[Closed] Privacy In Danger bug troubles

Computer forums for help with removing malicious software (malware) and improving computer security

Welcome Guest to What the Tech! ( Log In | Register ) We specialize in the removal of malicious software (malware), but here you'll find free help and support for all your tech questions. We invite you to ask questions, share experiences, and learn. Explore our message boards, or register now to post messages of your own. Please Start Here. Register today (registration removes advertising)

What the Tech > Spyware / Malware / Virus Removal > HijackThis™ Logs and Infections Removal

2 Pages

1 2 >

[Closed] Privacy In Danger bug troubles, Help would be mucho appreciated

Options

Swage View Member Profile	Jun 19 2008, 10:07 PM Post #1
New Member Group: New Member Posts: 11 Joined: 19-June 08 Member No.: 79,754 Operating System: Windows XP	Hey, New member here. I seem to have gotten the bug with the red screen and the 'privacy in danger' business. The only progress I've been able to make is getting my task manager to work again. I'm not sure what to do next. I downloaded your application and this is my log: (Any help would be awesome, thanks guys) Logfile of HijackThis v1.99.1 Scan saved at 23:52:22, on 6/19/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wltrysvc.exe C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE C:\DOCUME~1\OWNER~1.SWA\LOCALS~1\Temp\winlogan.exe C:\WINDOWS\system32\drivers\spools.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\Wtablet\TabUserW.exe C:\Program Files\BigFix\bigfix.exe C:\Program Files\Last.fm\LastFMHelper.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS C:\WINDOWS\system32\svchost.exe C:\Program Files\Streamload\MediaMax XL\StreamloadService.exe C:\WINDOWS\system32\Tablet.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\antiviirus.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\tmp0.exe C:\Program Files\tmp1.exe C:\Program Files\tmp2.exe C:\DOCUME~1\OWNER~1.SWA\LOCALS~1\Temp\csrssc.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Hijackthis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=...6Ojg5&lid=2 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.gateway.com/g/sidepanel.html?Ch...TB&M=MX6445 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://127.0.0.1:4664/first_usage&s=3q...W3DQiJdPLJXe9tc R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: C:\WINDOWS\system32\jfiehayd.dll - {c5af49a2-94f3-42bd-f434-2604812c897d} - C:\WINDOWS\system32\jfiehayd.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Zend Studio - {95188727-288F-4581-A48D-EAB3BD027314} - C:\PROGRA~1\Zend\ZENDST~1.0\bin\ZENDIE~1.DLL O4 - HKLM\..\Run: [jdgf894jrghoiiskd] C:\DOCUME~1\OWNER~1.SWA\LOCALS~1\Temp\winlogan.exe O4 - HKLM\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe O4 - HKLM\..\Run: [autoload] C:\Documents and Settings\Owner.SWAGE\cftmon.exe O4 - HKLM\..\Run: [C:\WINDOWS\system32\kdxbv.exe] C:\WINDOWS\system32\kdxbv.exe O4 - HKLM\..\Run: [antiviirus] C:\Program Files\antiviirus.exe O4 - HKCU\..\Run: [jdgf894jrghoiiskd] C:\DOCUME~1\OWNER~1.SWA\LOCALS~1\Temp\winlogan.exe O4 - HKCU\..\Run: [ntuser] C:\WINDOWS\system32\drivers\spools.exe O4 - HKCU\..\Run: [autoload] C:\Documents and Settings\Owner.SWAGE\cftmon.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Jnskdfmf9eldfd] C:\DOCUME~1\OWNER~1.SWA\LOCALS~1\Temp\csrssc.exe O4 - Startup: Last.fm Helper.lnk = C:\Program Files\Last.fm\LastFMHelper.exe O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ? O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: BigFix.lnk = C:\Program Files\BigFix\bigfix.exe O4 - Global Startup: TabUserW.exe.lnk = C:\WINDOWS\system32\Wtablet\TabUserW.exe O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Adobe Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Zend Studio - Debug current page - res://C:\Program Files\Zend\ZendStudio-5.5.0\bin\ZendIEToolbar.dll/DebugCurrent.html O8 - Extra context menu item: Zend Studio - Debug next page - res://C:\Program Files\Zend\ZendStudio-5.5.0\bin\ZendIEToolbar.dll/DebugNext.html O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Zend Studio Toolbar - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - C:\PROGRA~1\Zend\ZENDST~1.0\bin\ZENDIE~1.DLL O9 - Extra 'Tools' menuitem: Zend Studio - {A26ABCF0-1C8F-46e7-A67C-0489DC21B9CC} - C:\PROGRA~1\Zend\ZENDST~1.0\bin\ZENDIE~1.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc...ash/swflash.cab O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\WI1F86~1\MESSEN~1\MSGRAP~1.DLL O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~1\GOEC62~1.DLL,wbsys.dll O20 - Winlogon Notify: iifdbyqi - iifdbYQI.dll (file missing) O20 - Winlogon Notify: WB - C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\fastload.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O21 - SSODL: CDUnknown - {bd38d4bf-a9a3-4b55-a529-9a4b26693bab} - C:\WINDOWS\Resources\CDUnknown.dll O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS O23 - Service: Task Scheduler (Schedule) - Unknown owner - C:\WINDOWS\system32\drivers\spools.exe O23 - Service: Streamload Service (StreamloadService) - Streamload - C:\Program Files\Streamload\MediaMax XL\StreamloadService.exe O23 - Service: TabletService - Wacom Technology, Corp. - C:\WINDOWS\system32\Tablet.exe O23 - Service: Windows Network Log Manage - Unknown owner - C:\Program Files\Common Files\Microsoft Shared\MSInfo\Network.exe O23 - Service: Broadcom Wireless LAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\wltrysvc.exe

Gary R View Member Profile	Jun 20 2008, 09:22 AM Post #2
Advanced Member Group: Malware Team Posts: 930 Joined: 25-July 06 From: Yorkshire, England Member No.: 58,927 Operating System: XP	QUOTE Please note that all instructions given are customised for this computer only, the tools used may cause damage if used on a computer with different infections. If you think you have similar problems, please post a log in the HJT forum and wait for help. Unless informed of in advance, failure to post replies within 5 days will result in this thread being closed. Hi swage I'm Gary R, I'll be glad to help you with your computer problems. Please observe these rules while we work: Perform all actions in the order given. If you don't know, stop and ask! Don't keep going on. Please reply to this thread. Do not start a new topic. Stick with it till you're given the all clear. Remember, absence of symptoms does not mean the infection is all gone. If you can do these things, everything should go smoothly. If you're using XP, you'll need Administrator privileges to perform the fixes. (XP accounts are Administrator by default) If you're using Vista, it will be necessary to right click all tools we use and select ----> Run as Admistrator QUOTE It may be helpful to you to print out or take a copy of any instructions given, as sometimes it is necessary to go offline and you will lose access to them. Download SDFix and save it to your Desktop. Double click SDFix.exe Accept default location and click Install button. It will now extract the files to C:\SDFix Reboot your computer into Safe Mode by doing the following : Restart your computer After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually; Instead of Windows loading as normal, the Advanced Options Menu should appear; Select the first option, to run Windows in Safe Mode, then press Enter. Choose your usual account. Note: if you cannot boot into safe mode using this method, DO NOT attempt to do so by using MSConfig, this could result in your computer becoming unbootable. Just let me know. Once in safe mode. Open the extracted SDFix folder and double click RunThis.bat to start the script. Type Y to begin the cleanup process. It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot. Press any Key and it will restart the PC. When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons. Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt (Report.txt will also be copied to Clipboard ready for posting back on the forum). Finally paste me the contents of Report.txt Next Please download Malwarebytes' Anti-Malware to your Desktop. Double-click mbam-setup.exe and follow the prompts to install the program. Click on the Malwarebytes' Anti-Malware icon to launch the programme. Click the Updates tab. Click Check for Updates and allow the programme to download the latest definitions. Click the Scanner tab. Check Perform Quick Scan. Click Scan and wait for the scan to complete. When the scan is complete, click OK, then Show Results. Ensure all items are checked then click Remove Selected. A box will pop-up telling you that files have been quarantined. A log will pop-up. Post the log in your next reply please. You can also access the log by doing the following Click on the Logs tab. Click on the log at the bottom of those listed to highlight it. Click Open Next Run a new scan with HJT and post me the log please. Summary of the logs I need from you in your next post: SDFix log (report.txt) MBAM log New HJT log Please post each log separately to prevent them being cut off by the forum post size limiter. This post has been edited by Gary R: Jun 20 2008, 09:25 AM

Swage View Member Profile	Jun 20 2008, 11:44 AM Post #3
New Member Group: New Member Posts: 11 Joined: 19-June 08 Member No.: 79,754 Operating System: Windows XP	Hey, here's the first report: SDFix: Version 1.195 Run by Administrator on Fri 06/20/2008 at 12:02 PM Microsoft Windows XP [Version 5.1.2600] Running From: C:\SDFix Checking Services : Name : pqasghjd Path : \??\C:\WINDOWS\system32\pqasghjd.sys pqasghjd - Deleted Restoring Windows Registry Values Restoring Windows Default Hosts File Restoring Default Schedule Service Path Rebooting Checking Files : Trojan Files Found: C:\WINDOWS\Resources\CDUnknown.dll - Deleted C:\WINDOWS\system32\jfiehayd.dll - Deleted C:\WINDOWS\system32\kdxbv.exe - Deleted C:\Documents and Settings\LocalService\cftmon.exe - Deleted C:\Documents and Settings\Owner.SWAGE\cftmon.exe - Deleted C:\Program Files\tmp0.exe - Deleted C:\Program Files\tmp1.exe - Deleted C:\Program Files\tmp2.exe - Deleted C:\Program Files\antiviirus.exe - Deleted C:\WINDOWS\system32\689371\689371.dll - Deleted C:\WINDOWS\system32\drivers\spools.exe - Deleted C:\WINDOWS\system32\pqasghjd.sys - Deleted Folder C:\WINDOWS\system32\689371 - Removed Removing Temp Files ADS Check : Final Check : catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-20 12:48:36 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\controlset003\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}\Properties] "DeviceType"=dword:00000002 "DeviceCharacteristics"=dword:00000100 [HKEY_LOCAL_MACHINE\SYSTEM\controlset003\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}\Properties] "DeviceType"=dword:00000007 "DeviceCharacteristics"=dword:00000100 [HKEY_LOCAL_MACHINE\SYSTEM\controlset003\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\Properties] "DeviceType"=dword:00000023 "DeviceCharacteristics"=dword:00000100 [HKEY_LOCAL_MACHINE\SYSTEM\controlset003\Control\Class\{4D36E969-E325-11CE-BFC1-08002BE10318}\Properties] "DeviceType"=dword:00000004 "DeviceCharacteristics"=dword:00000100 [HKEY_LOCAL_MACHINE\SYSTEM\controlset003\Control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}\Properties] "DeviceType"=dword:00000004 "DeviceCharacteristics"=dword:00000100 [HKEY_LOCAL_MACHINE\SYSTEM\controlset003\Control\Class\{4D36E97B-E325-11CE-BFC1-08002BE10318}\Properties] "DeviceType"=dword:00000004 "DeviceCharacteristics"=dword:00000100 [HKEY_LOCAL_MACHINE\SYSTEM\controlset003\Control\Class\{4D36E980-E325-11CE-BFC1-08002BE10318}\Properties] "DeviceType"=dword:00000007 "DeviceCharacteristics"=dword:00000100 [HKEY_LOCAL_MACHINE\SYSTEM\controlset003\Services\MRxDAV\EncryptedDirectories] @="" scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services : Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe::enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe::Enabled:AOL Application Loader" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe::Enabled:AOL" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe::Enabled:AOL" "C:\\Program Files\\America Online 9.0\\waol.exe"="C:\\Program Files\\America Online 9.0\\waol.exe::Enabled:AOL" "C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"="C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe::Enabled:AOLTsMon" "C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"="C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe::Enabled:AOLTopSpeed" "C:\\Program Files\\Common Files\\AOL\\1156198756\\EE\\AOLServiceHost.exe"="C:\\Program Files\\Common Files\\AOL\\1156198756\\EE\\AOLServiceHost.exe::Enabled:AOL" "C:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"="C:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe::Enabled:AOL" "C:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\AOLSP Scheduler.exe"="C:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\AOLSP Scheduler.exe::Enabled:AOL" "C:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\asp.exe"="C:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\asp.exe::Enabled:AOL" "C:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"="C:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe::Enabled:AOL" "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe::Enabled:Yahoo! Messenger" "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe::Enabled:Yahoo! FT Server" "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe::Enabled:Windows Messenger" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe::Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\SmartFTP Client 2.0\\SmartFTP.exe"="C:\\Program Files\\SmartFTP Client 2.0\\SmartFTP.exe::Enabled:SmartFTP Client 2.0" "C:\\Program Files\\Trillian\\trillian.exe"="C:\\Program Files\\Trillian\\trillian.exe::Enabled:Trillian" "C:\\Program Files\\Zend\\ZendStudio-5.5.0\\jre\\bin\\javaw.exe"="C:\\Program Files\\Zend\\ZendStudio-5.5.0\\jre\\bin\\javaw.exe::Enabled:Java™ 2 Platform Standard Edition binary" "C:\\Program Files\\Eagletron\\DVdriver\\dvdriver.exe"="C:\\Program Files\\Eagletron\\DVdriver\\dvdriver.exe::Enabled:dvdriver application" "C:\\StubInstaller.exe"="C:\\StubInstaller.exe::Enabled:LimeWire swarmed installer" "C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe::Enabled:LimeWire" "C:\\WINDOWS\\system32\\rtcshare.exe"="C:\\WINDOWS\\system32\\rtcshare.exe::Enabled:RTC App Sharing" "C:\\Program Files\\NetMeeting\\conf.exe"="C:\\Program Files\\NetMeeting\\conf.exe::Enabled:Windowsr NetMeetingr" "C:\\Program Files\\Last.fm\\LastFM.exe"="C:\\Program Files\\Last.fm\\LastFM.exe::Enabled:Last.fm" "C:\\Program Files\\BitTorrent\\bittorrent.exe"="C:\\Program Files\\BitTorrent\\bittorrent.exe::Enabled:BitTorrent" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe::Enabled:Skype. Take a deep breath " "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe::Enabled:Windows Live Messenger" "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe::Enabled:Windows Live Messenger (Phone)" "C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"="C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe::Enabled:MySpaceIM" "C:\\Program Files\\DNA\\btdna.exe"="C:\\Program Files\\DNA\\btdna.exe::Enabled:DNA" "C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"="C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe::Enabled:Remote Assistance - Windows Messenger and Voice" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe::enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe::Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe::Enabled:Windows Live Messenger" "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe::Enabled:Windows Live Messenger (Phone)" Remaining Files : File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes : Fri 20 Jun 2008 15,505 ...H. --- "C:\Documents and Settings\Owner.SWAGE\Local Settings\Temp\csrssc.exe" Thu 19 Jun 2008 656,384 ..SHR --- "C:\Program Files\Common Files\Microsoft Shared\MSInfo\Network.exe" Fri 4 Jan 2008 25,755,448 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\994c1468d4935bc76995dbdc97f68a9e\BIT1A0.tmp" Fri 11 Apr 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\a7b63628b39fd8bdb7e535e34d0ea696\BIT1.tmp" Wed 7 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\fd0264849c01086f3c6b505dc02dbd44\BIT1.tmp" Fri 4 Jan 2008 3,510,048 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\ff092e346491ca97b0770b2040feb1de\BIT1A1.tmp" Thu 7 Dec 2006 3,096,576 A..H. --- "C:\Documents and Settings\Owner.SWAGE\Application Data\U3\temp\Launchpad Removal.exe" Finished!

Swage View Member Profile	Jun 20 2008, 11:47 AM Post #4
New Member Group: New Member Posts: 11 Joined: 19-June 08 Member No.: 79,754 Operating System: Windows XP	Hey, here's the first report: SDFix: Version 1.195 Run by Administrator on Fri 06/20/2008 at 12:02 PM Microsoft Windows XP [Version 5.1.2600] Running From: C:\SDFix Checking Services : Name : pqasghjd Path : \??\C:\WINDOWS\system32\pqasghjd.sys pqasghjd - Deleted Restoring Windows Registry Values Restoring Windows Default Hosts File Restoring Default Schedule Service Path Rebooting Checking Files : Trojan Files Found: C:\WINDOWS\Resources\CDUnknown.dll - Deleted C:\WINDOWS\system32\jfiehayd.dll - Deleted C:\WINDOWS\system32\kdxbv.exe - Deleted C:\Documents and Settings\LocalService\cftmon.exe - Deleted C:\Documents and Settings\Owner.SWAGE\cftmon.exe - Deleted C:\Program Files\tmp0.exe - Deleted C:\Program Files\tmp1.exe - Deleted C:\Program Files\tmp2.exe - Deleted C:\Program Files\antiviirus.exe - Deleted C:\WINDOWS\system32\689371\689371.dll - Deleted C:\WINDOWS\system32\drivers\spools.exe - Deleted C:\WINDOWS\system32\pqasghjd.sys - Deleted Folder C:\WINDOWS\system32\689371 - Removed Removing Temp Files ADS Check : Final Check : catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-20 12:48:36 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\controlset003\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}\Properties] "DeviceType"=dword:00000002 "DeviceCharacteristics"=dword:00000100 [HKEY_LOCAL_MACHINE\SYSTEM\controlset003\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}\Properties] "DeviceType"=dword:00000007 "DeviceCharacteristics"=dword:00000100 [HKEY_LOCAL_MACHINE\SYSTEM\controlset003\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\Properties] "DeviceType"=dword:00000023 "DeviceCharacteristics"=dword:00000100 [HKEY_LOCAL_MACHINE\SYSTEM\controlset003\Control\Class\{4D36E969-E325-11CE-BFC1-08002BE10318}\Properties] "DeviceType"=dword:00000004 "DeviceCharacteristics"=dword:00000100 [HKEY_LOCAL_MACHINE\SYSTEM\controlset003\Control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}\Properties] "DeviceType"=dword:00000004 "DeviceCharacteristics"=dword:00000100 [HKEY_LOCAL_MACHINE\SYSTEM\controlset003\Control\Class\{4D36E97B-E325-11CE-BFC1-08002BE10318}\Properties] "DeviceType"=dword:00000004 "DeviceCharacteristics"=dword:00000100 [HKEY_LOCAL_MACHINE\SYSTEM\controlset003\Control\Class\{4D36E980-E325-11CE-BFC1-08002BE10318}\Properties] "DeviceType"=dword:00000007 "DeviceCharacteristics"=dword:00000100 [HKEY_LOCAL_MACHINE\SYSTEM\controlset003\Services\MRxDAV\EncryptedDirectories] @="" scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services : Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe::enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe::Enabled:AOL Application Loader" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe::Enabled:AOL" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe::Enabled:AOL" "C:\\Program Files\\America Online 9.0\\waol.exe"="C:\\Program Files\\America Online 9.0\\waol.exe::Enabled:AOL" "C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"="C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe::Enabled:AOLTsMon" "C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"="C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe::Enabled:AOLTopSpeed" "C:\\Program Files\\Common Files\\AOL\\1156198756\\EE\\AOLServiceHost.exe"="C:\\Program Files\\Common Files\\AOL\\1156198756\\EE\\AOLServiceHost.exe::Enabled:AOL" "C:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"="C:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe::Enabled:AOL" "C:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\AOLSP Scheduler.exe"="C:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\AOLSP Scheduler.exe::Enabled:AOL" "C:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\asp.exe"="C:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\asp.exe::Enabled:AOL" "C:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"="C:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe::Enabled:AOL" "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe::Enabled:Yahoo! Messenger" "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe::Enabled:Yahoo! FT Server" "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe::Enabled:Windows Messenger" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe::Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\SmartFTP Client 2.0\\SmartFTP.exe"="C:\\Program Files\\SmartFTP Client 2.0\\SmartFTP.exe::Enabled:SmartFTP Client 2.0" "C:\\Program Files\\Trillian\\trillian.exe"="C:\\Program Files\\Trillian\\trillian.exe::Enabled:Trillian" "C:\\Program Files\\Zend\\ZendStudio-5.5.0\\jre\\bin\\javaw.exe"="C:\\Program Files\\Zend\\ZendStudio-5.5.0\\jre\\bin\\javaw.exe::Enabled:Java™ 2 Platform Standard Edition binary" "C:\\Program Files\\Eagletron\\DVdriver\\dvdriver.exe"="C:\\Program Files\\Eagletron\\DVdriver\\dvdriver.exe::Enabled:dvdriver application" "C:\\StubInstaller.exe"="C:\\StubInstaller.exe::Enabled:LimeWire swarmed installer" "C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe::Enabled:LimeWire" "C:\\WINDOWS\\system32\\rtcshare.exe"="C:\\WINDOWS\\system32\\rtcshare.exe::Enabled:RTC App Sharing" "C:\\Program Files\\NetMeeting\\conf.exe"="C:\\Program Files\\NetMeeting\\conf.exe::Enabled:Windowsr NetMeetingr" "C:\\Program Files\\Last.fm\\LastFM.exe"="C:\\Program Files\\Last.fm\\LastFM.exe::Enabled:Last.fm" "C:\\Program Files\\BitTorrent\\bittorrent.exe"="C:\\Program Files\\BitTorrent\\bittorrent.exe::Enabled:BitTorrent" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe::Enabled:Skype. Take a deep breath " "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe::Enabled:Windows Live Messenger" "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe::Enabled:Windows Live Messenger (Phone)" "C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"="C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe::Enabled:MySpaceIM" "C:\\Program Files\\DNA\\btdna.exe"="C:\\Program Files\\DNA\\btdna.exe::Enabled:DNA" "C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"="C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe::Enabled:Remote Assistance - Windows Messenger and Voice" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe::enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe::Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe::Enabled:Windows Live Messenger" "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe::Enabled:Windows Live Messenger (Phone)" Remaining Files : File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes : Fri 20 Jun 2008 15,505 ...H. --- "C:\Documents and Settings\Owner.SWAGE\Local Settings\Temp\csrssc.exe" Thu 19 Jun 2008 656,384 ..SHR --- "C:\Program Files\Common Files\Microsoft Shared\MSInfo\Network.exe" Fri 4 Jan 2008 25,755,448 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\994c1468d4935bc76995dbdc97f68a9e\BIT1A0.tmp" Fri 11 Apr 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\a7b63628b39fd8bdb7e535e34d0ea696\BIT1.tmp" Wed 7 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\fd0264849c01086f3c6b505dc02dbd44\BIT1.tmp" Fri 4 Jan 2008 3,510,048 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\ff092e346491ca97b0770b2040feb1de\BIT1A1.tmp" Thu 7 Dec 2006 3,096,576 A..H. --- "C:\Documents and Settings\Owner.SWAGE\Application Data\U3\temp\Launchpad Removal.exe" Finished!

Swage View Member Profile	Jun 20 2008, 11:48 AM Post #5
New Member Group: New Member Posts: 11 Joined: 19-June 08 Member No.: 79,754 Operating System: Windows XP	Hey, here's the first report: SDFix: Version 1.195 Run by Administrator on Fri 06/20/2008 at 12:02 PM Microsoft Windows XP [Version 5.1.2600] Running From: C:\SDFix Checking Services : Name : pqasghjd Path : \??\C:\WINDOWS\system32\pqasghjd.sys pqasghjd - Deleted Restoring Windows Registry Values Restoring Windows Default Hosts File Restoring Default Schedule Service Path Rebooting Checking Files : Trojan Files Found: C:\WINDOWS\Resources\CDUnknown.dll - Deleted C:\WINDOWS\system32\jfiehayd.dll - Deleted C:\WINDOWS\system32\kdxbv.exe - Deleted C:\Documents and Settings\LocalService\cftmon.exe - Deleted C:\Documents and Settings\Owner.SWAGE\cftmon.exe - Deleted C:\Program Files\tmp0.exe - Deleted C:\Program Files\tmp1.exe - Deleted C:\Program Files\tmp2.exe - Deleted C:\Program Files\antiviirus.exe - Deleted C:\WINDOWS\system32\689371\689371.dll - Deleted C:\WINDOWS\system32\drivers\spools.exe - Deleted C:\WINDOWS\system32\pqasghjd.sys - Deleted Folder C:\WINDOWS\system32\689371 - Removed Removing Temp Files ADS Check : Final Check : catchme 0.3.1361.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-06-20 12:48:36 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden services & system hive ... [HKEY_LOCAL_MACHINE\SYSTEM\controlset003\Control\Class\{4D36E965-E325-11CE-BFC1-08002BE10318}\Properties] "DeviceType"=dword:00000002 "DeviceCharacteristics"=dword:00000100 [HKEY_LOCAL_MACHINE\SYSTEM\controlset003\Control\Class\{4D36E967-E325-11CE-BFC1-08002BE10318}\Properties] "DeviceType"=dword:00000007 "DeviceCharacteristics"=dword:00000100 [HKEY_LOCAL_MACHINE\SYSTEM\controlset003\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\Properties] "DeviceType"=dword:00000023 "DeviceCharacteristics"=dword:00000100 [HKEY_LOCAL_MACHINE\SYSTEM\controlset003\Control\Class\{4D36E969-E325-11CE-BFC1-08002BE10318}\Properties] "DeviceType"=dword:00000004 "DeviceCharacteristics"=dword:00000100 [HKEY_LOCAL_MACHINE\SYSTEM\controlset003\Control\Class\{4D36E96A-E325-11CE-BFC1-08002BE10318}\Properties] "DeviceType"=dword:00000004 "DeviceCharacteristics"=dword:00000100 [HKEY_LOCAL_MACHINE\SYSTEM\controlset003\Control\Class\{4D36E97B-E325-11CE-BFC1-08002BE10318}\Properties] "DeviceType"=dword:00000004 "DeviceCharacteristics"=dword:00000100 [HKEY_LOCAL_MACHINE\SYSTEM\controlset003\Control\Class\{4D36E980-E325-11CE-BFC1-08002BE10318}\Properties] "DeviceType"=dword:00000007 "DeviceCharacteristics"=dword:00000100 [HKEY_LOCAL_MACHINE\SYSTEM\controlset003\Services\MRxDAV\EncryptedDirectories] @="" scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden processes: 0 hidden services: 0 hidden files: 0 Remaining Services : Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe::enabled:@xpsp2res.dll,-22019" "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe::Enabled:AOL Application Loader" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLDial.exe::Enabled:AOL" "C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe"="C:\\Program Files\\Common Files\\AOL\\ACS\\AOLacsd.exe::Enabled:AOL" "C:\\Program Files\\America Online 9.0\\waol.exe"="C:\\Program Files\\America Online 9.0\\waol.exe::Enabled:AOL" "C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe"="C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltsmon.exe::Enabled:AOLTsMon" "C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe"="C:\\Program Files\\Common Files\\AOL\\TopSpeed\\2.0\\aoltpspd.exe::Enabled:AOLTopSpeed" "C:\\Program Files\\Common Files\\AOL\\1156198756\\EE\\AOLServiceHost.exe"="C:\\Program Files\\Common Files\\AOL\\1156198756\\EE\\AOLServiceHost.exe::Enabled:AOL" "C:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe"="C:\\Program Files\\Common Files\\AOL\\System Information\\sinf.exe::Enabled:AOL" "C:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\AOLSP Scheduler.exe"="C:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\AOLSP Scheduler.exe::Enabled:AOL" "C:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\asp.exe"="C:\\Program Files\\Common Files\\AOL\\AOL Spyware Protection\\asp.exe::Enabled:AOL" "C:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe"="C:\\Program Files\\Common Files\\AolCoach\\en_en\\player\\AOLNySEV.exe::Enabled:AOL" "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe::Enabled:Yahoo! Messenger" "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"="C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe::Enabled:Yahoo! FT Server" "C:\\Program Files\\Messenger\\msmsgs.exe"="C:\\Program Files\\Messenger\\msmsgs.exe::Enabled:Windows Messenger" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe::Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\SmartFTP Client 2.0\\SmartFTP.exe"="C:\\Program Files\\SmartFTP Client 2.0\\SmartFTP.exe::Enabled:SmartFTP Client 2.0" "C:\\Program Files\\Trillian\\trillian.exe"="C:\\Program Files\\Trillian\\trillian.exe::Enabled:Trillian" "C:\\Program Files\\Zend\\ZendStudio-5.5.0\\jre\\bin\\javaw.exe"="C:\\Program Files\\Zend\\ZendStudio-5.5.0\\jre\\bin\\javaw.exe::Enabled:Java™ 2 Platform Standard Edition binary" "C:\\Program Files\\Eagletron\\DVdriver\\dvdriver.exe"="C:\\Program Files\\Eagletron\\DVdriver\\dvdriver.exe::Enabled:dvdriver application" "C:\\StubInstaller.exe"="C:\\StubInstaller.exe::Enabled:LimeWire swarmed installer" "C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe::Enabled:LimeWire" "C:\\WINDOWS\\system32\\rtcshare.exe"="C:\\WINDOWS\\system32\\rtcshare.exe::Enabled:RTC App Sharing" "C:\\Program Files\\NetMeeting\\conf.exe"="C:\\Program Files\\NetMeeting\\conf.exe::Enabled:Windowsr NetMeetingr" "C:\\Program Files\\Last.fm\\LastFM.exe"="C:\\Program Files\\Last.fm\\LastFM.exe::Enabled:Last.fm" "C:\\Program Files\\BitTorrent\\bittorrent.exe"="C:\\Program Files\\BitTorrent\\bittorrent.exe::Enabled:BitTorrent" "C:\\Program Files\\Skype\\Phone\\Skype.exe"="C:\\Program Files\\Skype\\Phone\\Skype.exe::Enabled:Skype. Take a deep breath " "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe::Enabled:Windows Live Messenger" "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe::Enabled:Windows Live Messenger (Phone)" "C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"="C:\\Program Files\\MySpace\\IM\\MySpaceIM.exe::Enabled:MySpaceIM" "C:\\Program Files\\DNA\\btdna.exe"="C:\\Program Files\\DNA\\btdna.exe::Enabled:DNA" "C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe"="C:\\WINDOWS\\pchealth\\helpctr\\binaries\\HelpCtr.exe::Enabled:Remote Assistance - Windows Messenger and Voice" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe::enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe::Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"="C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe::Enabled:Windows Live Messenger" "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"="C:\\Program Files\\Windows Live\\Messenger\\livecall.exe::Enabled:Windows Live Messenger (Phone)" Remaining Files : File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes : Fri 20 Jun 2008 15,505 ...H. --- "C:\Documents and Settings\Owner.SWAGE\Local Settings\Temp\csrssc.exe" Thu 19 Jun 2008 656,384 ..SHR --- "C:\Program Files\Common Files\Microsoft Shared\MSInfo\Network.exe" Fri 4 Jan 2008 25,755,448 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\994c1468d4935bc76995dbdc97f68a9e\BIT1A0.tmp" Fri 11 Apr 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\a7b63628b39fd8bdb7e535e34d0ea696\BIT1.tmp" Wed 7 May 2008 0 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\fd0264849c01086f3c6b505dc02dbd44\BIT1.tmp" Fri 4 Jan 2008 3,510,048 A..H. --- "C:\WINDOWS\SoftwareDistribution\Download\ff092e346491ca97b0770b2040feb1de\BIT1A1.tmp" Thu 7 Dec 2006 3,096,576 A..H. --- "C:\Documents and Settings\Owner.SWAGE\Application Data\U3\temp\Launchpad Removal.exe" Finished!

Swage View Member Profile	Jun 20 2008, 11:52 AM Post #6
New Member Group: New Member Posts: 11 Joined: 19-June 08 Member No.: 79,754 Operating System: Windows XP	Malwarebytes' Anti-Malware 1.18 Database version: 871 1:41:28 PM 6/20/2008 mbam-log-6-20-2008 (13-41-25).txt Scan type: Quick Scan Objects scanned: 47457 Time elapsed: 8 minute(s), 24 second(s) Memory Processes Infected: 3 Memory Modules Infected: 0 Registry Keys Infected: 7 Registry Values Infected: 5 Registry Data Items Infected: 1 Folders Infected: 3 Files Infected: 23 Memory Processes Infected: C:\Documents and Settings\Owner.SWAGE\Local Settings\Temp\winlogan.exe (Trojan.Downloader) -> No action taken. C:\Documents and Settings\Owner.SWAGE\Local Settings\Temp\csrssc.exe (Trojan.Downloader) -> No action taken. C:\Documents and Settings\Owner.SWAGE\Local Settings\Temp\csrssc.exe (Trojan.Downloader) -> No action taken. Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CURRENT_USER\Software\UpMedia (Adware.SmartShopper) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> No action taken. HKEY_CURRENT_USER\Software\Adsl Software Limited (Rogue.MalWarrior) -> No action taken. HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> No action taken. HKEY_CLASSES_ROOT\CLSID\{0351d11c-1087-4a1e-b4f6-586a144059ff} (Trojan.Vundo) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> No action taken. Registry Values Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jdgf894jrghoiiskd (Trojan.Downloader) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\jdgf894jrghoiiskd (Trojan.Downloader) -> No action taken. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Jnskdfmf9eldfd (Trojan.Downloader) -> No action taken. HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Main\Start Page (Trojan.FakeAlert) -> No action taken. HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Settings\mu (Trojan.Agent) -> No action taken. Registry Data Items Infected: HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions (Hijack.FolderOptions) -> Bad: (1) Good: (0) -> No action taken. Folders Infected: C:\WINDOWS\system32\UpMedia (Adware.SmartShopper) -> No action taken. C:\Documents and Settings\All Users\Application Data\Adsl Software Limited (Rogue.MalWarrior) -> No action taken. C:\Documents and Settings\All Users\Application Data\Adsl Software Limited\WinSpywareProtect (Rogue.MalWarrior) -> No action taken. Files Infected: C:\WINDOWS\system32\iiffGYon.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\noYGffii.ini (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\noYGffii.ini2 (Trojan.Vundo) -> No action taken. C:\Documents and Settings\Owner.SWAGE\Local Settings\Temp\winlogan.exe (Trojan.Downloader) -> No action taken. C:\Documents and Settings\Owner.SWAGE\Local Settings\Temp\csrssc.exe (Trojan.Downloader) -> No action taken. C:\WINDOWS\system32\awtuUMgE.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\rqRkIAst.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\yayyVnKd.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\eaqb.exe (Trojan.FakeAlert) -> No action taken. C:\nnjamld.exe (Trojan.Agent) -> No action taken. C:\ptgttuaq.exe (Trojan.FakeAlert) -> No action taken. C:\tqwkrav.exe (Trojan.Agent) -> No action taken. C:\Documents and Settings\Owner.SWAGE\Local Settings\Temporary Internet Files\Content.IE5\H0DO1CEW\luzznriima[1].htm (Trojan.Agent) -> No action taken. C:\Documents and Settings\Owner.SWAGE\Local Settings\Temporary Internet Files\Content.IE5\KO2L467U\dwxnbsj[1].htm (Trojan.Agent) -> No action taken. C:\Documents and Settings\Owner.SWAGE\Local Settings\Temporary Internet Files\Content.IE5\KO2L467U\tuylqdhim[1].htm (Trojan.FakeAlert) -> No action taken. C:\Documents and Settings\Owner.SWAGE\Local Settings\Temporary Internet Files\Content.IE5\P8XLK3P5\1279.0[1].exe (Trojan.FakeAlert) -> No action taken. C:\Documents and Settings\Owner.SWAGE\Local Settings\Temporary Internet Files\Content.IE5\PNYYG01O\tuhvzqdrv[1].htm (Trojan.FakeAlert) -> No action taken. C:\Documents and Settings\Owner.SWAGE\Local Settings\Temporary Internet Files\Content.IE5\PNYYG01O\wmvcodec2.03[1].exe (Trojan.Vundo) -> No action taken. C:\Documents and Settings\All Users\Application Data\Adsl Software Limited\WinSpywareProtect\WinSpywareProtect.exe (Rogue.MalWarrior) -> No action taken. C:\WINDOWS\system32\xxyWNeFx.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\gEwwWmJD.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\mlJYrRkj.dll (Trojan.Vundo) -> No action taken. C:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> No action taken.

Gary R View Member Profile	Jun 20 2008, 01:14 PM Post #7
Advanced Member Group: Malware Team Posts: 930 Joined: 25-July 06 From: Yorkshire, England Member No.: 58,927 Operating System: XP	You have not followed the directions for using MBAM as I gave them to you. Run the scan again, paying particular attention this time to the part highlighted in red. Double-click mbam-setup.exe and follow the prompts to install the program. Click on the Malwarebytes' Anti-Malware icon to launch the programme. Click the Updates tab. Click Check for Updates and allow the programme to download the latest definitions. Click the Scanner tab. Check Perform Quick Scan. Click Scan and wait for the scan to complete. When the scan is complete, click OK, then Show Results. Ensure all items are checked then click Remove Selected. A box will pop-up telling you that files have been quarantined. A log will pop-up. Post the log in your next reply please. You can also access the log by doing the following Click on the Logs tab. Click on the log at the bottom of those listed to highlight it. Click Open Don't forget to run a new scan with HJT and post me the log please This post has been edited by Gary R: Jun 20 2008, 01:15 PM

Swage

Jun 20 2008, 08:26 PM

Post #8

New Member

Group: New Member
Posts: 11
Joined: 19-June 08
Member No.: 79,754
Operating System: Windows XP

Hey,

Apologies about that, seconds after I posted the log I realized that I had missed a step, but before I could correct it, I lost my internet access... Really appreciate your help, this thing has been driving me crazy.

Malwarebytes' Anti-Malware 1.18
Database version: 871

1:54:49 PM 6/20/2008
mbam-log-6-20-2008 (13-54-49).txt

Scan type: Quick Scan
Objects scanned: 47457
Time elapsed: 8 minute(s), 24 second(s)

Memory Processes Infected: 3
Memory Modules Infected: 0
Registry Keys Infected: 7
Registry Values Infected: 5
Registry Data Items Infected: 1
Folders Infected: 3
Files Infected: 23

Memory Processes Infected:
C:\Documents and Settings\Owner.SWAGE\Local Settings\Temp\winlogan.exe (Trojan.Downloader) -> Unloaded process successfully.
C:\Documents and Settings\Owner.SWAGE\Local Settings\Temp\csrssc.exe (Trojan.Dow