[Closed] Sluggish response to UI actions + Google Redirect

What the Tech? It's as easy as 1,2,3! ( Log In | Register )

What the Tech > Spyware / Malware / Virus Removal > Infections Removal

[Closed] Sluggish response to UI actions + Google Redirect, Sluggish response to UI actions + Google Redirect

Options

calvin_hobbes View Member Profile	Apr 30 2009, 07:00 AM Post #1
Authentic Member Group: Authentic Member Posts: 60 Joined: 9-February 08 Member No.: 76,716 Operating System: windows XP	Hello to experts once again, Sometimes i wonder, despite the abundance of spyware/malware/AV checkers i have on the laptop, how do i land up with trojans/spyware/viruses etc.... anyways, problem description is, say every time i do a google search (in up-to-date mozilla firefox), the first time i click on the link, it redirects me to this strange website, with "Page Load Error" http://t.websearchmaster.net/?d=rAbyvfxBdx...-=-e576278d82c1 if i am not mistaken, then due to (mvp+spybot)hosts file entries, it gets blocked ==> thank goodness for this the second time i click on the same search link, i get a "404 Not Found" with URL pointing to http://www.google.com/undefined the third time i click on the same link, i finally am able to view the actual link site. Note, this occurs for almost every other link, and on every type of google search... computer has also, lately, been sluggish in response to UI commands, opening up Windows explorer, switching between tasks etc.. I have updated def files for Spybot R&D (with resident IE active), MVP Host file, MBAM, and Trend Micro Officescan NT. Below is HJT log included for your reference. Hope you gurus can help me once again. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 08:46:35 AM, on 04/30/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\WLTRYSVC.EXE C:\WINNT\System32\bcmwltry.exe C:\WINNT\system32\spoolsv.exe C:\Program Files\AccessManager\Client\AMBroker.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\iPass\iPassConnect\iPassPeriodicUpdateService.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINNT\System32\MCSvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\OfficeScan NT\ntrtscan.exe C:\WINNT\system32\Prot_srv.exe C:\WINNT\system32\pstartSr.exe C:\Program Files\AccessManager\PMAC\sp_SWIns.exe C:\Program Files\SigmaTel\C-Major Audio\WDM\StacSV.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\Suss.exe C:\Program Files\AccessManager\Client\sygman.exe C:\Program Files\OfficeScan NT\tmlisten.exe C:\WINNT\system32\CCM\CLICOMP\RemCtrl\Wuser32.exe C:\WINNT\system32\CCM\CcmExec.exe C:\WINNT\TEMP\GG3C15.EXE C:\Program Files\iPass\iPassConnect\iPassPeriodicUpdateApp.exe C:\Program Files\OfficeScan NT\TmPfw.exe C:\Program Files\OfficeScan NT\CNTAoSMgr.exe C:\WINNT\Explorer.EXE C:\Program Files\OfficeScan NT\pccntmon.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\WINNT\stsystra.exe C:\WINNT\system32\hkcmd.exe C:\WINNT\system32\igfxpers.exe C:\Program Files\AccessManager\Client\AccessMgr.exe C:\WINNT\system32\igfxsrvc.exe C:\WINNT\system32\WLTRAY.exe C:\WINNT\system32\taskswitch.exe C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe C:\Program Files\DellTPad\Apoint.exe C:\Program Files\WinPatrol\winpatrol.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\DellTPad\ApMsgFwd.exe C:\Program Files\DellTPad\HidFind.exe C:\Program Files\DellTPad\Apntex.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\iPass\iPassConnect\iPassConnectGUI.exe C:\Program Files\Pointsec\Pointsec for PC\P95Tray.exe C:\WINNT\system32\ctfmon.exe C:\Documents and Settings\vm092543\Local Settings\Application Data\Google\Update\GoogleUpdate.exe C:\Program Files\Spybot\TeaTimer.exe C:\Program Files\iPass\iPassConnect\iPassConnectEngine.exe C:\Program Files\Copernic Desktop Search\DesktopSearchService.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\interwise\Participant\pull.exe C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Nokia\Nokia PC Suite 7\PcSync2.exe C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtKbd.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtBty.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE C:\Program Files\MCollect\MPCMon.exe C:\WINNT\explorer.exe C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe C:\Program Files\PC Connectivity Solution\Transports\NclToBTSrv.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\SvcLncher.exe C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe C:\Program Files\Password Safe\pwsafe.exe C:\WINNT\system32\HPZinw12.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://inside.nokiasiemensnetworks.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://inside.nokiasiemensnetworks.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by NSN R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxyconf.glb.nsn-net.net/proxy.pac O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot\SDHelper.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Copernic Desktop Search - Home Toolbar - {4A1C6093-14F9-44D7-860E-5D265CFCA9D9} - C:\Program Files\Copernic Desktop Search\Toolbar\ToolbarContainer101000311.dll O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\OfficeScan NT\pccntmon.exe" -HideWindow O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [WinZip Quick Pick] C:\Program Files\WinZip\WZQKPICK.EXE O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\WINNT\system32\igfxpers.exe O4 - HKLM\..\Run: [AccessManager] C:\Program Files\AccessManager\Client\AccessMgr.exe O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINNT\system32\WLTRAY.exe O4 - HKLM\..\Run: [CoolSwitch] C:\WINNT\system32\taskswitch.exe O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\WinPatrol\winpatrol.exe -expressboot O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [iPassConnect] "C:\Program Files\iPass\iPassConnect\iPassConnectGUI.exe" /S O4 - HKLM\..\Run: [Pointsec Tray] C:\Program Files\Pointsec\Pointsec for PC\P95Tray.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\vm092543\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot\TeaTimer.exe O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [Copernic Desktop Search - Home] "C:\Program Files\Copernic Desktop Search\DesktopSearchService.exe" /tray O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Bluetooth Manager.lnk = ? O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Push Client.LNK = C:\Program Files\interwise\Participant\pull.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Edit with Altova X&MLSpy - C:\Program Files\Altova\XMLSpy2008\spy.htm O9 - Extra button: Edit with Altova X&MLSpy - {2222EF56-F49E-4d07-A14E-8D2B08766958} - C:\Program Files\Altova\XMLSpy2008\spy.htm O9 - Extra 'Tools' menuitem: Edit with Altova X&MLSpy - {2222EF56-F49E-4d07-A14E-8D2B08766958} - C:\Program Files\Altova\XMLSpy2008\spy.htm O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINNT\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINNT\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=https://inside.nokiasiemensnetworks.com O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1230590012390 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1230592905812 O16 - DPF: {7261EE42-318E-490A-AE8F-77649DBA1ECA} (JNILoader Control) - https://xesp-nsnst004.inside.nokiasiemensne...STJNILoader.cab O16 - DPF: {8D9563A9-8D5F-459B-87F2-BA842255CB9A} (Whale Client Components) - https://bpsn.inside.nokiasiemensnetworks.co.../WhlCompMgr.cab O16 - DPF: {D3E01836-60CD-480D-BBDB-19D5A7D23128} (Xerox_Services_Portal.XrxPrinter_Inst) - https://office.services.xerox.com/XeroxServ...Portal_Pref.CAB O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://apertio.webex.com/client/T27L/webex/ieatgpc.cab O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = nsn-intra.net O17 - HKLM\Software\..\Telephony: DomainName = nsn-intra.net O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = nsn-intra.net O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = nsn-intra.net O23 - Service: Access Manager Configuration Service (AMBroker) - MCI, Inc. - C:\Program Files\AccessManager\Client\AMBroker.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Visual Insight DA Plugin (DAPlugin) - MCI, Inc. - C:\Program Files\AccessManager\Client\DAPlugin.exe O23 - Service: Contivity VPN Service (ExtranetAccess) - Nortel Networks NA, Inc. - C:\Program Files\IP VPN Remote Services\Extranet_serv.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINNT\system32\spool\drivers\w32x86\3\HPBPRO.EXE O23 - Service: HTTP Poster Service (HTTP Poster) - Nokia - C:\WINNT\system32\HTTP_Poster.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPassConnectEngine - iPass, Inc. - C:\Program Files\iPass\iPassConnect\iPassConnectEngine.exe O23 - Service: iPassPeriodicUpdateApp - iPass, Inc. - C:\Program Files\iPass\iPassConnect\iPassPeriodicUpdateApp.exe O23 - Service: iPassPeriodicUpdateService - iPass, Inc. - C:\Program Files\iPass\iPassConnect\iPassPeriodicUpdateService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Managed Client Service (MCsvc) - © 2005 - 2008 Siemens AG - C:\WINNT\System32\MCSvc.exe O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\OfficeScan NT\ntrtscan.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe O23 - Service: Pointsec - Unknown owner - C:\WINNT\system32\Prot_srv.exe O23 - Service: Pointsec Service Start (Pointsec_start) - Unknown owner - C:\WINNT\system32\pstartSr.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe O23 - Service: Service Launcher - SIS GO GIO DS PSU6 - C:\WINNT\system32\SvcLncher.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: SP Software Installer - Smartpipes, Inc. - C:\Program Files\AccessManager\PMAC\sp_SWIns.exe O23 - Service: Visual Insight Dial Analysis (sp_spi_da) - Smartpipes, Inc. - C:\Program Files\AccessManager\SMOC\spi_da.exe O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\StacSV.exe O23 - Service: SSA Integration Manager (Sygman) - MCI, Inc. - C:\Program Files\AccessManager\Client\sygman.exe O23 - Service: OfficeScan NT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\OfficeScan NT\tmlisten.exe O23 - Service: OfficeScanNT Personal Firewall (TmPfw) - Trend Micro Inc. - C:\Program Files\OfficeScan NT\TmPfw.exe O23 - Service: OfficeScan NT Proxy Service (TmProxy) - Trend Micro Inc. - C:\Program Files\OfficeScan NT\TmProxy.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINNT\System32\WLTRYSVC.EXE -- End of file - 16088 bytes

Tomk View Member Profile	May 5 2009, 04:41 PM Post #2
Forum God Group: Classroom Teacher Posts: 11,227 Joined: 27-December 07 From: Sisters, OR Member No.: 75,503 Operating System: xp	Hi calvin_hobbes, My name is Tomk. I would be glad to take a look at your log and help you with solving any malware problems. HijackThis logs can take a while to research, so please be patient and I'd be grateful if you would note the following: I will be working on your Malware issues, this may or may not, solve other issues you have with your machine. The fixes are specific to your problem and should only be used for the issues on this machine. Please continue to review my answers until I tell you your machine appears to be clear. Absence of symptoms does not mean that everything is clear. It's often worth reading through these instructions and printing them for ease of reference. If you don't know or understand something, please don't hesitate to say or ask!! It's better to be sure and safe than sorry. Please reply to this thread. Do not start a new topic. Please download ATF Cleaner by Atribune. Download - ATF Cleaner Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. (If you use FireFox or the Opera browser To keep saved passwords, click No at the prompt.) It's normal after running ATF cleaner that the PC will be slower to boot the first time or two. Then Please download Malwarebytes' Anti-Malware to your desktop. Double-click mbam-setup.exe and follow the prompts to install the program. At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish. If an update is found, it will download and install the latest version. Once the program has loaded, select Perform quick scan, then click Scan. When the scan is complete, click OK, then Show Results to view the results. Be sure that everything is checked, and click Remove Selected. When completed, a log will open in Notepad. Please save it to a convenient location and post the results. Note: If you receive a notice that some of the items couldn't be removed, that they have been added to the delete on reboot list, please reboot (shut down your computer then restart it). Also "copy/paste" a new HijackThis log file into this thread. Also please describe how your computer behaves at the moment.

calvin_hobbes View Member Profile	May 6 2009, 08:25 PM Post #3
Authentic Member Group: Authentic Member Posts: 60 Joined: 9-February 08 Member No.: 76,716 Operating System: windows XP	Hi Tomk, Nice to see ya again :-) MBAM Log ======= Malwarebytes' Anti-Malware 1.36 Database version: 2085 Windows 5.1.2600 Service Pack 3 05/06/2009 10:21:42 PM mbam-log-2009-05-06 (22-21-42).txt Scan type: Quick Scan Objects scanned: 113144 Time elapsed: 5 minute(s), 27 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) HJT Log ====== Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:24:24 PM, on 05/06/2009 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v8.00 (8.00.6001.18702) Boot mode: Normal Running processes: C:\WINNT\System32\smss.exe C:\WINNT\system32\winlogon.exe C:\WINNT\system32\services.exe C:\WINNT\system32\lsass.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\svchost.exe C:\WINNT\System32\WLTRYSVC.EXE C:\WINNT\System32\bcmwltry.exe C:\WINNT\system32\spoolsv.exe C:\Program Files\AccessManager\Client\AMBroker.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\iPass\iPassConnect\iPassPeriodicUpdateService.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINNT\System32\MCSvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\OfficeScan NT\ntrtscan.exe C:\WINNT\system32\HPZipm12.exe C:\WINNT\system32\Prot_srv.exe C:\WINNT\system32\pstartSr.exe C:\WINNT\system32\SvcLncher.exe C:\Program Files\AccessManager\PMAC\sp_SWIns.exe C:\Program Files\SigmaTel\C-Major Audio\WDM\StacSV.exe C:\WINNT\system32\svchost.exe C:\WINNT\system32\Suss.exe C:\Program Files\AccessManager\Client\sygman.exe C:\Program Files\OfficeScan NT\tmlisten.exe C:\WINNT\system32\CCM\CLICOMP\RemCtrl\Wuser32.exe C:\WINNT\system32\CCM\CcmExec.exe C:\WINNT\TEMP\TP1EDA.EXE C:\Program Files\iPass\iPassConnect\iPassPeriodicUpdateApp.exe C:\Program Files\OfficeScan NT\TmPfw.exe C:\WINNT\Explorer.EXE C:\Program Files\OfficeScan NT\pccntmon.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\WINNT\stsystra.exe C:\WINNT\system32\hkcmd.exe C:\WINNT\system32\igfxpers.exe C:\WINNT\system32\igfxsrvc.exe C:\Program Files\AccessManager\Client\AccessMgr.exe C:\WINNT\System32\svchost.exe C:\WINNT\system32\WLTRAY.exe C:\WINNT\system32\taskswitch.exe C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe C:\Program Files\DellTPad\Apoint.exe C:\Program Files\WinPatrol\winpatrol.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\iPass\iPassConnect\iPassConnectGUI.exe C:\Program Files\DellTPad\ApMsgFwd.exe C:\Program Files\Pointsec\Pointsec for PC\P95Tray.exe C:\WINNT\system32\ctfmon.exe C:\Program Files\DellTPad\HidFind.exe C:\Program Files\DellTPad\Apntex.exe C:\Documents and Settings\vm092543\Local Settings\Application Data\Google\Update\GoogleUpdate.exe C:\Program Files\Spybot\TeaTimer.exe C:\Program Files\iPass\iPassConnect\iPassConnectEngine.exe C:\Program Files\Copernic Desktop Search\DesktopSearchService.exe C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\interwise\Participant\pull.exe C:\Program Files\Open Text\Livelink Explorer\LLSynch3.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtKbd.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtBty.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe C:\Program Files\OfficeScan NT\CNTAoSMgr.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\WINNT\system32\HPZinw12.exe C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe C:\Program Files\PC Connectivity Solution\Transports\NclToBTSrv.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE C:\WINNT\explorer.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = https://inside.nokiasiemensnetworks.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://inside.nokiasiemensnetworks.com R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer provided by NSN R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,AutoConfigURL = http://proxyconf.glb.nsn-net.net/proxy.pac O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\Spybot\SDHelper.dll O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O2 - BHO: Java™ Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O2 - BHO: LLIEHlprObj Class - {F757FBBF-10E5-4DDA-BBEA-2357E54BEA2B} - C:\Program Files\Open Text\Livelink Explorer\LLBHO3.dll O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll O3 - Toolbar: Copernic Desktop Search - Home Toolbar - {4A1C6093-14F9-44D7-860E-5D265CFCA9D9} - C:\Program Files\Copernic Desktop Search\Toolbar\ToolbarContainer101000311.dll O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\Program Files\OfficeScan NT\pccntmon.exe" -HideWindow O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon O4 - HKLM\..\Run: [WinZip Quick Pick] C:\Program Files\WinZip\WZQKPICK.EXE O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\system32\hkcmd.exe O4 - HKLM\..\Run: [Persistence] C:\WINNT\system32\igfxpers.exe O4 - HKLM\..\Run: [AccessManager] C:\Program Files\AccessManager\Client\AccessMgr.exe O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINNT\system32\WLTRAY.exe O4 - HKLM\..\Run: [CoolSwitch] C:\WINNT\system32\taskswitch.exe O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe O4 - HKLM\..\Run: [WinPatrol] C:\Program Files\WinPatrol\winpatrol.exe -expressboot O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [iPassConnect] "C:\Program Files\iPass\iPassConnect\iPassConnectGUI.exe" /S O4 - HKLM\..\Run: [Pointsec Tray] C:\Program Files\Pointsec\Pointsec for PC\P95Tray.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\vm092543\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot\TeaTimer.exe O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized O4 - HKCU\..\Run: [Copernic Desktop Search - Home] "C:\Program Files\Copernic Desktop Search\DesktopSearchService.exe" /tray O4 - HKCU\..\Run: [PC Suite Tray] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe" -onlytray O4 - Startup: Livelink Explorer Synchronizer.lnk = C:\Program Files\Open Text\Livelink Explorer\LLSynch3.exe O4 - Global Startup: Adobe Reader - Schnellstart.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: Bluetooth Manager.lnk = ? O4 - Global Startup: Digital Line Detect.lnk = C:\Program Files\Digital Line Detect\DLG.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Push Client.LNK = C:\Program Files\interwise\Participant\pull.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Edit with Altova X&MLSpy - C:\Program Files\Altova\XMLSpy2008\spy.htm O9 - Extra button: Edit with Altova X&MLSpy - {2222EF56-F49E-4d07-A14E-8D2B08766958} - C:\Program Files\Altova\XMLSpy2008\spy.htm O9 - Extra 'Tools' menuitem: Edit with Altova X&MLSpy - {2222EF56-F49E-4d07-A14E-8D2B08766958} - C:\Program Files\Altova\XMLSpy2008\spy.htm O9 - Extra button: (no name) - {80947ADC-151D-490B-87F1-7C8CE1B46220} - (no file) O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\Spybot\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINNT\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINNT\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O14 - IERESET.INF: START_PAGE_URL=https://inside.nokiasiemensnetworks.com O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1230590012390 O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1230592905812 O16 - DPF: {7261EE42-318E-490A-AE8F-77649DBA1ECA} (JNILoader Control) - https://xesp-nsnst004.inside.nokiasiemensne...STJNILoader.cab O16 - DPF: {8D9563A9-8D5F-459B-87F2-BA842255CB9A} (Whale Client Components) - https://bpsn.inside.nokiasiemensnetworks.co.../WhlCompMgr.cab O16 - DPF: {D3E01836-60CD-480D-BBDB-19D5A7D23128} (Xerox_Services_Portal.XrxPrinter_Inst) - https://office.services.xerox.com/XeroxServ...Portal_Pref.CAB O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://apertio.webex.com/client/T27L/webex/ieatgpc.cab O16 - DPF: {F53270D3-0E32-48B7-B63B-159E33210F70} (Livelink Edit Control) - https://sharenet-ims.inside.nokiasiemensnet...edit/lledit.cab O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = nsn-intra.net O17 - HKLM\Software\..\Telephony: DomainName = nsn-intra.net O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = nsn-intra.net O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = nsn-intra.net O23 - Service: Access Manager Configuration Service (AMBroker) - MCI, Inc. - C:\Program Files\AccessManager\Client\AMBroker.exe O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Visual Insight DA Plugin (DAPlugin) - MCI, Inc. - C:\Program Files\AccessManager\Client\DAPlugin.exe O23 - Service: Contivity VPN Service (ExtranetAccess) - Nortel Networks NA, Inc. - C:\Program Files\IP VPN Remote Services\Extranet_serv.exe O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe O23 - Service: HP Port Resolver - Hewlett-Packard Company - C:\WINNT\system32\spool\drivers\w32x86\3\HPBPRO.EXE O23 - Service: HP Status Server - Hewlett-Packard Company - C:\WINNT\system32\spool\drivers\w32x86\3\HPBOID.EXE O23 - Service: HTTP Poster Service (HTTP Poster) - Nokia - C:\WINNT\system32\HTTP_Poster.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe O23 - Service: iPassConnectEngine - iPass, Inc. - C:\Program Files\iPass\iPassConnect\iPassConnectEngine.exe O23 - Service: iPassPeriodicUpdateApp - iPass, Inc. - C:\Program Files\iPass\iPassConnect\iPassPeriodicUpdateApp.exe O23 - Service: iPassPeriodicUpdateService - iPass, Inc. - C:\Program Files\iPass\iPassConnect\iPassPeriodicUpdateService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe O23 - Service: Managed Client Service (MCsvc) - © 2005 - 2008 Siemens AG - C:\WINNT\System32\MCSvc.exe O23 - Service: OfficeScanNT RealTime Scan (ntrtscan) - Trend Micro Inc. - C:\Program Files\OfficeScan NT\ntrtscan.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe O23 - Service: Pointsec - Unknown owner - C:\WINNT\system32\Prot_srv.exe O23 - Service: Pointsec Service Start (Pointsec_start) - Unknown owner - C:\WINNT\system32\pstartSr.exe O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program Files\WinPcap\rpcapd.exe O23 - Service: Service Launcher - SIS GO GIO DS PSU6 - C:\WINNT\system32\SvcLncher.exe O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: SP Software Installer - Smartpipes, Inc. - C:\Program Files\AccessManager\PMAC\sp_SWIns.exe O23 - Service: Visual Insight Dial Analysis (sp_spi_da) - Smartpipes, Inc. - C:\Program Files\AccessManager\SMOC\spi_da.exe O23 - Service: SigmaTel Audio Service (STacSV) - SigmaTel, Inc. - C:\Program Files\SigmaTel\C-Major Audio\WDM\StacSV.exe O23 - Service: SSA Integration Manager (Sygman) - MCI, Inc. - C:\Program Files\AccessManager\Client\sygman.exe O23 - Service: OfficeScan NT Listener (tmlisten) - Trend Micro Inc. - C:\Program Files\OfficeScan NT\tmlisten.exe O23 - Service: OfficeScanNT Personal Firewall (TmPfw) - Trend Micro Inc. - C:\Program Files\OfficeScan NT\TmPfw.exe O23 - Service: OfficeScan NT Proxy Service (TmProxy) - Trend Micro Inc. - C:\Program Files\OfficeScan NT\TmProxy.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINNT\System32\WLTRYSVC.EXE -- End of file - 16577 bytes Computer behaviour as described earlier stands true i.e. stays the same.

Tomk View Member Profile	May 6 2009, 09:27 PM Post #4
Forum God Group: Classroom Teacher Posts: 11,227 Joined: 27-December 07 From: Sisters, OR Member No.: 75,503 Operating System: xp	calvin_hobbes, Let's get a little different look. Please download DDS by sUBs from one of the following links and save it to your desktop. DDS.scr DDS.pif Disable any script blocking protection (How to Disable your Security Programs) Double click DDS icon to run the tool (may take up to 3 minutes to run) When done, DDS.txt will open. After a few moments, attach.txt will open in a second window. Save both reports to your desktop. --------------------------------------------------- Post the contents of the DDS.txt report in your next reply *Attach* the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and the click UPLOAD.

calvin_hobbes View Member Profile	May 7 2009, 05:45 PM Post #5
Authentic Member Group: Authentic Member Posts: 60 Joined: 9-February 08 Member No.: 76,716 Operating System: windows XP	DDS.txt ====== DDS (Ver_09-03-16.01) - NTFSx86 Run by vm092543 at 19:41:12.44 on 05/07/2009 Internet Explorer: 8.0.6001.18702 BrowserJavaVersion: 1.6.0_13 Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.3062.1922 [GMT -4:00] AV: Trend Micro OfficeScan Antivirus On-access scanning enabled (Updated) FW: Trend Micro Personal Firewall enabled ============== Running Processes =============== C:\WINNT\system32\svchost -k DcomLaunch svchost.exe C:\WINNT\System32\svchost.exe -k netsvcs C:\WINNT\system32\svchost.exe -k WudfServiceGroup svchost.exe svchost.exe C:\WINNT\System32\WLTRYSVC.EXE C:\WINNT\System32\bcmwltry.exe C:\WINNT\system32\spoolsv.exe svchost.exe C:\Program Files\AccessManager\Client\AMBroker.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\iPass\iPassConnect\iPassPeriodicUpdateService.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\WINNT\System32\MCSvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\OfficeScan NT\ntrtscan.exe C:\WINNT\system32\Prot_srv.exe C:\WINNT\system32\pstartSr.exe C:\WINNT\system32\SvcLncher.exe C:\Program Files\AccessManager\PMAC\sp_SWIns.exe C:\Program Files\SigmaTel\C-Major Audio\WDM\StacSV.exe C:\WINNT\system32\svchost.exe -k imgsvc C:\WINNT\system32\Suss.exe C:\Program Files\AccessManager\Client\sygman.exe C:\Program Files\OfficeScan NT\tmlisten.exe C:\WINNT\system32\CCM\CLICOMP\RemCtrl\Wuser32.exe C:\WINNT\system32\CCM\CcmExec.exe C:\WINNT\TEMP\HIB1F0.EXE C:\Program Files\iPass\iPassConnect\iPassPeriodicUpdateApp.exe C:\Program Files\OfficeScan NT\TmPfw.exe C:\Program Files\OfficeScan NT\CNTAoSMgr.exe C:\WINNT\Explorer.EXE C:\Program Files\OfficeScan NT\pccntmon.exe C:\Program Files\WinZip\WZQKPICK.EXE C:\WINNT\stsystra.exe C:\WINNT\system32\igfxsrvc.exe C:\WINNT\system32\igfxpers.exe C:\Program Files\AccessManager\Client\AccessMgr.exe C:\WINNT\system32\WLTRAY.exe C:\WINNT\system32\taskswitch.exe C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe C:\Program Files\DellTPad\Apoint.exe C:\Program Files\WinPatrol\winpatrol.exe C:\Program Files\DellTPad\ApMsgFwd.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\DellTPad\HidFind.exe C:\Program Files\DellTPad\Apntex.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\iPass\iPassConnect\iPassConnectGUI.exe C:\Program Files\Pointsec\Pointsec for PC\P95Tray.exe C:\WINNT\system32\ctfmon.exe C:\Documents and Settings\vm092543\Local Settings\Application Data\Google\Update\GoogleUpdate.exe C:\Program Files\Spybot\TeaTimer.exe C:\Program Files\iPass\iPassConnect\iPassConnectEngine.exe C:\Program Files\Copernic Desktop Search\DesktopSearchService.exe C:\Program Files\Nokia\Nokia PC Suite 7\PCSuite.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\interwise\Participant\pull.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosA2dp.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHid.exe C:\Program Files\HP\Digital Imaging\bin\hpqnrs08.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtHsp.exe C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtKbd.exe C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtBty.exe C:\Program Files\PC Connectivity Solution\ServiceLayer.exe C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE C:\WINNT\explorer.exe C:\PROGRA~1\COPERN~2\DESKTO~1.EXE C:\Program Files\MCollect\MPCMon.exe C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrobat.exe C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe C:\Program Files\PC Connectivity Solution\Transports\NclToBTSrv.exe C:\WINNT\System32\svchost.exe -k HTTPFilter C:\Program Files\IP VPN Remote Services\Extranet_serv.exe C:\Documents and Settings\vm092543\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\vm092543\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\vm092543\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Documents and Settings\vm092543\Local Settings\Application Data\Google\Chrome\Application\chrome.exe C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcrobatInfo.exe D:\Data\Downloads\Malware Removal\dds.scr ============== Pseudo HJT Report =============== uWindow Title = Microsoft Internet Explorer provided by NSN uStart Page = https://inside.nokiasiemensnetworks.com uDefault_Page_URL = https://inside.nokiasiemensnetworks.com uInternet Settings,ProxyOverride = <local> BHO: Adobe PDF Reader Link Helper: {06849e9f-c8d7-4d59-b87d-784b7d6be0b3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelper.dll BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot\SDHelper.dll BHO: Adobe PDF Conversion Toolbar Helper: {ae7cd045-e861-484f-8273-0445ee161910} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll BHO: Java™ Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: Adobe PDF: {47833539-d0c5-4125-9fa8-0819e2eaac93} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll TB: Copernic Desktop Search - Home Toolbar: {4a1c6093-14f9-44d7-860e-5d265cfca9d9} - c:\program files\copernic desktop search\toolbar\ToolbarContainer101000311.dll TB: {968631B6-4729-440D-9BF4-251F5593EC9A} - No File EB: Adobe PDF: {182ec0be-5110-49c8-a062-beb1d02a220b} - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll EB: Copernic Desktop Search - Home Toolbar: {4a1c6093-14f9-44d7-860e-5d265cfca9d9} - c:\program files\copernic desktop search\toolbar\ToolbarContainer101000311.dll EB: Copernic Desktop Search - Home: {9c3fca1f-99e3-48f2-a7f4-dd3931b2f99a} - c:\program files\copernic desktop search\DeskbandIntegration302000044.dll uRun: [ctfmon.exe] c:\winnt\system32\ctfmon.exe uRun: [Google Update] "c:\documents and settings\vm092543\local settings\application data\google\update\GoogleUpdate.exe" /c uRun: [SpybotSD TeaTimer] c:\program files\spybot\TeaTimer.exe uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized uRun: [Copernic Desktop Search - Home] "c:\program files\copernic desktop search\DesktopSearchService.exe" /tray uRun: [PC Suite Tray] "c:\program files\nokia\nokia pc suite 7\PCSuite.exe" -onlytray mRun: [OfficeScanNT Monitor] "c:\program files\officescan nt\pccntmon.exe" -HideWindow mRun: [Synchronization Manager] mobsync.exe /logon mRun: [WinZip Quick Pick] c:\program files\winzip\WZQKPICK.EXE mRun: [SigmatelSysTrayApp] stsystra.exe mRun: [IgfxTray] c:\winnt\system32\igfxtray.exe mRun: [HotKeysCmds] c:\winnt\system32\hkcmd.exe mRun: [Persistence] c:\winnt\system32\igfxpers.exe mRun: [AccessManager] c:\program files\accessmanager\client\AccessMgr.exe mRun: [Broadcom Wireless Manager UI] c:\winnt\system32\WLTRAY.exe mRun: [CoolSwitch] c:\winnt\system32\taskswitch.exe mRun: [Acrobat Assistant 8.0] "c:\program files\adobe\acrobat 8.0\acrobat\Acrotray.exe" mRun: [Apoint] c:\program files\delltpad\Apoint.exe mRun: [WinPatrol] c:\program files\winpatrol\winpatrol.exe -expressboot mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe" mRun: [iPassConnect] "c:\program files\ipass\ipassconnect\iPassConnectGUI.exe" /S mRun: [Pointsec Tray] c:\program files\pointsec\pointsec for pc\P95Tray.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\blueto~1.lnk - c:\program files\toshiba\bluetooth toshiba stack\TosBtMng.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\digita~1.lnk - c:\program files\digital line detect\DLG.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\hpdigi~1.lnk - c:\program files\hp\digital imaging\bin\hpqtra08.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\pushcl~1.lnk - c:\program files\interwise\participant\pull.exe uPolicies-explorer: NoSMHelp = 01000000 uPolicies-explorer: NoSMMyPictures = 01000000 uPolicies-explorer: NoStrCmpLogical = 01000000 uPolicies-explorer: NoThumbnailCache = 1 (0x1) uPolicies-explorer: NoWindowsUpdate = 1 (0x1) uPolicies-explorer: ForceStartMenuLogOff = 1 (0x1) uPolicies-explorer: NoResolveTrack = 1 (0x1) uPolicies-explorer: GreyMSIAds = 1 (0x1) uPolicies-explorer: NoInternetIcon = 1 (0x1) uPolicies-explorer: NoRecentDocsNetHood = 1 (0x1) uPolicies-explorer: DisablePersonalDirChange = 1 (0x1) uPolicies-explorer: NoDesktopCleanupWizard = 1 (0x1) uPolicies-explorer: NoWelcomeScreen = 1 (0x1) uPolicies-explorer: NoAutoUpdate = 1 (0x1) uPolicies-system: ConnectHomeDirToRoot = 0 (0x0) uPolicies-system: HideLogonScripts = 0 (0x0) mPolicies-explorer: NoSMConfigurePrograms = 1 (0x1) mPolicies-explorer: NoPublishingWizard = 1 (0x1) mPolicies-explorer: NoWebServices = 1 (0x1) mPolicies-explorer: NoOnlinePrintsWizard = 1 (0x1) mPolicies-explorer: NoWelcomeScreen = 1 (0x1) mPolicies-explorer: NoMSAppLogo5ChannelNotify = 1 (0x1) mPolicies-system: RunStartupScriptSync = 1 (0x1) dPolicies-explorer: NoSetActiveDesktop = 1 (0x1) dPolicies-explorer: DisablePersonalDirChange = 1 (0x1) IE: Append to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert link target to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert link target to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert selected links to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html IE: Convert selected links to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html IE: Convert selection to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: Convert selection to existing PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIEAppend.html IE: Convert to Adobe PDF - c:\program files\adobe\acrobat 8.0\acrobat\AcroIEFavClient.dll/AcroIECapture.html IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office11\EXCEL.EXE/3000 IE: Edit with Altova X&MLSpy - c:\program files\altova\xmlspy2008\spy.htm IE: {2222EF56-F49E-4d07-A14E-8D2B08766958} - c:\program files\altova\xmlspy2008\spy.htm IE: {80947ADC-151D-490B-87F1-7C8CE1B46220} IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~2\office11\REFIEBAR.DLL IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot\SDHelper.dll Trusted Zone: microsoft.com Trusted Zone: siemens.com\project Trusted Zone: microsoft.com Trusted Zone: siemens.com\project DPF: {17492023-C23A-453E-A040-C7C580BBF700} - hxxp://download.microsoft.com/download/C/0/C/C0CBBA88-A6F2-48D9-9B0E-1719D1177202/LegitCheckControl.cab DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1230590012390 DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} - hxxp://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1230592905812 DPF: {7261EE42-318E-490A-AE8F-77649DBA1ECA} - hxxps://xesp-nsnst004.inside.nokiasiemensnetworks.com/sametime/stmeetingroomclient/STJNILoader.cab DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {8D9563A9-8D5F-459B-87F2-BA842255CB9A} - hxxps://bpsn.inside.nokiasiemensnetworks.com/InternalSite/WhlCompMgr.cab DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab DPF: {CAFEEFAC-0016-0000-0013-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_13-windows-i586.cab DPF: {D3E01836-60CD-480D-BBDB-19D5A7D23128} - hxxps://office.services.xerox.com/XeroxServicesManager/UI/FindPrinter/PrnInst/Xerox_Services_Portal_Pref.CAB DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} - hxxps://apertio.webex.com/client/T27L/webex/ieatgpc.cab DPF: {F53270D3-0E32-48B7-B63B-159E33210F70} - hxxps://sharenet-ims.inside.nokiasiemensnetworks.com/img/webedit/lledit.cab TCP: {67C55556-3A19-425C-AE9D-6F311F24CF5B} = 10.139.1.145,10.159.160.10 Notify: igfxcui - igfxdev.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\winnt\system32\WPDShServiceObj.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\vm092543\applic~1\mozilla\firefox\profiles\rrxtafk7.default\ FF - component: c:\program files\copernic desktop search\firefoxconnector\components\CSPXPCOMBridge.dll FF - component: c:\program files\copernic desktop search\toolbar\firefoxcontainer\components\CCLCXPCOMBridge.dll FF - component: c:\program files\nokia\nokia pc suite 7\bkmrksync\components\BkMrkExt.dll FF - plugin: c:\documents and settings\vm092543\application data\mozilla\firefox\profiles\rrxtafk7.default\extensions\moveplayer@movenetworks.com\platform\winnt_x86-msvc\plugins\npmnqmp071303000006.dll FF - plugin: c:\documents and settings\vm092543\local settings\application data\google\update\1.2.145.5\npGoogleOneClick8.dll FF - plugin: c:\program files\mozilla firefox\plugins\npatgpc.dll FF - plugin: c:\program files\mozilla firefox\plugins\NPTURNMED.dll FF - plugin: c:\program files\nokia\ovi maps\mozilla firefox plugin\xpi\plugins\npNMapG.dll ============= SERVICES / DRIVERS =============== R0 prot_2k;prot_2k;c:\winnt\system32\drivers\prot_2k.sys [2008-4-12 221632] R2 AMBroker;Access Manager Configuration Service;c:\program files\accessmanager\client\AMBroker.exe [2004-8-5 77824] R2 MCsvc;Managed Client Service;c:\winnt\system32\MCSvc.exe [2008-9-15 69632] R2 Pointsec;Pointsec;c:\winnt\system32\Prot_srv.exe [2008-4-12 367168] R2 Pointsec_start;Pointsec Service Start;c:\winnt\system32\pstartSr.exe [2008-4-12 145984] R2 Service Launcher;Service Launcher;c:\winnt\system32\SvcLncher.exe [2008-3-6 229376] R2 SU;SU Service;c:\winnt\system32\Suss.exe [2007-9-26 12048] R2 Sygman;SSA Integration Manager;c:\program files\accessmanager\client\sygman.exe [2004-8-5 126976] R2 TmFilter;Trend Micro Filter;c:\program files\officescan nt\tmxpflt.sys [2006-9-6 205328] R2 TmPreFilter;Trend Micro PreFilter;c:\program files\officescan nt\tmpreflt.sys [2006-9-6 36368] R3 Eacfilt;Eacfilt Miniport;c:\winnt\system32\drivers\eacfilt.sys [2007-9-27 9817] R3 ExtranetAccess;Contivity VPN Service;c:\program files\ip vpn remote services\Extranet_serv.exe [2007-9-27 643072] R3 tmcfw;Trend Micro Common Firewall Service;c:\winnt\system32\drivers\TM_CFW.sys [2006-12-22 338448] R3 TmPfw;OfficeScanNT Personal Firewall;c:\program files\officescan nt\TmPfw.exe [2008-5-13 488768] S2 HTTP Poster;HTTP Poster Service;c:\winnt\system32\HTTP_Poster.exe [2008-10-21 45056] S2 IPSECEXT;Nortel Extranet Access Protocol;c:\winnt\system32\drivers\ipsecw2k.sys [2007-9-27 117760] S3 DAPlugin;Visual Insight DA Plugin;c:\program files\accessmanager\client\DAPlugin.exe [2004-8-5 81920] S3 DMService;Whale Component Manager;c:\winnt\downlo~1\DMService.exe [2008-8-7 423576] S3 el575nd5;3Com Megahertz 10/100 LAN CardBus PC Card Driver;c:\winnt\system32\drivers\el575ND5.sys [2007-9-26 69692] S3 NbtDet;NetBoot PCI Detection Service;c:\winnt\system32\drivers\nbtdet.sys [2008-9-15 4992] S3 NPF;NetGroup Packet Filter Driver;c:\winnt\system32\drivers\npf.sys [2007-11-6 34064] S3 sp_spi_da;Visual Insight Dial Analysis;c:\program files\accessmanager\smoc\spi_da.exe [2003-4-17 81920] S3 TmProxy;OfficeScan NT Proxy Service;c:\program files\officescan nt\TmProxy.exe [2008-5-13 652552] =============== Created Last 30 ================ 2009-05-07 15:03 8,192 a------- c:\winnt\system32\srbt.dll 2009-05-07 14:21 <DIR> -cd-h--- c:\winnt\ie8 2009-05-03 20:07 <DIR> --d----- c:\documents and settings\vm092543\Livelink 2009-04-29 14:12 <DIR> --d----- c:\program files\Pointsec 2009-04-29 14:10 512 a------- C:\BOOT_SAV.BOT 2009-04-29 14:10 2,097,152 ---shr-- C:\PROT_INS.SYS 2009-04-29 14:10 6 a------- C:\VOL_CHAR.DAT 2009-04-29 11:56 <DIR> --d----- c:\docume~1\alluse~1\applic~1\Pointsec 2009-04-29 10:24 <DIR> --d----- c:\program files\common files\PCSuite 2009-04-29 10:22 18,816 a------- c:\winnt\system32\drivers\pccsmcfd.sys 2009-04-29 10:22 <DIR> --d----- c:\program files\PC Connectivity Solution 2009-04-29 09:49 <DIR> --d----- c:\docume~1\alluse~1\applic~1\iPass 2009-04-29 09:49 356,352 a------- c:\winnt\system32\iPassI5Installer.exe 2009-04-29 09:49 21,393 a------- c:\winnt\system32\drivers\iPassP.sys 2009-04-29 09:49 <DIR> --d----- c:\program files\iPass 2009-04-25 19:18 <DIR> --d----- c:\winnt\system32\NtmsData 2009-04-24 10:47 <DIR> --d----- c:\program files\iPod 2009-04-24 10:46 <DIR> --d----- c:\program files\iTunes 2009-04-24 10:46 <DIR> --d----- c:\docume~1\alluse~1\applic~1\{8CD7F5AF-ECFA-4793-BF40-D8F42DBFF906} 2009-04-17 11:05 354,304 -c------ c:\winnt\system32\dllcache\winhttp.dll 2009-04-17 11:04 2,560 -------- c:\winnt\system32\xpsp4res.dll 2009-04-17 11:04 1,203,922 -c------ c:\winnt\system32\dllcache\sysmain.sdb 2009-04-17 11:04 215,552 -c------ c:\winnt\system32\dllcache\wordpad.exe 2009-04-17 11:03 989,696 -c------ c:\winnt\system32\dllcache\kernel32.dll 2009-04-17 11:03 56,832 -c------ c:\winnt\system32\dllcache\secur32.dll 2009-04-17 10:59 956,928 -c------ c:\winnt\system32\dllcache\msdtctm.dll 2009-04-17 10:59 161,792 -c------ c:\winnt\system32\dllcache\msdtcuiu.dll 2009-04-17 10:59 91,648 -c------ c:\winnt\system32\dllcache\mtxoci.dll 2009-04-17 10:59 66,560 -c------ c:\winnt\system32\dllcache\mtxclu.dll 2009-04-17 10:59 58,880 -c------ c:\winnt\system32\dllcache\msdtclog.dll 2009-04-15 14:29 <DIR> --d--r-- c:\program files\Skype 2009-04-08 22:03 80 a------- c:\winnt\wininit.ini ==================== Find3M ==================== 2009-04-06 15:32 38,496 a------- c:\winnt\system32\drivers\mbamswissarmy.sys 2009-04-06 15:32 15,504 a------- c:\winnt\system32\drivers\mbam.sys 2009-03-19 16:32 23,400 a------- c:\winnt\system32\drivers\GEARAspiWDM.sys 2009-03-09 05:19 410,984 a------- c:\winnt\system32\deploytk.dll 2009-03-08 04:34 914,944 a------- c:\winnt\system32\wininet.dll 2009-03-08 04:34 43,008 a------- c:\winnt\system32\licmgr10.dll 2009-03-08 04:33 18,944 a------- c:\winnt\system32\corpol.dll 2009-03-08 04:33 420,352 a------- c:\winnt\system32\vbscript.dll 2009-03-08 04:32 72,704 a------- c:\winnt\system32\admparse.dll 2009-03-08 04:32 71,680 a------- c:\winnt\system32\iesetup.dll 2009-03-08 04:31 34,816 a------- c:\winnt\system32\imgutil.dll 2009-03-08 04:31 48,128 a------- c:\winnt\system32\mshtmler.dll 2009-03-08 04:31 45,568 a------- c:\winnt\system32\mshta.exe 2009-03-08 04:22 156,160 a------- c:\winnt\system32\msls31.dll 2009-03-06 14:18 86,315 a------- c:\winnt\pchealth\helpctr\offlinecache\index.dat 2009-03-06 10:22 284,160 a------- c:\winnt\system32\pdh.dll 2009-03-02 10:03 206,848 a------- c:\winnt\system32\SetupSvc.exe 2009-02-25 21:21 229,376 a------- c:\winnt\system32\SvcLncher.exe 2009-02-09 08:10 729,088 a------- c:\winnt\system32\lsasrv.dll 2009-02-09 08:10 714,752 a------- c:\winnt\system32\ntdll.dll 2009-02-09 08:10 617,472 a------- c:\winnt\system32\advapi32.dll 2009-02-09 08:10 401,408 a------- c:\winnt\system32\rpcss.dll 2009-02-09 07:37 91,136 a------- c:\winnt\system32\nmwcdcls.dll 2009-02-09 07:13 1,846,784 a------- c:\winnt\system32\win32k.sys ============= FINISH: 19:41:56.33 =============== Attach.txt ======= Attach.txt ( 8.29K ) Number of downloads: 344

Tomk View Member Profile	May 7 2009, 06:30 PM Post #6
Forum God Group: Classroom Teacher Posts: 11,227 Joined: 27-December 07 From: Sisters, OR Member No.: 75,503 Operating System: xp	calvin_hobbes, Click Start, then Settings, then click Control Panel. In Control Panel, double-click Add or Remove Programs. In Add or Remove Programs, Remove Java™ 6 Update 3 Do the same for Java™ 6 Update 4. Please go to Kaspersky website and perform an online antivirus scan. Read through the requirements and privacy statement and click on Accept button. It will start downloading and installing the scanner and virus definitions. You will be prompted to install an application from Kaspersky. Click Run. When the downloads have finished, click on Settings. Make sure these boxes are checked (ticked). If they are not, please tick them and click on the Save button: Spyware, Adware, Dialers, and other potentially dangerous programs Archives Mail databases Click on My Computer under Scan. Once the scan is complete, it will display the results. Click on View Scan Report. You will see a list of infected items there. Click on Save Report As.... Save this report to a convenient place. Change the Files of type to Text file (.txt) before clicking on the Save button. Please post this log in your next reply.

calvin_hobbes View Member Profile	May 7 2009, 08:22 PM Post #7
Authentic Member Group: Authentic Member Posts: 60 Joined: 9-February 08 Member No.: 76,716 Operating System: windows XP	removed older java versions... scanning via kaspersky ongoing now... will post as soon as finished..

Tomk View Member Profile	May 7 2009, 10:26 PM Post #8
Forum God Group: Classroom Teacher Posts: 11,227 Joined: 27-December 07 From: Sisters, OR Member No.: 75,503 Operating System: xp

calvin_hobbes View Member Profile	May 8 2009, 06:00 AM Post #9
Authentic Member Group: Authentic Member Posts: 60 Joined: 9-February 08 Member No.: 76,716 Operating System: windows XP	Kaspersky Log ============ -------------------------------------------------------------------------------- KASPERSKY ONLINE SCANNER 7.0 REPORT Friday, May 8, 2009 Operating System: Microsoft Windows XP Professional Service Pack 3 (build 2600) Kaspersky Online Scanner version: 7.0.26.13 Program database last update: Friday, May 08, 2009 04:23:38 Records in database: 2142778 -------------------------------------------------------------------------------- Scan settings: Scan using the following database: extended Scan archives: yes Scan mail databases: yes Scan area - Folder: C:\ Scan statistics: Files scanned: 79389 Threat name: 5 Infected objects: 5 Suspicious objects: 0 Duration of the scan: 02:42:55 File name / Threat name / Threats count C:\CF1 Customer Files\vnchooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.e 1 C:\Program Files\emwprof\pskill.exe Infected: not-a-virus:RiskTool.Win32.PsKill.1101 1 C:\WINNT\$NtServicePackUninstall$\userinit.exe Infected: Backdoor.Win32.Rbot.abrk 1 C:\WINNT\system32\6TO4V32_618.VIR Infected: Trojan.Win32.Obfuscated.acrg 1 C:\WINNT\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\BLJJX0MW\zha[1].exe Infected: Trojan.Win32.Agent.btpk 1 The selected area was scanned.

Tomk View Member Profile	May 8 2009, 06:05 AM Post #10
Forum God Group: Classroom Teacher Posts: 11,227 Joined: 27-December 07 From: Sisters, OR Member No.: 75,503 Operating System: xp	calvin_hobbes, Your computer appears to have been infected by a backdoor trojan. These programs have the ability to steal passwords and other information from your system. If you use your computer for sensitive purposes such as internet banking then I recommend you take the following steps immediately: Use another, uninfected computer to change all your internet passwords, especially ones with financial implications such as banks, paypal, ebay, etc. You should also change the passwords for any other site you use. Call your bank(s), credit card company or any other institution which may be affected and advise them that your login/password or credit card information may have been stolen and ask what steps to take with regard to your account. Consider what other private information could possibly have been taken from your computer and take appropriate steps This infection can almost certainly be cleaned, but as the malware could be configured to run any program a remote attacker requires, it will be impossible to be 100% sure that the machine is clean, if this is unacceptable to you then you should consider reformatting the system partition and reinstalling Windows as this is the only 100% sure answer. If you wish to reformat then please let me know in your next response, I'll now continue with instructions for cleaning. Download ComboFix from one of these locations: Link 1 Link 2 Link 3 * IMPORTANT !!! Save ComboFix.exe to your Desktop Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools. If you have difficulty properly disabling your protective programs, refer to this link --> http://forums.whatthetech.com/How_Disable_...ams_t96260.html Double click on ComboFix.exe & follow the prompts. As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware. Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console. Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures. Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message: Click on Yes, to continue scanning for malware. When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply. Notes: 1. Do not mouse-click Combofix's window while it is running. That may cause it to stall. 2. Do not "re-run" Combofix. If you have a problem, reply back for further instructions. 3. ComboFix may reset a number of Internet Explorer's settings, including making I-E the default browser. 4. Combofix prevents autorun of ALL** CD, floppy and USB devices to assist with malware removal & increase security. If this is an issue or makes it difficult for you -- please tell your helper. 5. CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

calvin_hobbes View Member Profile	May 8 2009, 10:02 PM Post #11
Authentic Member Group: Authentic Member Posts: 60 Joined: 9-February 08 Member No.: 76,716 Operating System: windows XP	Hi tomk, This seems to be the second time i am infected w/ backdoor trojan (occured about a month or two ago as well)... i am exploring the option of reimaging / reinstalling OS and starting from clean plate... please stay tuned over the next 3-4 days.. if i decide against it, then i will follow the combofix procedures suggested by you..

Tomk View Member Profile	May 8 2009, 10:28 PM Post #12
Forum God Group: Classroom Teacher Posts: 11,227 Joined: 27-December 07 From: Sisters, OR Member No.: 75,503 Operating System: xp	calvin_hobbes, Let me know.

Tomk View Member Profile	May 14 2009, 09:27 PM Post #13
Forum God Group: Classroom Teacher Posts: 11,227 Joined: 27-December 07 From: Sisters, OR Member No.: 75,503 Operating System: xp	Due to inactivity this topic will be closed. If you need help please start a new thread and post a new HJT log

« Next Oldest · Infections Removal · Next Newest »

6 User(s) are reading this topic (6 Guests and 0 Anonymous Users)

0 Members:

Topic Title	Replies	Topic Starter	Views	Last Action
Comments and Suggestions 'What To Do If You Have No Response In 3 Days'	1	LDTate	19,368	30 minutes ago Last post by: jfinner1
Infections Removal Google Redirect/Invalid Security Certificate	1	mekap04	13	Today, 06:09 AM Last post by: Raktor
Infections Removal Google Redirects	6	Calvin.sparta	141	Today, 12:52 AM Last post by: inzanity
Infections Removal Google redirects & spybot,hijack this problems 123» 7	99	arfon.jones	2,464	Yesterday, 04:21 PM Last post by: noahdfear