 [Resolved] Panda log (found 7 items) and HJT log, Lots of bad and/or unnecessary junk on computer! |
Welcome Guest to What the Tech! ( Log In | Register ) We specialize in the removal of malicious software (malware), but here you'll find free help and support for all your tech questions. We invite you to ask questions, share experiences, and learn. Explore our message boards, or register now to post messages of your own. Please Start Here. Register today (registration removes advertising)
  |
 Jul 14 2008, 04:42 PM
Post
#1
|
|
 Authentic Member  Group: Authentic Member Posts: 40 Joined: 6-February 08 Member No.: 76,641 Operating System: Windows XP  |
In trying to clean up my computer, which is pretty old, I've noticed a lot of files that seem suspicious or are from programs that I thought I deleted. I'm getting a lot of popups from Tea Timer about values being deleted or changed: SCR/REG extension handlers, ginaDLL.
I've also been having problems with the internet connection. Oddly, my mom who has the same cable provider and lives in another city had the same problem - she was told by the cable company that it was Zone Alarm that was affecting the connection. The next day, (after I had restarted the computer), I had the same problem. I have to disable it Zone Alarm, disable the connection, unplug the modem and do a lot of fiddling around to get it going otherwise it says low connectivity or just won't work. I doubt it's Zone Alarm, It seems to have started after I did a windows update. I followed the geeks to go malware cleaning instructions from the link on the HJT quick start page. I reenabled everything from msconfig as per their instructions although I had disabled lots of suspicious things from there (br0ken.exe for example) which is why I have so much stuff running right now. Here is my panda log (haven't removed anything) and my HJT log. Thanks. ;******************************************************************************* ********************************************************************************* ******************* ANALYSIS: 2008-07-14 10:35:00 PROTECTIONS: 1 MALWARE: 5 SUSPECTS: 0 ;******************************************************************************* ********************************************************************************* ******************* PROTECTIONS Description Version Active Updated ;=============================================================================== ================================================================================= =================== Zone Alarm Security Suite 7.0.470.000 No No ;=============================================================================== ================================================================================= =================== MALWARE Id Description Type Active Severity Disinfectable Disinfected Location ;=============================================================================== ================================================================================= =================== 00018331 adware/gator Adware No 0 Yes No c:\gatorpatch.log 00029424 adware/cws.searchmeup Adware No 1 Yes No c:\windows\system32\bose.ico 00041446 application/myway HackTools No 0 Yes No hkey_classes_root\clsid\{66fc8717-efa7-4546-8c4a-e224f3a80c76} 00041446 application/myway HackTools No 0 Yes No HKEY_LOCAL_MACHINE\software\classes\CLSID\{66FC8717-EFA7-4546-8C4A-E224F3A80C76} 00065527 spyware/safesurf Spyware No 0 Yes No hkey_local_machine\software\microsoft\windows\currentversion\app management\arpcache\richeditor 00065527 spyware/safesurf Spyware No 0 Yes No hkey_local_machine\software\riched 00253851 adware/winprotect Adware No 0 Yes No c:\windows\help\spalert.chm ;=============================================================================== ================================================================================= =================== SUSPECTS Sent Location ;=============================================================================== ================================================================================= =================== ;=============================================================================== ================================================================================= =================== VULNERABILITIES Id Severity Description ;=============================================================================== ================================================================================= =================== ;=============================================================================== ================================================================================= =================== Logfile of HijackThis v1.99.1 Scan saved at 4:10:17 PM, on 7/14/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\WINDOWS\system32\ps2.exe C:\windows\system\hpsysdrv.exe C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\QuickTime\qttask.exe C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe C:\WINDOWS\system32\HPZipm12.exe C:\Program Files\Hijackthis\HijackThis.exe C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe C:\WINDOWS\system32\ZoneLabs\vsmon.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qus8.hpwis.com/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/...//www.yahoo.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Hello! R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe O4 - HKLM\..\Run: [exe.mssmd] C:\WINDOWS\system32\dmssm.exe O4 - HKLM\..\Run: [exe.zhzmd] C:\WINDOWS\system32\dmzhz.exe O4 - HKLM\..\Run: [exe.vklmd] C:\WINDOWS\system32\dmlkv.exe O4 - HKLM\..\Run: [exe.zpqmd] C:\WINDOWS\system32\dmqpz.exe O4 - HKLM\..\Run: [exe.sximd] C:\WINDOWS\system32\dmixs.exe O4 - HKLM\..\Run: [exe.voymd] C:\WINDOWS\system32\dmyov.exe O4 - HKLM\..\Run: [exe.rxpmd] C:\WINDOWS\system32\dmpxr.exe O4 - HKLM\..\Run: [exe.bfamd] C:\WINDOWS\system32\dmafb.exe O4 - HKLM\..\Run: [exe.asdmd] C:\WINDOWS\system32\dmdsa.exe O4 - HKLM\..\Run: [exe.tbwmd] C:\WINDOWS\system32\dmwbt.exe O4 - HKLM\..\Run: [exe.pilmd] C:\WINDOWS\system32\dmlip.exe O4 - HKLM\..\Run: [exe.oklmd] C:\WINDOWS\system32\dmlko.exe O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Sysnet] C:\DOCUME~1\Owner\LOCALS~1\Temp\sysnet.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe O4 - HKLM\..\Run: [slamm] MON76234.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [ISUSScheduler] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe" -start O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [bnui] Shaitan1678.exe O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKCU\..\Run: [XTermInit] lpt.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [zxc] FLKPT.exe O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1 O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [lpt] br0ken.exe O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZS O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing) O9 - Extra button: (no name) - {AFC3FA82-AD07-45cd-8B57-983435B9899E} - (no file) O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O11 - Options group: [INTERNATIONAL] International* O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/MTSInstall...MetaStream3.cab O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/pcpitstop/PCPitStop.CAB O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.johannrain-softwareentwicklung....can8/oscan8.cab O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo...otoUploader.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1128383746453 O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/...tiveXPlugin.cab O16 - DPF: {CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA} (Java Plug-in 1.5.0_01) - O16 - DPF: {D1ACD2D8-7312-4D06-BECD-90EB094D2277} - http://mediaplayer.walmart.com/installer/install.cab O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://download.games.yahoo.com/games/web_...inematycoon.cab O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by108fd.bay108.hotmail.msn.com/activex/HMAtchmt.ocx O17 - HKLM\System\CCS\Services\Tcpip\..\{1FE7BB8C-74A2-4688-BA6C-8C827C35353D}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CCS\Services\Tcpip\..\{8C51193C-6208-4FBC-8507-46FA73620CCC}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CS1\Services\Tcpip\..\{1FE7BB8C-74A2-4688-BA6C-8C827C35353D}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CS2\Services\Tcpip\..\{1FE7BB8C-74A2-4688-BA6C-8C827C35353D}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CS4\Services\Tcpip\..\{1FE7BB8C-74A2-4688-BA6C-8C827C35353D}: NameServer = 208.67.220.220,208.67.222.222 O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing) O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: NavLogon - C:\WINDOWS\ O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe |
 |
 
|
|
Jul 20 2008, 04:54 AM
Post
#2
|
|
 SuperHelper  Group: Malware Expert Posts: 7,037 Joined: 3-December 04 From: Darien, Connecticut Member No.: 19,436 Operating System: Win Xp Home SP3/ Vista Home Premium SP1  |
Hello ahelaumakani
Welcome to the Whatthetech Malware Removal Forum, sorry about the delay, but the amount of people posting with infected computers is through the roof and sometimes we can't get to logs as fast as we would like to. You may want to print out these instructions for reference, since you will have to restart your computer during the fix. Please download FixWareout from one of these sites: FixWareout Subratam FixWareout Lonny
Save the contents of the logfile C:\fixwareout\report.txt and post it into your next reply. Now lets check some settings on your system. For (2000/XP) Only)
Please download Malwarebytes' Anti-Malware from Here or Here Double Click mbam-setup.exe to install the application.
I need to see the Wareout log, the malwarebytes log and before you post a new HJT log, drag HJT to the trash as its an outdated version and download and install the latest version by Trendmicro and post a new log. Download Trendmicros Hijackthis to your desktop. Double click it to install Follow the prompts and by default it will install in C:\Program Files\Trendmicro\Hijackthis\Highjackthis.exe
DO NOT have HijackThis fix anything yet. Most of what it finds will be harmless or even required. |
|
|
|
|
Jul 20 2008, 06:55 PM
Post
#3
|
|
|
Authentic Member Group: Authentic Member Posts: 40 Joined: 6-February 08 Member No.: 76,641 Operating System: Windows XP |
Thanks for responding.
1. After I ran fixwareout it said that if I was having trouble with my internet to double-click dnsbak.reg and let my forum helper know. It asked me did I want to add the information in C:\fixwareout\dnsbak.reg to the registry and I said yes. I hope that was what I was supposed to do. 2. I looked at the network settings - the setup was a little different than your instructions but I changed it to "obtain DNS servers automatically". Also did the dns flush. I'm still having trouble with low or no connectivity when Zone Alarm is running. The local area connection status says connected at 100Mpbs but under activity it doesn't seem to be sending or receiving many packets. If Zone Alarm is on and I attempt to open IE or update a program ZA says: Generic host process for Win 32 services is trying to access 24.93.41.127: DNS. The program is svchost.exe. Choosing allow or deny has no effect so I end up having to turn off Zone Alarm. As soon as I do, the numbers of packets sent and received goes way up and the internet works fine. Here are the 3 logs you requested. Username "Owner" - 07/20/2008 16:37:48 [Fixwareout edited 9/01/2007] ~~~~~ Prerun check Successfully flushed the DNS Resolver Cache. System was rebooted successfully. ~~~~~ Postrun check HKLM\SOFTWARE\~\Winlogon\ "System"="" .... HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion "lxusc" Value deleted HKCR\CLSID\{B1AEC0C6-3668-433D-84EC-02F764E960B5}\_h\4 Deleted. .... ~~~~~ Misc files. C:\WINDOWS\Help\SPAlert.chm Deleted .... ~~~~~ Checking for older varients. .... ~~~~~ Current runs (hklm hkcu "run" Keys Only) [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Recguard"="C:\\WINDOWS\\SMINST\\RECGUARD.EXE" "PS2"="C:\\WINDOWS\\system32\\ps2.exe" "hpsysdrv"="c:\\windows\\system\\hpsysdrv.exe" "HPDJ Taskbar Utility"="C:\\WINDOWS\\System32\\spool\\drivers\\w32x86\\3\\hpztsb07.exe" "exe.mssmd"="C:\\WINDOWS\\system32\\dmssm.exe" "exe.zhzmd"="C:\\WINDOWS\\system32\\dmzhz.exe" "exe.vklmd"="C:\\WINDOWS\\system32\\dmlkv.exe" "exe.zpqmd"="C:\\WINDOWS\\system32\\dmqpz.exe" "exe.sximd"="C:\\WINDOWS\\system32\\dmixs.exe" "exe.voymd"="C:\\WINDOWS\\system32\\dmyov.exe" "exe.rxpmd"="C:\\WINDOWS\\system32\\dmpxr.exe" "exe.bfamd"="C:\\WINDOWS\\system32\\dmafb.exe" "exe.asdmd"="C:\\WINDOWS\\system32\\dmdsa.exe" "exe.tbwmd"="C:\\WINDOWS\\system32\\dmwbt.exe" "exe.pilmd"="C:\\WINDOWS\\system32\\dmlip.exe" "exe.oklmd"="C:\\WINDOWS\\system32\\dmlko.exe" "UpdateManager"="\"C:\\Program Files\\Common Files\\Sonic\\Update Manager\\sgtray.exe\" /r" "ZoneAlarm Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\"" "AVG8_TRAY"="C:\\PROGRA~1\\AVG\\AVG8\\avgtray.exe" "TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot" "Sysnet"="C:\\DOCUME~1\\Owner\\LOCALS~1\\Temp\\sysnet.exe" "SunJavaUpdateSched"="C:\\Program Files\\Java\\jre1.5.0_01\\bin\\jusched.exe" "slamm"="MON76234.exe" "QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime" "nwiz"="nwiz.exe /installquiet /keeploaded /nodetect" "NvCplDaemon"="RUNDLL32.EXE C:\\WINDOWS\\System32\\NvCpl.dll,NvStartup" "ISUSScheduler"="\"C:\\PROGRA~1\\COMMON~1\\INSTAL~1\\UPDATE~1\\issch.exe\" -start" "ISUSPM Startup"="C:\\PROGRA~1\\COMMON~1\\INSTAL~1\\UPDATE~1\\ISUSPM.exe -startup" "IgfxTray"="C:\\WINDOWS\\system32\\igfxtray.exe" "HotKeysCmds"="C:\\WINDOWS\\system32\\hkcmd.exe" "ccApp"="\"C:\\Program Files\\Common Files\\Symantec Shared\\ccApp.exe\"" "bnui"="Shaitan1678.exe" "AlcxMonitor"="ALCXMNTR.EXE" [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "XTermInit"="lpt.exe" "Sonic RecordNow!"="" "SpybotSD TeaTimer"="C:\\Program Files\\Spybot - Search & Destroy\\TeaTimer.exe" "zxc"="FLKPT.exe" "updateMgr"="\"C:\\Program Files\\Adobe\\Acrobat 7.0\\Reader\\AdobeUpdateManager.exe\" AcRdB7_0_8 -reboot 1" "NVIEW"="rundll32.exe nview.dll,nViewLoadHook" "MsnMsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background" "lpt"="br0ken.exe" "Aim6"="\"C:\\Program Files\\AIM6\\aim6.exe\" /d locale=en-US ee://aol/imApp" .... Hosts file was reset, If you use a custom hosts file please replace it... ~~~~~ End report ~~~~~ Malwarebytes' Anti-Malware 1.21 Database version: 971 Windows 5.1.2600 Service Pack 3 6:13:52 PM 7/20/2008 mbam-log-7-20-2008 (18-13-49).txt Scan type: Quick Scan Objects scanned: 39934 Time elapsed: 32 minute(s), 19 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 6:47:35 PM, on 7/20/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16674) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\ps2.exe C:\windows\system\hpsysdrv.exe C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\Program Files\QuickTime\qttask.exe C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqSTE08.exe C:\WINDOWS\system32\HPZipm12.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\WINDOWS\system32\taskmgr.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://qus8.hpwis.com/ R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://login.passport.net/uilogin.srf?lc=1033&id=2 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/...//www.yahoo.com R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Hello! R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe O4 - HKLM\..\Run: [exe.mssmd] C:\WINDOWS\system32\dmssm.exe O4 - HKLM\..\Run: [exe.zhzmd] C:\WINDOWS\system32\dmzhz.exe O4 - HKLM\..\Run: [exe.vklmd] C:\WINDOWS\system32\dmlkv.exe O4 - HKLM\..\Run: [exe.zpqmd] C:\WINDOWS\system32\dmqpz.exe O4 - HKLM\..\Run: [exe.sximd] C:\WINDOWS\system32\dmixs.exe O4 - HKLM\..\Run: [exe.voymd] C:\WINDOWS\system32\dmyov.exe O4 - HKLM\..\Run: [exe.rxpmd] C:\WINDOWS\system32\dmpxr.exe O4 - HKLM\..\Run: [exe.bfamd] C:\WINDOWS\system32\dmafb.exe O4 - HKLM\..\Run: [exe.asdmd] C:\WINDOWS\system32\dmdsa.exe O4 - HKLM\..\Run: [exe.tbwmd] C:\WINDOWS\system32\dmwbt.exe O4 - HKLM\..\Run: [exe.pilmd] C:\WINDOWS\system32\dmlip.exe O4 - HKLM\..\Run: [exe.oklmd] C:\WINDOWS\system32\dmlko.exe O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot O4 - HKLM\..\Run: [Sysnet] C:\DOCUME~1\Owner\LOCALS~1\Temp\sysnet.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe O4 - HKLM\..\Run: [slamm] MON76234.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [ISUSScheduler] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe" -start O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [bnui] Shaitan1678.exe O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKCU\..\Run: [XTermInit] lpt.exe O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe O4 - HKCU\..\Run: [zxc] FLKPT.exe O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_8 -reboot 1 O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [lpt] br0ken.exe O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp O4 - HKUS\S-1-5-18\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet (User 'Default user') O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe O4 - Global Startup: Kodak EasyShare software.lnk = C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZS O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe O9 - Extra button: (no name) - {AFC3FA82-AD07-45cd-8B57-983435B9899E} - (no file) O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O16 - DPF: {03F998B2-0E00-11D3-A498-00104B6EB52E} (MetaStreamCtl Class) - https://components.viewpoint.com/MTSInstall...MetaStream3.cab O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/pcpitstop/PCPitStop.CAB O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoftware.com/activescan/cabs/as2stubie.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://www.johannrain-softwareentwicklung....can8/oscan8.cab O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo...otoUploader.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1128383746453 O16 - DPF: {A8F2B9BD-A6A0-486A-9744-18920D898429} (ScorchPlugin Class) - http://www.sibelius.com/download/software/...tiveXPlugin.cab O16 - DPF: {CAFEEFAC-0015-0000-0001-ABCDEFFEDCBA} (Java Plug-in 1.5.0_01) - O16 - DPF: {D1ACD2D8-7312-4D06-BECD-90EB094D2277} - http://mediaplayer.walmart.com/installer/install.cab O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://download.games.yahoo.com/games/web_...inematycoon.cab O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by108fd.bay108.hotmail.msn.com/activex/HMAtchmt.ocx O17 - HKLM\System\CCS\Services\Tcpip\..\{8C51193C-6208-4FBC-8507-46FA73620CCC}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CS2\Services\Tcpip\..\{1FE7BB8C-74A2-4688-BA6C-8C827C35353D}: NameServer = 208.67.220.220,208.67.222.222 O17 - HKLM\System\CS4\Services\Tcpip\..\{1FE7BB8C-74A2-4688-BA6C-8C827C35353D}: NameServer = 208.67.220.220,208.67.222.222 O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe O24 - Desktop Component 0: (no name) - http://www.cyberzeus.com/swdesktop/featured/wallpaper.jpg O24 - Desktop Component 1: (no name) - file:///C:/DOCUME~1/Owner/LOCALS~1/Temp/msohtml1/01/clip_image002.jpg O24 - Desktop Component 2: (no name) - file:///C:/DOCUME~1/Owner/LOCALS~1/Temp/msohtml1/01/clip_image001.jpg -- End of file - 11777 bytes |
|
|
|
|
Jul 20 2008, 07:36 PM
Post
#4
|
|
|
SuperHelper Group: Malware Expert Posts: 7,037 Joined: 3-December 04 From: Darien, Connecticut Member No.: 19,436 Operating System: Win Xp Home SP3/ Vista Home Premium SP1 |
Hi,
What I would do is to uninstall ZoneAlarm, we can reinstall it when where done. Do this first...Important Disable the TeaTimer, you can re enable it when were done if you wish
Open HijackThis > Do a System Scan Only, close your browser and all open windows including this one, the only program or window you should have open is HijackThis, check the following entries and click on Fix Checked. R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://red.clientapps.yahoo.com/customize/...//www.yahoo.com O4 - HKLM\..\Run: [exe.mssmd] C:\WINDOWS\system32\dmssm.exe O4 - HKLM\..\Run: [exe.zhzmd] C:\WINDOWS\system32\dmzhz.exe O4 - HKLM\..\Run: [exe.vklmd] C:\WINDOWS\system32\dmlkv.exe O4 - HKLM\..\Run: [exe.zpqmd] C:\WINDOWS\system32\dmqpz.exe O4 - HKLM\..\Run: [exe.sximd] C:\WINDOWS\system32\dmixs.exe O4 - HKLM\..\Run: [exe.voymd] C:\WINDOWS\system32\dmyov.exe O4 - HKLM\..\Run: [exe.rxpmd] C:\WINDOWS\system32\dmpxr.exe O4 - HKLM\..\Run: [exe.bfamd] C:\WINDOWS\system32\dmafb.exe O4 - HKLM\..\Run: [exe.asdmd] C:\WINDOWS\system32\dmdsa.exe O4 - HKLM\..\Run: [exe.tbwmd] C:\WINDOWS\system32\dmwbt.exe O4 - HKLM\..\Run: [exe.pilmd] C:\WINDOWS\system32\dmlip.exe O4 - HKLM\..\Run: [exe.oklmd] C:\WINDOWS\system32\dmlko.exe O4 - HKLM\..\Run: [Sysnet] C:\DOCUME~1\Owner\LOCALS~1\Temp\sysnet.exe O4 - HKLM\..\Run: [slamm] MON76234.exe O4 - HKLM\..\Run: [bnui] Shaitan1678.exe O4 - HKCU\..\Run: [zxc] FLKPT.exe O4 - HKCU\..\Run: [lpt] br0ken.exe If you know what these are and know them to be safe then keep them O24 - Desktop Component 0: (no name) - http://www.cyberzeus.com/swdesktop/featured/wallpaper.jpg O24 - Desktop Component 1: (no name) - file:///C:/DOCUME~1/Owner/LOCALS~1/Temp/msohtml1/01/clip_image002.jpg O24 - Desktop Component 2: (no name) - file:///C:/DOCUME~1/Owner/LOCALS~1/Temp/msohtml1/01/clip_image001.jpg Download ComboFix from Here or Here to your Desktop. In the event you already have Combofix, this is a new version that I need you to download. It must be saved directly to your desktop. 1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
2. Close any open browsers and make sure you are disconnected from the net. Unplug the cable if need be before running combofix.
3. Now double click on combofix.exe & follow the prompts. When finished, it will produce a report for you. Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze. |
|
|
|
|
Jul 21 2008, 12:51 AM
Post
#5
|
|
|
Authentic Member Group: Authentic Member Posts: 40 Joined: 6-February 08 Member No.: 76,641 Operating System: Windows XP |
It's running faster already! Can I turn Tea Timer back on now or should I wait until everything's cleaned up? Here are the 2 logs: ComboFix 08-07-20.5 - Owner 2008-07-21 0:52:28.1 - NTFSx86 Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\WINDOWS\file.bat . ((((((((((((((((((((((((( Files Created from 2008-06-21 to 2008-07-21 ))))))))))))))))))))))))))))))) . 2008-07-20 18:46 . 2008-07-20 18:46 <DIR> d-------- C:\Program Files\Trend Micro 2008-07-20 17:25 . 2008-07-18 19:15 36,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys 2008-07-20 16:22 . 2008-07-20 16:55 <DIR> d-------- C:\fixwareout 2008-07-14 13:19 . 2008-07-14 13:19 <DIR> d-------- C:\WINDOWS\system32\scripting 2008-07-14 13:19 . 2008-07-14 13:19 <DIR> d-------- C:\WINDOWS\system32\en 2008-07-14 13:19 . 2008-07-14 13:19 <DIR> d-------- C:\WINDOWS\l2schemas 2008-07-14 12:05 . 2008-04-13 19:12 346,112 --------- C:\WINDOWS\system32\windowscodecsext.dll 2008-07-14 12:05 . 2008-04-13 19:12 276,992 --------- C:\WINDOWS\system32\wmphoto.dll 2008-07-14 12:05 . 2008-04-13 19:12 69,120 --------- C:\WINDOWS\system32\wlanapi.dll 2008-07-14 12:04 . 2008-04-13 19:12 712,704 --------- C:\WINDOWS\system32\windowscodecs.dll 2008-07-14 12:04 . 2008-04-13 19:12 53,248 --------- C:\WINDOWS\system32\tsgqec.dll 2008-07-14 12:04 . 2008-04-13 19:12 50,688 --------- C:\WINDOWS\system32\tspkg.dll 2008-07-14 12:04 . 2008-04-13 19:12 32,768 --------- C:\WINDOWS\system32\setupn.exe 2008-07-14 12:04 . 2008-04-13 13:40 10,240 --------- C:\WINDOWS\system32\drivers\sffp_mmc.sys 2008-07-14 12:02 . 2008-04-13 19:11 397,312 --------- C:\WINDOWS\system32\mmcex.dll 2008-07-14 12:02 . 2008-04-13 19:11 184,320 --------- C:\WINDOWS\system32\microsoft.managementconsole.dll 2008-07-14 12:02 . 2008-04-13 19:12 155,136 --------- C:\WINDOWS\system32\mssha.dll 2008-07-14 12:02 . 2008-04-13 19:11 106,496 --------- C:\WINDOWS\system32\mmcfxcommon.dll 2008-07-14 12:02 . 2008-04-13 13:14 76,800 --------- C:\WINDOWS\system32\msshavmsg.dll 2008-07-14 12:02 . 2008-04-13 19:11 37,376 --------- C:\WINDOWS\system32\l2gpstore.dll 2008-07-14 12:02 . 2008-04-13 19:12 33,792 --------- C:\WINDOWS\system32\mmcperf.exe 2008-07-14 12:00 . 2008-04-13 19:11 650,752 --------- C:\WINDOWS\system32\dot3ui.dll 2008-07-14 01:34 . 2008-06-19 17:24 28,544 --a------ C:\WINDOWS\system32\drivers\pavboot.sys 2008-07-13 22:38 . 2008-07-13 22:38 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com 2008-07-13 22:35 . 2008-07-13 22:36 <DIR> d-------- C:\Program Files\SUPERAntiSpyware 2008-07-13 22:35 . 2008-07-13 22:35 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\SUPERAntiSpyware.com 2008-07-13 22:34 . 2008-07-13 22:34 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard 2008-07-05 09:53 . 2008-03-25 03:37 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl 2008-07-05 09:28 . 2008-07-05 09:28 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Malwarebytes 2008-07-05 09:27 . 2008-07-20 17:26 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware 2008-07-05 09:27 . 2008-07-05 09:27 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes 2008-07-05 09:27 . 2008-07-18 19:15 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys 2008-07-04 18:46 . 2008-07-10 11:56 <DIR> d-------- C:\Program Files\Google 2008-06-29 04:40 . 2008-07-05 10:37 <DIR> d--h----- C:\$AVG8.VAULT$ 2008-06-29 00:50 . 2008-07-04 13:39 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys 2008-06-29 00:50 . 2008-07-04 13:40 76,040 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys 2008-06-29 00:50 . 2008-07-04 13:39 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll 2008-06-29 00:49 . 2008-07-20 17:27 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg 2008-06-29 00:49 . 2008-06-29 00:49 <DIR> d-------- C:\Program Files\AVG 2008-06-29 00:49 . 2008-06-29 00:49 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8 2008-06-28 22:34 . 2008-06-13 06:05 272,128 -----c--- C:\WINDOWS\system32\dllcache\bthport.sys 2008-06-28 22:32 . 2008-05-08 09:02 203,136 -----c--- C:\WINDOWS\system32\dllcache\rmcast.sys . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-07-14 06:33 --------- d-----w C:\Program Files\Panda Security 2008-07-05 23:31 --------- d-----w C:\Program Files\Viewpoint 2008-07-05 23:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint 2008-07-05 15:12 --------- d-----w C:\Program Files\Java 2008-07-04 23:38 --------- d--h--w C:\Documents and Settings\Owner\Application Data\GTek 2008-07-03 19:22 --------- d-----w C:\Documents and Settings\Owner\Application Data\MSN6 2008-07-03 18:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-06-29 04:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft 2008-06-20 17:46 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-06-20 11:51 361,600 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys 2008-06-20 11:40 138,496 ----a-w C:\WINDOWS\system32\drivers\afd.sys 2008-06-20 11:08 225,856 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys 2008-06-13 11:05 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys 2008-05-13 22:02 691,545 ----a-w C:\WINDOWS\unins000.exe 2008-05-09 10:53 90,112 ----a-w C:\WINDOWS\system32\wshext.dll 2008-05-09 10:53 430,080 ----a-w C:\WINDOWS\system32\vbscript.dll 2008-05-09 10:53 180,224 ----a-w C:\WINDOWS\system32\scrobj.dll 2008-05-09 10:53 172,032 ----a-w C:\WINDOWS\system32\scrrun.dll 2008-05-08 11:24 155,648 ----a-w C:\WINDOWS\system32\wscript.exe 2008-05-07 09:07 135,168 ----a-w C:\WINDOWS\system32\cscript.exe 2008-05-07 05:12 1,288,192 ----a-w C:\WINDOWS\system32\quartz.dll 2008-04-23 04:16 826,368 ----a-w C:\WINDOWS\system32\wininet.dll 2006-03-03 21:37 35,216 ----a-w C:\Documents and Settings\Owner\Application Data\GDIPFONTCACHEV1.DAT 2006-02-27 00:46 240,507 ----a-w C:\Program Files\audioscrobbler.wmp.1.1.10.exe 2004-08-04 05:10 26,407 ------w C:\WINDOWS\inf\SET5DA.tmp . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-13 19:12 15360] "swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-07-05 23:55 171448] "NVIEW"="nview.dll" [2003-03-03 18:44 831557 C:\WINDOWS\system32\nview.dll] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "PS2"="C:\WINDOWS\system32\ps2.exe" [2002-07-31 21:28 81920] "hpsysdrv"="c:\windows\system\hpsysdrv.exe" [1998-05-07 18:04 52736] "HPDJ Taskbar Utility"="C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb07.exe" [2002-11-27 06:29 188416] "UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2003-08-19 02:01 110592] "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-07-04 13:40 1232152] "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2004-11-07 01:07 180269] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2005-06-05 17:37 98304] "NvCplDaemon"="C:\WINDOWS\System32\NvCpl.dll" [2003-03-03 18:44 4595712] "ISUSScheduler"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\issch.exe" [2004-06-16 07:03 81920] "ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-06-16 07:03 221184] "IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2004-08-20 16:55 155648] "HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2004-08-20 16:51 118784] "nwiz"="nwiz.exe" [2003-03-03 18:44 323584 C:\WINDOWS\system32\nwiz.exe] "AlcxMonitor"="ALCXMNTR.EXE" [2004-09-07 14:47 57344 C:\WINDOWS\ALCXMNTR.EXE] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 04:38:16 29696] HP Digital Imaging Monitor.lnk - C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpqtra08.exe [2006-02-19 05:21:22 288472] Kodak EasyShare software.lnk - C:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe [2006-06-07 06:26:28 180224] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 10:13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=avgrsstx.dll [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Driver] @="" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\AVG Anti-Spyware Guard] @="" HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update [HKEY_LOCAL_MACHINE\software\microsoft\security center] "FirewallOverride"=dword:00000001 [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile] "EnableFirewall"= 0 (0x0) "DisableNotifications"= 1 (0x1) [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "C:\\WINDOWS\\system32\\java.exe"= "C:\\WINDOWS\\system32\\sessmgr.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"= "%windir%\\Network Diagnostic\\xpnetdiag.exe"= "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "C:\\Program Files\\AVG\\AVG8\\avgemc.exe"= "C:\\Program Files\\SUPERAntiSpyware\\SUPERAntiSpyware.exe"= "%windir%\\system32\\sessmgr.exe"= [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List] "3389:TCP"= 3389:TCP:*:Disabled:@xpsp2res.dll,-22009 R0 pavboot;pavboot;C:\WINDOWS\system32\drivers\pavboot.sys [2008-06-19 17:24] R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-07-04 13:39] R2 avg8emc;AVG8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-07-04 13:39] R2 avg8wd;AVG8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-07-04 13:40] R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-07-04 13:40] S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\wg111v2.sys [] *Newly Created Service* - CATCHME *Newly Created Service* - PROCEXP90 . Contents of the 'Scheduled Tasks' folder "2008-07-18 09:00:23 C:\WINDOWS\Tasks\AVG Anti-Spyware.job" - C:\PROGRA~1\Grisoft\AVGANT~1.5\avgas.exe "2003-10-18 01:58:30 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1057876983.job" - C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe4-I . - - - - ORPHANS REMOVED - - - - HKCU-Run-MsnMsgr - C:\Program Files\MSN Messenger\MsnMsgr.Exe HKCU-Run-Aim6 - C:\Program Files\AIM6\aim6.exe HKCU-Run-XTermInit - lpt.exe HKCU-Run-Sonic RecordNow! - (no file) HKLM-Run-Recguard - C:\WINDOWS\SMINST\RECGUARD.EXE HKLM-Run-SunJavaUpdateSched - C:\Program Files\Java\jre1.5.0_01\bin\jusched.exe HKLM-Run-ccApp - C:\Program Files\Common Files\Symantec Shared\ccApp.exe HKU-Default-Run-Yahoo! Pager - C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE Notify-NavLogon - (no file) . ------- Supplementary Scan ------- . R0 -: HKCU-Main |