 Smacchat, Blogs?, vulguar ads, Problems with smacchat and other adware |
Welcome Guest to What the Tech! ( Log In | Register ) We specialize in the removal of malicious software (malware), but here you'll find free help and support for all your tech questions. We invite you to ask questions, share experiences, and learn. Explore our message boards, or register now to post messages of your own. Please Start Here. Register today (registration removes advertising)
  |
 Aug 18 2008, 02:39 PM
Post
#1
|
|
|
New Member  Group: New Member Posts: 6 Joined: 18-August 08 Member No.: 81,056 Operating System: Windows Xp  |
Long story short I AVG 8 detected a viruis I wiped the object, however that did not fix the problem. I know have obscence ads, smacchat ads appearing everywhere. I have read previous posts and have already done HijackThis log to post here. I have ran avg and it shows only that my shell and kernell files have been changed, not much help there. And I have run Lavasoft Ad-Aware remover and it has removed the occasionally spyware. Nothing seems to help! I am leaving for college this week and need a healty laptop for the work ahead, someone please help me. Here is my log...thanxs in advance
Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 4:29:06 PM, on 8/18/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\hkcmd.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\system32\WLTRAY.exe C:\WINDOWS\stsystra.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe C:\WINDOWS\system32\ctfmon.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\explorer.exe C:\Documents and Settings\Hali\Local Settings\Temporary Internet Files\Content.IE5\C12F4HUV\avg_free_stf_en_8_138a1332[1].exe C:\DOCUME~1\Hali\LOCALS~1\Temp\7zS1D.tmp\avgsetup.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\WINDOWS\system32\msiexec.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = https://webmail.vt.edu/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com O3 - Toolbar: Pop-Up Blocker - {D7F30B62-8269-41AF-9539-B2697FA7D77E} - C:\Program Files\EarthLink TotalAccess\PnEL.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing) O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [DLCGCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll,_RunDLLEntry@16 O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [e4e0ab4f] rundll32.exe "C:\WINDOWS\system32\aljjpkon.dll",b O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-21-2837568732-1308431763-2382294085-501\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe (User 'Guest') O4 - HKUS\S-1-5-21-2837568732-1308431763-2382294085-501\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime (User 'Guest') O4 - HKUS\S-1-5-21-2837568732-1308431763-2382294085-501\..\Run: [DellSupport-] "C:\Program Files\Dell Support\DSAgnt.exe" /startup (User 'Guest') O4 - HKUS\S-1-5-21-2837568732-1308431763-2382294085-501\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Guest') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVGFRE~1\avgw.exe /RUNONCE (User 'Default user') O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/Facebo...toUploader5.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by23fd.bay23.hotmail.msn.com/resources/MsnPUpld.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab56649.cab O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - http://3dlifeplayer.dl.3dvia.com/player/in...l/installer.exe O16 - DPF: {DA80E089-4648-43D5-93B4-7F37917084E6} (CacheManager.CacheManagerCtrl) - http://www.candystand.com/assets/activex/v...acheManager.CAB O20 - AppInit_DLLs: whynyt.dll O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe O23 - Service: dlcg_device - - C:\WINDOWS\system32\dlcgcoms.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE -- End of file - 6683 bytes |
 |
 
|
|
Aug 20 2008, 02:57 PM
Post
#2
|
|
 Anti-Malware Buddha  Group: Classroom Teacher Posts: 3,587 Joined: 22-July 04 From: New England, USA Member No.: 10,811 Operating System: Windows XP Pro SP3 ~ Vista Ultimate ~ Ubuntu Linux |
Hi and welcome to the forums here at WTT!
 Please download ComboFix from Here or Here to your Desktop. **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
**Note: Do not mouseclick combofix's window while it's running. That may cause it to stall** |
|
|
|
|
Aug 21 2008, 09:36 AM
Post
#3
|
|
|
New Member Group: New Member Posts: 6 Joined: 18-August 08 Member No.: 81,056 Operating System: Windows Xp |
Thank you for your quick reply. I done as you instructed and here are the Combo Fix & Hijack This Logs. Thanks!
 ComboFix 08-08-19.06 - Hali 2008-08-21 4:56:58.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.213 [GMT -4:00] Running from: C:\Documents and Settings\Hali\Desktop\ComboFix.exe * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . C:\Documents and Settings\Hali\Application Data\macromedia\Flash Player\#SharedObjects\JLQ49FED\interclick.com C:\Documents and Settings\Hali\Application Data\macromedia\Flash Player\#SharedObjects\JLQ49FED\interclick.com\ud.sol C:\Documents and Settings\Hali\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com C:\Documents and Settings\Hali\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol C:\WINDOWS\cookies.ini C:\WINDOWS\system32\awtqqrpq.dll C:\WINDOWS\system32\hinmvd.dll C:\WINDOWS\system32\kmaujplo.dll C:\WINDOWS\system32\mcrh.tmp C:\WINDOWS\system32\mqeemcxd.dll C:\WINDOWS\system32\nokpjjla.ini C:\WINDOWS\system32\olpjuamk.ini C:\WINDOWS\system32\qprqqtwa.ini C:\WINDOWS\system32\qprqqtwa.ini2 C:\WINDOWS\system32\xdodcdby.dll C:\WINDOWS\system32\xxyXoPFy.dll C:\WINDOWS\system32\ybdcdodx.ini . ((((((((((((((((((((((((( Files Created from 2008-07-21 to 2008-08-21 ))))))))))))))))))))))))))))))) . 2008-08-19 15:24 . 2008-08-19 15:24 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-08-19 15:24 . 2008-08-19 16:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-08-19 15:06 . 2008-08-19 22:32 2,422 --a------ C:\WINDOWS\system32\tmp.reg 2008-08-19 15:00 . 2006-04-27 02:29 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Gtek 2008-08-19 15:00 . 2006-04-27 02:34 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Corel 2008-08-19 14:59 . 2008-08-19 15:00 <DIR> d-------- C:\Documents and Settings\Administrator 2008-08-18 18:52 . 2008-08-21 04:36 <DIR> d--h----- C:\$AVG8.VAULT$ 2008-08-18 16:31 . 2008-08-21 04:19 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg 2008-08-18 16:31 . 2008-08-18 16:31 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys 2008-08-18 16:31 . 2008-08-18 16:31 76,040 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys 2008-08-18 16:31 . 2008-08-18 16:31 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll 2008-08-18 16:30 . 2008-08-18 16:30 <DIR> d-------- C:\Program Files\AVG 2008-08-18 16:30 . 2008-08-18 16:30 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8 2008-08-18 16:28 . 2008-08-18 16:28 <DIR> d-------- C:\Program Files\Trend Micro 2008-08-09 12:29 . 2008-08-09 12:29 7,985,707 --a------ C:\wreck.avi.MOV 2008-08-09 12:27 . 2008-08-09 12:27 <DIR> d-------- C:\Program Files\AviSynth 2.5 2008-08-09 12:27 . 2004-02-22 10:11 719,872 --a------ C:\WINDOWS\system32\devil.dll 2008-08-09 12:27 . 2006-10-07 17:43 502,784 --a------ C:\WINDOWS\x2.64.exe 2008-08-09 12:27 . 2007-05-14 15:24 394,240 --a------ C:\WINDOWS\system32\Smab.dll 2008-08-09 12:27 . 2007-05-17 17:30 318,976 --a------ C:\WINDOWS\system32\avisynth.dll 2008-08-09 12:27 . 2005-02-28 13:16 240,128 --a------ C:\WINDOWS\system32\x.264.exe 2008-08-09 12:27 . 2006-04-12 09:47 217,073 --a------ C:\WINDOWS\meta4.exe 2008-08-09 12:27 . 2004-01-25 00:00 70,656 --a------ C:\WINDOWS\system32\yv12vfw.dll 2008-08-09 12:27 . 2004-01-25 00:00 70,656 --a------ C:\WINDOWS\system32\i420vfw.dll 2008-08-09 12:27 . 2006-04-05 08:09 66,560 --a------ C:\WINDOWS\MOTA113.exe 2008-08-09 12:27 . 2005-07-14 12:31 27,648 --a------ C:\WINDOWS\system32\AVSredirect.dll 2008-08-09 12:26 . 2005-02-12 18:00 186,880 -rahs---- C:\WINDOWS\system32\RLOgg.ax 2008-08-09 12:26 . 2005-01-17 18:26 179,200 -rahs---- C:\WINDOWS\system32\DiracSplitter.ax 2008-08-09 12:26 . 2006-08-16 09:53 175,104 -rahs---- C:\WINDOWS\system32\CoreAAC.ax 2008-08-09 12:26 . 2005-02-05 18:00 92,672 -rahs---- C:\WINDOWS\system32\RLVorbisDec.ax 2008-08-09 12:26 . 2005-02-22 11:55 81,920 -rahs---- C:\WINDOWS\system32\aac_parser.ax 2008-08-09 12:26 . 2005-02-12 18:00 67,584 -rahs---- C:\WINDOWS\system32\RLTheoraDec.ax 2008-08-09 12:26 . 2005-02-12 18:00 51,712 -rahs---- C:\WINDOWS\system32\RLSpeexDec.ax 2008-08-08 19:02 . 2008-08-09 15:51 <DIR> d-------- C:\Program Files\DVR365-Player . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-19 18:35 --------- d-----w C:\Program Files\Jasc Software Inc 2008-08-19 18:35 --------- d-----w C:\Documents and Settings\Hali\Application Data\Jasc Software Inc 2008-07-31 18:20 --------- d-----w C:\Documents and Settings\Hali\Application Data\AdobeUM 2008-07-24 14:23 --------- d-----w C:\Program Files\Java 2008-07-23 20:17 --------- d-----w C:\Program Files\Dl_cats 2008-07-23 20:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Trymedia 2008-07-19 16:43 --------- d--h--w C:\Program Files\InstallShield Installation Information 2007-08-05 21:44 56 -csh--r C:\WINDOWS\system32\0618BB27E3.sys 2007-07-21 13:50 88 -csh--r C:\WINDOWS\system32\E327BB1806.sys 2007-08-05 21:44 6,528 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-14 21:49 94208] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-14 21:46 77824] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-10-14 21:50 114688] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-11-29 05:56 761947] "dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-12-06 02:05 127035] "DLCGCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll" [2005-09-08 14:56 73728] "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-08-18 16:30 1232152] "Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [2005-12-19 16:08 1347584] "SigmatelSysTrayApp"="stsystra.exe" [2005-09-10 00:19 393216 C:\WINDOWS\stsystra.exe] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=whynyt.dll,avgrsstx.dll hinmvd.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.I420"= i420vfw.dll "vidc.yv12"= yv12vfw.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Works Calendar Reminders.lnk backup=C:\WINDOWS\pss\Microsoft Works Calendar Reminders.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Hali^Start Menu^Programs^Startup^LimeWire On Startup.lnk] path=C:\Documents and Settings\Hali\Start Menu\Programs\Startup\LimeWire On Startup.lnk backup=C:\WINDOWS\pss\LimeWire On Startup.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ShowLOMControl] [X] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI] --a------ 2005-12-19 16:08 1347584 C:\WINDOWS\system32\WLTRAY.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dlcgmon.exe] --a------ 2005-10-21 11:42 425984 C:\Program Files\Dell AIO 810\DLCGmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher] --------- 2005-12-09 20:29 49152 C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\E6TaskPanel] --a------ 2003-12-08 15:51 733184 C:\Program Files\EarthLink TotalAccess\TaskPanl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] --a------ 2005-06-10 11:44 249856 C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] --a------ 2005-06-10 11:44 81920 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2007-11-15 14:11 267048 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection] --a------ 2001-08-16 23:41 28738 C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --a------ 2004-10-13 12:24 1694208 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2007-11-15 00:43 286720 C:\Program Files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] -rahs---- 2008-07-07 09:42 2156368 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2008-06-10 04:27 144784 C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "AVGEMS"=2 (0x2) "WinDefend"=2 (0x2) "WMPNetworkSvc"=3 (0x3) "usnjsvc"=3 (0x3) "ose"=3 (0x3) "iPod Service"=3 (0x3) "Apple Mobile Device"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\LimeWire\\LimeWire.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\AVG\\AVG8\\avgemc.exe"= "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"= R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-08-18 16:31] R2 avg8emc;AVG Free8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-08-18 16:30] R2 avg8wd;AVG Free8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-08-18 16:30] R2 AvgTdiX;AVG Free8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-08-18 16:31] . Contents of the 'Scheduled Tasks' folder 2008-02-27 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 15:57] . - - - - ORPHANS REMOVED - - - - HKLM-Run-e4e0ab4f - C:\WINDOWS\system32\kmaujplo.dll MSConfigStartUp-AlcoholAutomount - C:\Documents and Settings\Hali\Desktop\Alcohol 120\axcmd.exe MSConfigStartUp-e4e0ab4f - C:\WINDOWS\system32\xdodcdby.dll MSConfigStartUp-MCAgentExe - c:\PROGRA~1\mcafee.com\agent\mcagent.exe MSConfigStartUp-MCUpdateExe - c:\PROGRA~1\mcafee.com\agent\mcupdate.exe MSConfigStartUp-MPFExe - C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe MSConfigStartUp-MSKAGENTEXE - C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe MSConfigStartUp-MSKDetectorExe - C:\Program Files\McAfee\SpamKiller\MSKDetct.exe MSConfigStartUp-MsnMsgr - C:\Program Files\MSN Messenger\MsnMsgr.Exe MSConfigStartUp-MySpaceIM - C:\Program Files\MySpace\IM\MySpaceIM.exe MSConfigStartUp-OASClnt - C:\Program Files\McAfee.com\VSO\oasclnt.exe MSConfigStartUp-VirusScan Online - c:\PROGRA~1\mcafee.com\vso\mcvsshld.exe MSConfigStartUp-VSOCheckTask - C:\PROGRA~1\McAfee.com\VSO\mcmnhdlr.exe . ------- Supplementary Scan ------- . R0 -: HKCU-Main,Start Page = hxxp://www.webmail.vt.edu/ O8 -: &Google Search - C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 -: &Translate English Word - C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html O8 -: Backward Links - C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 -: Cached Snapshot of Page - C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 -: Similar Pages - C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 -: Translate Page into English - C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html . ************************************************************************** catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-08-21 05:07:41 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . C:\WINDOWS\system32\WLTRYSVC.EXE C:\WINDOWS\system32\BCMWLTRY.EXE C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Dell\NicConfigSvc\NicConfigSvc.exe C:\WINDOWS\system32\igfxsrvc.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\AVG\AVG8\avgrsx.exe C:\WINDOWS\SoftwareDistribution\Download\69b4634e26426212182d03d1e1c76c7b\update\update.exe C:\WINDOWS\system32\imapi.exe . ************************************************************************** . Completion time: 2008-08-21 5:12:05 - machine was rebooted ComboFix-quarantined-files.txt 2008-08-21 09:11:38 Pre-Run: 20,062,486,528 bytes free Post-Run: 19,977,457,664 bytes free 215 --- E O F --- 2008-08-12 19:27:19 Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:36:57, on 8/21/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\WLTRYSVC.EXE C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxsrvc.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\WINDOWS\stsystra.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\WINDOWS\system32\WLTRAY.exe C:\WINDOWS\system32\ctfmon.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\internet explorer\iexplore.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.webmail.vt.edu/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing) O3 - Toolbar: Pop-Up Blocker - {D7F30B62-8269-41AF-9539-B2697FA7D77E} - C:\Program Files\EarthLink TotalAccess\PnEL.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing) O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [DLCGCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll,_RunDLLEntry@16 O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/Facebo...toUploader5.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab56649.cab O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - http://3dlifeplayer.dl.3dvia.com/player/in...l/installer.exe O16 - DPF: {DA80E089-4648-43D5-93B4-7F37917084E6} (CacheManager.CacheManagerCtrl) - http://www.candystand.com/assets/activex/v...acheManager.CAB O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: whynyt.dll,avgrsstx.dll hinmvd.dll O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: dlcg_device - - C:\WINDOWS\system32\dlcgcoms.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE -- End of file - 6475 bytes |
|
|
|
|
Aug 21 2008, 10:42 AM
Post
#4
|
|
|
Anti-Malware Buddha Group: Classroom Teacher Posts: 3,587 Joined: 22-July 04 From: New England, USA Member No.: 10,811 Operating System: Windows XP Pro SP3 ~ Vista Ultimate ~ Ubuntu Linux |
Hi,
Just one entry to fix in HJT, the files are gone but the reference to them in the registry is still there. We'll use a reg fix for this one. Backup Your Registry with ERUNT * Please use the following link and scroll down to ERUNT and download it. http://aumha.org/freeware/freeware.php * For version with the Installer: Use the setup program to install ERUNT on your computer * For the zipped version: Unzip all the files into a folder of your choice. Click Erunt.exe to backup your registry to the folder of your choice. Note: to restore your registry, go to the folder and start ERDNT.exe Open Notepad (press Start->Run, enter notepad and press OK) Copy everything inside the code box below (Starting with REGEDIT4) and paste it into a new notepad file. Change the Save As Type to All Files and save it as fix020.reg to your Desktop. Note: Please copy and paste all the text at once, and check that there is NO blank line above REGEDIT4 and one blank line at the bottom. CODE REGEDIT4 [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows] "AppInit_DLLs"="avgrsstx.dll" Then double-click on the fix020.reg file, and when it prompts to merge say yes. Now reboot and run HijackThis again, please post that log and let me know how it's running at this point. This post has been edited by IndiGenus: Aug 21 2008, 10:43 AM |
|
|
|
|
Aug 21 2008, 10:25 PM
Post
#5
|
|
|
New Member Group: New Member Posts: 6 Joined: 18-August 08 Member No.: 81,056 Operating System: Windows Xp |
It seemed to be working perfect after running ComboFix the first time. However, after jumping online to post here and check my email the pop ups begun again and my computer became bogged down. I ran my AdAware,AVG, and SpyBot. The computer was infected with Virtunode,Virtunode.dll, and WildTangent. I tried clearing them from those programs. Once again it was a temp. fix.
So I started allover again with the ComboFix and then I ran the ERUNT program as you instructed however I am currently in safe mode because before the Internet Explore wouldn't load the fourms for me to reply. Thus I have been opening all programs in Safe Mode. Here is the current HijackThis log. I will continue to run in Safe Mode until you feel I can do otherwise. Ps. A guy from a local computer repair shop instructed me to use SmitFixFraud. It seemed to do nothing and my AVG detected it as "possible fake spyware" or something like that. Will it harm my computer? Thank you for all your support. College starts Monday!  Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 00:20:17, on 8/22/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Safe mode with network support Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.webmail.vt.edu/ R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing) O3 - Toolbar: Pop-Up Blocker - {D7F30B62-8269-41AF-9539-B2697FA7D77E} - C:\Program Files\EarthLink TotalAccess\PnEL.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing) O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [DLCGCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll,_RunDLLEntry@16 O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe O4 - HKLM\..\Run: [e4e0ab4f] rundll32.exe "C:\WINDOWS\system32\mjggvhwg.dll",b O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE /auto O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE O8 - Extra context menu item: &Google Search - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: &Translate English Word - res://C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html O8 - Extra context menu item: Backward Links - res://C:\Program Files\Google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://C:\Program Files\Google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://C:\Program Files\Google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate Page into English - res://C:\Program Files\Google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file) O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/Facebo...toUploader5.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/...ro.cab56649.cab O16 - DPF: {D4323BF2-006A-4440-A2F5-27E3E7AB25F8} - http://3dlifeplayer.dl.3dvia.com/player/in...l/installer.exe O16 - DPF: {DA80E089-4648-43D5-93B4-7F37917084E6} (CacheManager.CacheManagerCtrl) - http://www.candystand.com/assets/activex/v...acheManager.CAB O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: dlcg_device - - C:\WINDOWS\system32\dlcgcoms.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE -- End of file - 5926 bytes |
|
|
|
|
Aug 22 2008, 08:03 AM
Post
#6
|
|
|
Anti-Malware Buddha Group: Classroom Teacher Posts: 3,587 Joined: 22-July 04 From: New England, USA Member No.: 10,811 Operating System: Windows XP Pro SP3 ~ Vista Ultimate ~ Ubuntu Linux |
Hi,
Sorry things have turned for the worse. I can see from your last HJT log that yes, Vundo is back. Let's run combofix again and please post the log. I'll look back and see if I missed anything on the last go around also. For the internet connection issues, try WinsockFix to see if it brings back your connection. I would like you to run combofix in Normal Mode if at all possible. WinsockFix to restore internet connectivity. http://www.spychecker.com/program/winsockxpfix.html The Winsockfix Utility will: · Detect your current Operating System · Release the IP address, taking you "Offline" · Reset the TCP stack using Netsh.exe (Windows XP only) · Delete the current Registry TCP and Winsock Values · Import new "Working" Registry Values · Backup any Current "Hosts" file · Replace the "Hosts" file with a default one · Reboot the Computer Instructions: http://www.home-network-help.com/winsockfix.html |
|
|
|
|
Aug 22 2008, 08:04 AM
Post
#7
|
|
|
Anti-Malware Buddha Group: Classroom Teacher Posts: 3,587 Joined: 22-July 04 From: New England, USA Member No.: 10,811 Operating System: Windows XP Pro SP3 ~ Vista Ultimate ~ Ubuntu Linux |
Oh also. Smitfraudfix tool is fine, and many AV's report it falsely as bad. It's good for removing the Smitfruad infections, but we're dealing with Vundo here. No harm done though, it's a great tool.
|
|
|
|
|
Aug 24 2008, 09:51 AM
Post
#8
|
|
|
New Member Group: New Member Posts: 6 Joined: 18-August 08 Member No.: 81,056 Operating System: Windows Xp |
Okay I run ComboFix again and here is the log from this scan. I think there may have been some confusion concerning my internet on my last post, sorry. I was just saying that when I run the Combo,ERUNT,& Hijackthis I disconnected my computer from my internet; then it seemed as though when I connected back the problems restarted so to say. ComboFix 08-08-23.03 - Hali 2008-08-24 11:43:46.3 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.225 [GMT -4:00] Running from: C:\Documents and Settings\Hali\Desktop\ComboFix.exe * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! . ((((((((((((((((((((((((( Files Created from 2008-07-24 to 2008-08-24 ))))))))))))))))))))))))))))))) . 2008-08-21 18:09 . 2008-08-21 18:09 <DIR> d-------- C:\Program Files\ERUNT 2008-08-19 15:24 . 2008-08-19 15:24 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy 2008-08-19 15:24 . 2008-08-19 16:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy 2008-08-19 15:06 . 2008-08-19 22:32 2,422 --a------ C:\WINDOWS\system32\tmp.reg 2008-08-19 15:00 . 2006-04-27 02:29 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Gtek 2008-08-19 15:00 . 2006-04-27 02:34 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Corel 2008-08-19 14:59 . 2008-08-19 15:00 <DIR> d-------- C:\Documents and Settings\Administrator 2008-08-18 18:52 . 2008-08-21 13:33 <DIR> d--h----- C:\$AVG8.VAULT$ 2008-08-18 16:31 . 2008-08-24 11:40 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg 2008-08-18 16:31 . 2008-08-18 16:31 96,520 --a------ C:\WINDOWS\system32\drivers\avgldx86.sys 2008-08-18 16:31 . 2008-08-18 16:31 76,040 --a------ C:\WINDOWS\system32\drivers\avgtdix.sys 2008-08-18 16:31 . 2008-08-18 16:31 10,520 --a------ C:\WINDOWS\system32\avgrsstx.dll 2008-08-18 16:30 . 2008-08-18 16:30 <DIR> d-------- C:\Program Files\AVG 2008-08-18 16:30 . 2008-08-18 16:30 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8 2008-08-18 16:28 . 2008-08-18 16:28 <DIR> d-------- C:\Program Files\Trend Micro 2008-08-09 12:29 . 2008-08-09 12:29 7,985,707 --a------ C:\wreck.avi.MOV 2008-08-09 12:27 . 2008-08-09 12:27 <DIR> d-------- C:\Program Files\AviSynth 2.5 2008-08-09 12:27 . 2004-02-22 10:11 719,872 --a------ C:\WINDOWS\system32\devil.dll 2008-08-09 12:27 . 2006-10-07 17:43 502,784 --a------ C:\WINDOWS\x2.64.exe 2008-08-09 12:27 . 2007-05-14 15:24 394,240 --a------ C:\WINDOWS\system32\Smab.dll 2008-08-09 12:27 . 2007-05-17 17:30 318,976 --a------ C:\WINDOWS\system32\avisynth.dll 2008-08-09 12:27 . 2005-02-28 13:16 240,128 --a------ C:\WINDOWS\system32\x.264.exe 2008-08-09 12:27 . 2006-04-12 09:47 217,073 --a------ C:\WINDOWS\meta4.exe 2008-08-09 12:27 . 2004-01-25 00:00 70,656 --a------ C:\WINDOWS\system32\yv12vfw.dll 2008-08-09 12:27 . 2004-01-25 00:00 70,656 --a------ C:\WINDOWS\system32\i420vfw.dll 2008-08-09 12:27 . 2006-04-05 08:09 66,560 --a------ C:\WINDOWS\MOTA113.exe 2008-08-09 12:27 . 2005-07-14 12:31 27,648 --a------ C:\WINDOWS\system32\AVSredirect.dll 2008-08-09 12:26 . 2005-02-12 18:00 186,880 -rahs---- C:\WINDOWS\system32\RLOgg.ax 2008-08-09 12:26 . 2005-01-17 18:26 179,200 -rahs---- C:\WINDOWS\system32\DiracSplitter.ax 2008-08-09 12:26 . 2006-08-16 09:53 175,104 -rahs---- C:\WINDOWS\system32\CoreAAC.ax 2008-08-09 12:26 . 2005-02-05 18:00 92,672 -rahs---- C:\WINDOWS\system32\RLVorbisDec.ax 2008-08-09 12:26 . 2005-02-22 11:55 81,920 -rahs---- C:\WINDOWS\system32\aac_parser.ax 2008-08-09 12:26 . 2005-02-12 18:00 67,584 -rahs---- C:\WINDOWS\system32\RLTheoraDec.ax 2008-08-09 12:26 . 2005-02-12 18:00 51,712 -rahs---- C:\WINDOWS\system32\RLSpeexDec.ax 2008-08-08 19:02 . 2008-08-09 15:51 <DIR> d-------- C:\Program Files\DVR365-Player . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-08-22 03:41 --------- d-----w C:\Program Files\Dl_cats 2008-08-19 18:35 --------- d-----w C:\Program Files\Jasc Software Inc 2008-08-19 18:35 --------- d-----w C:\Documents and Settings\Hali\Application Data\Jasc Software Inc 2008-07-31 18:20 --------- d-----w C:\Documents and Settings\Hali\Application Data\AdobeUM 2008-07-24 14:23 --------- d-----w C:\Program Files\Java 2008-07-23 20:14 --------- d-----w C:\Documents and Settings\All Users\Application Data\Trymedia 2008-07-19 16:43 --------- d--h--w C:\Program Files\InstallShield Installation Information 2008-07-07 20:32 253,952 ----a-w C:\WINDOWS\system32\es.dll 2008-07-07 20:32 253,952 ------w C:\WINDOWS\system32\dllcache\es.dll 2008-06-24 16:23 74,240 ----a-w C:\WINDOWS\system32\mscms.dll 2008-06-24 16:23 74,240 ------w C:\WINDOWS\system32\dllcache\mscms.dll 2008-06-23 16:12 667,136 ----a-w C:\WINDOWS\system32\wininet.dll 2008-06-23 16:12 667,136 ------w C:\WINDOWS\system32\dllcache\wininet.dll 2008-06-23 16:12 618,496 ------w C:\WINDOWS\system32\dllcache\urlmon.dll 2008-06-23 16:12 532,480 ----a-w C:\WINDOWS\system32\dllcache\mstime.dll 2008-06-23 16:12 474,112 ------w C:\WINDOWS\system32\dllcache\shlwapi.dll 2008-06-23 16:12 449,024 ------w C:\WINDOWS\system32\dllcache\mshtmled.dll 2008-06-23 16:12 39,424 ------w C:\WINDOWS\system32\dllcache\pngfilt.dll 2008-06-23 16:12 146,432 ------w C:\WINDOWS\system32\dllcache\msrating.dll 2008-06-23 16:12 1,499,136 ------w C:\WINDOWS\system32\dllcache\shdocvw.dll 2008-06-23 16:11 96,256 ----a-w C:\WINDOWS\system32\dllcache\inseng.dll 2008-06-23 16:11 55,808 ------w C:\WINDOWS\system32\dllcache\extmgr.dll 2008-06-23 16:11 357,888 ------w C:\WINDOWS\system32\dllcache\dxtmsft.dll 2008-06-23 16:11 3,067,392 ------w C:\WINDOWS\system32\dllcache\mshtml.dll 2008-06-23 16:11 251,904 ------w C:\WINDOWS\system32\dllcache\iepeers.dll 2008-06-23 16:11 205,312 ------w C:\WINDOWS\system32\dllcache\dxtrans.dll 2008-06-23 16:11 16,384 ----a-w C:\WINDOWS\system32\dllcache\jsproxy.dll 2008-06-23 16:11 151,040 ------w C:\WINDOWS\system32\dllcache\cdfview.dll 2008-06-23 16:11 1,054,208 ----a-w C:\WINDOWS\system32\dllcache\danim.dll 2008-06-23 16:11 1,024,000 ------w C:\WINDOWS\system32\dllcache\browseui.dll 2008-06-23 09:53 18,432 ------w C:\WINDOWS\system32\dllcache\iedw.exe 2008-06-20 17:41 245,248 ----a-w C:\WINDOWS\system32\mswsock.dll 2008-06-20 17:41 245,248 ------w C:\WINDOWS\system32\dllcache\mswsock.dll 2008-06-20 17:41 148,992 ----a-w C:\WINDOWS\system32\dllcache\dnsapi.dll 2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\dllcache\tcpip.sys 2008-06-20 10:44 138,368 ------w C:\WINDOWS\system32\dllcache\afd.sys 2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\dllcache\tcpip6.sys 2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\dllcache\bthport.sys 2007-08-05 21:44 56 -csh--r C:\WINDOWS\system32\0618BB27E3.sys 2007-07-21 13:50 88 -csh--r C:\WINDOWS\system32\E327BB1806.sys 2007-08-05 21:44 6,528 -csha-w C:\WINDOWS\system32\KGyGaAvL.sys . ((((((((((((((((((((((((((((( snapshot@2008-08-21_ 5.11.07.17 ))))))))))))))))))))))))))))))))))))))))) . + 2005-10-20 16:02:28 163,328 ----a-w C:\WINDOWS\erdnt\8-21-2008\ERDNT.EXE + 2008-08-21 22:09:51 7,704,576 ----a-w C:\WINDOWS\erdnt\8-21-2008\Users\00000001\NTUSER.DAT + 2008-08-21 22:09:51 196,608 ----a-w C:\WINDOWS\erdnt\8-21-2008\Users\00000002\UsrClass.dat + 2005-10-20 16:02:28 163,328 ----a-w C:\WINDOWS\erdnt\8-22-2008\ERDNT.EXE + 2008-08-22 04:14:23 7,704,576 ----a-w C:\WINDOWS\erdnt\8-22-2008\Users\00000001\NTUSER.DAT + 2008-08-22 04:14:23 196,608 ----a-w C:\WINDOWS\erdnt\8-22-2008\Users\00000002\UsrClass.dat + 2005-10-20 16:02:28 163,328 ----a-w C:\WINDOWS\erdnt\AutoBackup\8-21-2008\ERDNT.EXE + 2008-08-22 03:40:13 7,704,576 ----a-w C:\WINDOWS\erdnt\AutoBackup\8-21-2008\Users\00000001\NTUSER.DAT + 2008-08-22 03:40:13 196,608 ----a-w C:\WINDOWS\erdnt\AutoBackup\8-21-2008\Users\00000002\UsrClass.dat + 2005-10-20 16:02:28 163,328 ----a-w C:\WINDOWS\erdnt\AutoBackup\8-24-2008\ERDNT.EXE + 2008-08-24 15:39:38 7,704,576 ----a-w C:\WINDOWS\erdnt\AutoBackup\8-24-2008\Users\00000001\NTUSER.DAT + 2008-08-24 15:39:38 196,608 ----a-w C:\WINDOWS\erdnt\AutoBackup\8-24-2008\Users\00000002\UsrClass.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00 15360] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-14 21:49 94208] "igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-14 21:46 77824] "igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-10-14 21:50 114688] "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-11-29 05:56 761947] "dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-12-06 02:05 127035] "DLCGCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCGtime.dll" [2005-09-08 14:56 73728] "AVG8_TRAY"="C:\PROGRA~1\AVG\AVG8\avgtray.exe" [2008-08-18 16:30 1232152] "Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [2005-12-19 16:08 1347584] "e4e0ab4f"="C:\WINDOWS\system32\mjggvhwg.dll" [BU] "MSConfig"="C:\WINDOWS\pchealth\helpctr\Binaries\MSCONFIG.EXE" [2005-09-26 20:34 169984] "SigmatelSysTrayApp"="stsystra.exe" [2005-09-10 00:19 393216 C:\WINDOWS\stsystra.exe] C:\Documents and Settings\Hali\Start Menu\Programs\Startup\ ERUNT AutoBackup.lnk - C:\Program Files\ERUNT\AUTOBACK.EXE [2005-10-20 12:04:08 38912] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "AppInit_DLLs"=avgrsstx.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32] "vidc.I420"= i420vfw.dll "vidc.yv12"= yv12vfw.dll [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Works Calendar Reminders.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Works Calendar Reminders.lnk backup=C:\WINDOWS\pss\Microsoft Works Calendar Reminders.lnkCommon Startup [HKLM\~\startupfolder\C:^Documents and Settings^Hali^Start Menu^Programs^Startup^LimeWire On Startup.lnk] path=C:\Documents and Settings\Hali\Start Menu\Programs\Startup\LimeWire On Startup.lnk backup=C:\WINDOWS\pss\LimeWire On Startup.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ShowLOMControl] [X] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI] --a------ 2005-12-19 16:08 1347584 C:\WINDOWS\system32\WLTRAY.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dlcgmon.exe] --a------ 2005-10-21 11:42 425984 C:\Program Files\Dell AIO 810\DLCGmon.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DVDLauncher] --------- 2005-12-09 20:29 49152 C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\E6TaskPanel] --a------ 2003-12-08 15:51 733184 C:\Program Files\EarthLink TotalAccess\TaskPanl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] --a------ 2005-06-10 11:44 249856 C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] --a------ 2005-06-10 11:44 81920 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] --a------ 2007-11-15 14:11 267048 C:\Program Files\iTunes\iTunesHelper.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Microsoft Works Update Detection] --a------ 2001-08-16 23:41 28738 C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] --a------ 2004-10-13 12:24 1694208 C:\Program Files\Messenger\msmsgs.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] --a------ 2007-11-15 00:43 286720 C:\Program Files\QuickTime\QTTask.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpybotSD TeaTimer] -rahs---- 2008-07-07 09:42 2156368 C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] --a------ 2008-06-10 04:27 144784 C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "AVGEMS"=2 (0x2) "WinDefend"=2 (0x2) "WMPNetworkSvc"=3 (0x3) "usnjsvc"=3 (0x3) "ose"=3 (0x3) "iPod Service"=3 (0x3) "Apple Mobile Device"=2 (0x2) [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\McAfeeFirewall] "DisableMonitoring"=dword:00000001 [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "C:\\Program Files\\EarthLink TotalAccess\\TaskPanl.exe"= "C:\\Program Files\\Messenger\\msmsgs.exe"= "C:\\Program Files\\LimeWire\\LimeWire.exe"= "C:\\Program Files\\iTunes\\iTunes.exe"= "C:\\Program Files\\AVG\\AVG8\\avgemc.exe"= "C:\\Program Files\\AVG\\AVG8\\avgupd.exe"= R1 AvgLdx86;AVG Free AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-08-18 16:31] R2 avg8emc;AVG Free8 E-mail Scanner;C:\PROGRA~1\AVG\AVG8\avgemc.exe [2008-08-18 16:30] R2 avg8wd;AVG Free8 WatchDog;C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe [2008-08-18 16:30] R2 AvgTdiX;AVG Free8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-08-18 16:31] *Newly Created Service* - CATCHME . Contents of the 'Scheduled Tasks' folder 2008-02-27 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 15:57] . . ------- Supplementary Scan ------- . R0 -: HKCU-Main,Start Page = hxxp://www.webmail.vt.edu/ O8 -: &Google Search - C:\Program Files\Google\GoogleToolbar1.dll/cmsearch.html O8 -: &Translate English Word - C:\Program Files\Google\GoogleToolbar1.dll/cmwordtrans.html O8 -: Backward Links - C:\Program Files\Google\GoogleToolba |