103 replies to this topic

[matt b]

»»»»»»»»»»»»»»»»»»***LOG!***»»»»»»»»»»»»»»»» HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\snpstd SZ C:\\WINDOWS\\vsnpstd.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\nwiz SZ nwiz.exe /install HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvMediaCenter SZ RUNDLL32.EXE C:\\WINDOWS\\system32\\NvMcTray.dll,NvTaskbarInit HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\%FP%Friendly fts.exe SZ "C:\\Program Files\\VoyagerTest\\fts.exe" HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SunJavaUpdateSched SZ C:\\Program Files\\Java\\jre1.5.0_02\\bin\\jusched.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Zone Labs Client SZ C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DSLSTATEXE SZ C:\\Program Files\\BT Voyager 105 ADSL Modem\\dslstat.exe icon HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\DSLAGENTEXE SZ C:\\Program Files\\BT Voyager 105 ADSL Modem\\dslagent.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\NvCplDaemon SZ RUNDLL32.EXE C:\\WINDOWS\\system32\\NvCpl.dll,NvStartup HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\avast! SZ C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\ NONE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL\Installed SZ 1 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI\NoChange SZ 1 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI\Installed SZ 1 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS\Installed SZ 1 HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\MsnMsgr SZ "C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe" /background HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\CTFMON.EXE SZ C:\\WINDOWS\\system32\\ctfmon.exe HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\AWMON SZ "C:\\Program Files\\Lavasoft\\Ad-Aware SE Professional\\Ad-Watch.exe" HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServices\ NONE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunServices\ NONE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\ NONE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnceEx\ NONE HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce\ NONE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce\ NONE HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunServicesOnce\ NONE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\ NONE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Desktop Search.lnk\location SZ Common Startup HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Desktop Search.lnk\command SZ C:\\PROGRA~1\\MSNTOO~1\\DS\\020500~1.108\\en-us\\bin\\WINDOW~3.EXE /startup HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Windows Desktop Search.lnk\item SZ Windows Desktop Search HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\ NONE HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Boots Insert Detect\key SZ SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Boots Insert Detect\item SZ InsDetect HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Boots Insert Detect\hkey SZ HKCU HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Boots Insert Detect\inimapping SZ 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\CTFMON.EXE\key SZ SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\CTFMON.EXE\item SZ ctfmon HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\CTFMON.EXE\hkey SZ HKCU HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\CTFMON.EXE\command SZ C:\\WINDOWS\\system32\\ctfmon.exe HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\CTFMON.EXE\inimapping SZ 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\MSMSGS\key SZ SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\MSMSGS\item SZ msmsgs HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\MSMSGS\hkey SZ HKCU HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\MSMSGS\command SZ "C:\\Program Files\\Messenger\\msmsgs.exe" /background HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\MSMSGS\inimapping SZ 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Soltek\key SZ SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Soltek\item SZ autorun HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Soltek\hkey SZ HKLM HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\startupreg\Soltek\inimapping SZ 0 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Shared Tools\MSConfig\services\svcWRSSSDK DWORD 00000002 HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run-\QuickTime Task SZ "C:\\Program Files\\QuickTime\\qttask.exe" -atboottime HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run-\CTFMON.EXE SZ C:\\WINDOWS\\system32\\ctfmon.exe

[LDTate]

This is the only one that looks weird to me.

Can you locate this one and find the spelling of the file name?
C:\\PROGRA~1\\MSNTOO~1\\DS\\020500~1.108\\en-us\\bin\\WINDOW~3.EXE /startup

c:\program files\msn

Also see if you have a folder called ‘mc’ in the Windows folder.

[matt b]

Sorry for being stoopid but im not quite sure what to do

[LDTate]

Don't worry about it, I think that's just msn toolbar anyway.

See if you have a folder called ‘mc’ in the Windows folder.

[matt b]

how do i search for that?

[LDTate]

click Start button> Search> All files and folders> type in MC tap enter

[matt b]

Oh good good, ive just done that and there's loads with the letters in but not one file with that name. It lets me copy the results but wont let me paste them into this thread?

[LDTate]

We were looking for a Folder named MC. I'm still looking for a fix.

[LDTate]

Lets try this:


Click HERE to download DllCompare. Start the Program with and click the Run Locate.com - be sure the \Windows\System32 directory is in the box and wait until the the blue text says it has 'completed the scan'.

Click the Compare button to start the next process. The results appear in two panes - files in the upper pane have been verified to 'exist', files in the lower pane were 'not able to be accessed'. Very few files should be listed in the lower pane when the Compare scan is complete. Click on each of the listed entries in the lower pane to select them. Right-click on the file and use the option Rescan. This will cause Windows Find to see if the file does exist, and then if so it will be removed from the list to reduce the number of identified files.

Click the Make a Log of what was found button and post the log here in this thread and wait for further instructions.

[matt b]

it found 1 item in lower pane. this is the result. * DLLCompare Log version(1.0.0.127) Files Found that Windows does not See or cannot Access *Not everything listed here means you are infected! ________________________________________________ C:\WINDOWS\SYSTEM32\vb6stkit.dll Fri 26 Mar 1999 0:00:00 A.S.. 101,888 99.50 K ________________________________________________ 1,334 items found: 1,334 files (1 H/S), 0 directories. Total of file sizes: 287,049,312 bytes 273.75 M Administrator Account = True --------------------End log---------------------

[LDTate]

Launch Notepad (not wordpad), and copy and paste the BOLD below into a new text file.
Save it as file name: "fixme.reg" (not including the quotes). Save as file type: All files (*.*) and save it on your Desktop.

REGEDIT4

[-HKEY_USERS\S-1-5-21-2052111302-1757981266-725345543-1003\Software\LanConfig]
[-HKEY_USERS\S-1-5-21-2052111302-1757981266-725345543-1003\Software\mc\SA]

Now double-click on the fixme.reg file you saved and click on the Yes button when it asks if you would like to merge the information. Once you get a successful message delete fixme.reg.

[matt b]

done that.

[LDTate]

That should have killed it if it worked. Can you test to see if it's gone?

[matt b]

Yeah sure. How do you want me to test?

[LDTate]

Doesn't Spybot pick it up?