Spyware / Malware / Virus Removal
Can't Make Sense Of This!
12 min read
ironboot
Topic Starter
Hello TC. Of course this post has to do with spyware/adware and the like. Hopefully, though, I will be easy to help.
I have spent considerable time cleaning my work computer (as well as others in my network) from all sorts of bugs, and I believe I have been highly successful. I have stayed extremely diligent and payed close attention to forums such as this.
I wanted to see if I could give you a list of the few data miners that Ad-aware finds AND the (very short) log from hijackthis.
Thank you in advance for your help. - Ironboot
ironboot
Here are the bugs found by Ad-aware:
2o7
bluestreak
cgi-bin
citi-bridgetrack
edge.ru4
fastclick
questionmarket
z1.adserver
Spybot also located fastclick after I deleted it.
Here is my hijackthis log:
Logfile of HijackThis v1.98.2
Scan saved at 10:21:27 AM, on 11/23/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\mgabg.exe
C:\OfficeScan NT\ntrtscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\OfficeScan NT\tmlisten.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\OfficeScan NT\pccntmon.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINNT\system32\PDesk\PDesk.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\InterMute\SpySubtract\SpySub.exe
C:\WINNT\system32\wuauclt.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Jim.CARPET\Local Settings\Temp\HijackThis.exe
R3 - URLSearchHook: (no name) - {20EC3D2D-33C1-4C9D-BC37-C2D500688DA2} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {1EA81450-C518-20C7-8076-64557BAE263B} - C:\WINNT\System32\mlvydbw.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\OfficeScan NT\pccntmon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINNT\system32\PDesk\PDesk.exe /Autolaunch
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O16 - DPF: {10003000-1000-0000-1000-000000000000} - ms-its:mhtml:file://C:\foo.mht!http://195.225.177.13/20609/online.chm::/on-line.exe
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200305…meInstaller.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{D1E3E61D-D493-45D2-94C7-1F13DF184EB7}: NameServer = 166.102.165.11,166.102.165.13
2o7
bluestreak
cgi-bin
citi-bridgetrack
edge.ru4
fastclick
questionmarket
z1.adserver
Spybot also located fastclick after I deleted it.
Here is my hijackthis log:
Logfile of HijackThis v1.98.2
Scan saved at 10:21:27 AM, on 11/23/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\mgabg.exe
C:\OfficeScan NT\ntrtscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\OfficeScan NT\tmlisten.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\OfficeScan NT\pccntmon.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINNT\system32\PDesk\PDesk.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\InterMute\SpySubtract\SpySub.exe
C:\WINNT\system32\wuauclt.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Jim.CARPET\Local Settings\Temp\HijackThis.exe
R3 - URLSearchHook: (no name) - {20EC3D2D-33C1-4C9D-BC37-C2D500688DA2} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {1EA81450-C518-20C7-8076-64557BAE263B} - C:\WINNT\System32\mlvydbw.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\OfficeScan NT\pccntmon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINNT\system32\PDesk\PDesk.exe /Autolaunch
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O16 - DPF: {10003000-1000-0000-1000-000000000000} - ms-its:mhtml:file://C:\foo.mht!http://195.225.177.13/20609/online.chm::/on-line.exe
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200305…meInstaller.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{D1E3E61D-D493-45D2-94C7-1F13DF184EB7}: NameServer = 166.102.165.11,166.102.165.13
ironboot
Here is my hijackthis log:
Logfile of HijackThis v1.98.2
Scan saved at 10:21:27 AM, on 11/23/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\mgabg.exe
C:\OfficeScan NT\ntrtscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\OfficeScan NT\tmlisten.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\OfficeScan NT\pccntmon.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINNT\system32\PDesk\PDesk.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\InterMute\SpySubtract\SpySub.exe
C:\WINNT\system32\wuauclt.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Jim.CARPET\Local Settings\Temp\HijackThis.exe
R3 - URLSearchHook: (no name) - {20EC3D2D-33C1-4C9D-BC37-C2D500688DA2} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {1EA81450-C518-20C7-8076-64557BAE263B} - C:\WINNT\System32\mlvydbw.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\OfficeScan NT\pccntmon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINNT\system32\PDesk\PDesk.exe /Autolaunch
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O16 - DPF: {10003000-1000-0000-1000-000000000000} - ms-its:mhtml:file://C:\foo.mht!http://195.225.177.13/20609/online.chm::/on-line.exe
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200305…meInstaller.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{D1E3E61D-D493-45D2-94C7-1F13DF184EB7}: NameServer = 166.102.165.11,166.102.165.13
Logfile of HijackThis v1.98.2
Scan saved at 10:21:27 AM, on 11/23/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\mgabg.exe
C:\OfficeScan NT\ntrtscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\OfficeScan NT\tmlisten.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\OfficeScan NT\pccntmon.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINNT\system32\PDesk\PDesk.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\InterMute\SpySubtract\SpySub.exe
C:\WINNT\system32\wuauclt.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Jim.CARPET\Local Settings\Temp\HijackThis.exe
R3 - URLSearchHook: (no name) - {20EC3D2D-33C1-4C9D-BC37-C2D500688DA2} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {1EA81450-C518-20C7-8076-64557BAE263B} - C:\WINNT\System32\mlvydbw.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no file)
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\OfficeScan NT\pccntmon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINNT\system32\PDesk\PDesk.exe /Autolaunch
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O16 - DPF: {10003000-1000-0000-1000-000000000000} - ms-its:mhtml:file://C:\foo.mht!http://195.225.177.13/20609/online.chm::/on-line.exe
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200305…meInstaller.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{D1E3E61D-D493-45D2-94C7-1F13DF184EB7}: NameServer = 166.102.165.11,166.102.165.13
DumbTerminal
First, you need to put Hijack this in its own folder BEFORE you do anything else, because we are going to empty that temp folder.
Right click on your desktop, click "New" > "folder" and name it HJT.
Put HijackThis.exe in there
Is this a work computer? Don't you have an I.T. department?
Oh well…
Run HJT again, from it's NEW location
Place a check next to these entries, if they still exist:
3 - URLSearchHook: (no name) - {20EC3D2D-33C1-4C9D-BC37-C2D500688DA2} - (no file)
O2 - BHO: (no name) - {1EA81450-C518-20C7-8076-64557BAE263B} - C:\WINNT\System32\mlvydbw.dll
O16 - DPF: {10003000-1000-0000-1000-000000000000} - ms-its:mhtml:file://C:\foo.mht!http://195.225.177.13/20609/online.chm::/on-line.exe <= this is the nasty one!!
Close ALL windows and click on "Fix Checked"
Show hidden files and folders
Make sure you UNCHECKED Hide file extensions for known file types.
It is very important that you clean the following directory contents (but NOT the directory folder): To do this, navigate to the folder listed below (example: C:\Windows\Temp\)
Then go to "Edit" - "Select All"- then click on the red "X" on the toolbar to delete the contents.
* C:\Windows\Temp\
* C:\Documents and Settings\\Local Settings\Temporary Internet Files\ <=This will delete all your cached internet content including cookies. This is recommended and strongly suggested.
* C:\Documents and Settings\\Local Settings\Temp\
* C:\Documents and Settings\\Local Settings\Temporary Internet Files\
* C:\Documents and Settings\\Local Settings\Temp\
* Empty your "Recycle Bin".
It is normal for some files to not delete. If you have alot of these that wont delete, reboot into safe mode and try again.
Reboot
Download, UPDATE and run Spybot search and destroy.
Spybot
Reboot
Then download, UPDATE and run Lavasoft Ad-Aware. Choose to check for updates and then
run the scan and choose to fix whatever it finds. (Put checks in the boxes).
Adaware
Reboot, and post another log please
Right click on your desktop, click "New" > "folder" and name it HJT.
Put HijackThis.exe in there
Is this a work computer? Don't you have an I.T. department?
Oh well…
Run HJT again, from it's NEW location
Place a check next to these entries, if they still exist:
3 - URLSearchHook: (no name) - {20EC3D2D-33C1-4C9D-BC37-C2D500688DA2} - (no file)
O2 - BHO: (no name) - {1EA81450-C518-20C7-8076-64557BAE263B} - C:\WINNT\System32\mlvydbw.dll
O16 - DPF: {10003000-1000-0000-1000-000000000000} - ms-its:mhtml:file://C:\foo.mht!http://195.225.177.13/20609/online.chm::/on-line.exe <= this is the nasty one!!
Close ALL windows and click on "Fix Checked"
Show hidden files and folders
Make sure you UNCHECKED Hide file extensions for known file types.
It is very important that you clean the following directory contents (but NOT the directory folder): To do this, navigate to the folder listed below (example: C:\Windows\Temp\)
Then go to "Edit" - "Select All"- then click on the red "X" on the toolbar to delete the contents.
* C:\Windows\Temp\
* C:\Documents and Settings\\Local Settings\Temporary Internet Files\ <=This will delete all your cached internet content including cookies. This is recommended and strongly suggested.
* C:\Documents and Settings\\Local Settings\Temp\
* C:\Documents and Settings\\Local Settings\Temporary Internet Files\
* C:\Documents and Settings\\Local Settings\Temp\
* Empty your "Recycle Bin".
It is normal for some files to not delete. If you have alot of these that wont delete, reboot into safe mode and try again.
Reboot
Download, UPDATE and run Spybot search and destroy.
Spybot
Reboot
Then download, UPDATE and run Lavasoft Ad-Aware. Choose to check for updates and then
run the scan and choose to fix whatever it finds. (Put checks in the boxes).
Adaware
Reboot, and post another log please
ironboot
First off, thank you for coming to my aid.
To answer a question - yes it is a work computer - and there are more to fix where this comes from. Some of my (now fired) sales people were email nudy sites to each other. IT department? Nope. We're too small and the boss is too cheap. I am the closest thing we have and I am just the sales manager.
Anyway, lemme see if I can update you on what I have done.
I created the new folder and deleted the 3 strings you directed me to in HJT.
I couldn't find c:\windows\temp\ but I did a search for 'temp' and deleted the contents for those.
I deleted the contents of the files under my user name you suggested.
BUT I chickened out of doing the same for other user names….. AND I chickened out of cleaning the recycle bin. Some things looked too important to delete just yet. I want to make sure everything runs fine for a day or too. I hope this doesn't ruin things. If so sorry.
I updated both Spybot and Ad-aware and ran them - both turned up clean. I stay on top of that pretty well.
Here is the log file:
Logfile of HijackThis v1.98.2
Scan saved at 6:38:19 PM, on 11/23/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\mgabg.exe
C:\OfficeScan NT\ntrtscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\OfficeScan NT\tmlisten.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\OfficeScan NT\pccntmon.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINNT\system32\PDesk\PDesk.exe
C:\PROGRA~1\PESTPA~1\PPControl.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\InterMute\SpySubtract\SpySub.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINNT\system32\wuauclt.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Jim.CARPET\Local Settings\Temp\HijackThis.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\OfficeScan NT\pccntmon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINNT\system32\PDesk\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200305…meInstaller.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D1E3E61D-D493-45D2-94C7-1F13DF184EB7}: NameServer = 166.102.165.11,166.102.165.13
To answer a question - yes it is a work computer - and there are more to fix where this comes from. Some of my (now fired) sales people were email nudy sites to each other. IT department? Nope. We're too small and the boss is too cheap. I am the closest thing we have and I am just the sales manager.
Anyway, lemme see if I can update you on what I have done.
I created the new folder and deleted the 3 strings you directed me to in HJT.
I couldn't find c:\windows\temp\ but I did a search for 'temp' and deleted the contents for those.
I deleted the contents of the files under my user name you suggested.
BUT I chickened out of doing the same for other user names….. AND I chickened out of cleaning the recycle bin. Some things looked too important to delete just yet. I want to make sure everything runs fine for a day or too. I hope this doesn't ruin things. If so sorry.
I updated both Spybot and Ad-aware and ran them - both turned up clean. I stay on top of that pretty well.
Here is the log file:
Logfile of HijackThis v1.98.2
Scan saved at 6:38:19 PM, on 11/23/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\mgabg.exe
C:\OfficeScan NT\ntrtscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\OfficeScan NT\tmlisten.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\OfficeScan NT\pccntmon.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINNT\system32\PDesk\PDesk.exe
C:\PROGRA~1\PESTPA~1\PPControl.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\InterMute\SpySubtract\SpySub.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINNT\system32\wuauclt.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Jim.CARPET\Local Settings\Temp\HijackThis.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\OfficeScan NT\pccntmon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINNT\system32\PDesk\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200305…meInstaller.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D1E3E61D-D493-45D2-94C7-1F13DF184EB7}: NameServer = 166.102.165.11,166.102.165.13
DumbTerminal
BUT I chickened out of doing the same for other user names….. AND I chickened out of cleaning the recycle bin. Some things looked too important to delete just yet. I want to make sure everything runs fine for a day or too. I hope this doesn't ruin things. If so sorry.
Not a problem and very understandable. And speaking of this, you really DO need to move HJT into its own folder. This is because it will make backups of what you delete. That way, if something goes wrong, you can put them back. This doesn't work if you have it in a temp folder like you do now
Your log looks clean, good job. What kinds of problems were you having that made you decide to post a log?
You did have a p0rn dialer in that last log, so my guess would be embarrassing pop ups.
If there are other users on that same machine, you can log in under them and run Adaware and Spybot and it will find some things it didnt find on your login. At least thats how it works with a local machine on a workgroup, I'm not sure how that works on a domain.
Are you in St Louis by any chance??IT department? Nope. We're too small and the boss is too cheap. I am the closest thing we have and I am just the sales manager.
Just kiddin!
Bring em ON!!To answer a question - yes it is a work computer - and there are more to fix where this comes from.
Here are some things I want you to do on those machines first, before posting HJT logs. And if you do post logs, briefly outline what you have tried in your post, that will help us help you.
Download Stinger
This is best run in safe mode
Download CWShredder
Run this, and click on "Fix"
Download Adaware and
Spybot
Here is how to use them.
SPYBOT AND ADAWARE SETUP
Download and install Spybot S&D and Adaware SE.
1. Downloaded and Install Spybot S&D, accepting the Default
Settings
2. In the Menu Bar at the top of the Spybot window you will see
'Mode'. Make certain that 'default mode' has a check mark
beside it.
3. Close ALL windows except Spybot S&D
4. Click the button to ‘Search for Updates’ then download and
install the Updates.
5. Next click the button ‘Check for Problems’
6. When Spybot is complete, it will be showing ‘RED’ entries
bold 'Black' entries and ‘GREEN’ entries in the window
7. Make certain there is a check mark beside all of the RED
entries ONLY.
8. Choose ‘Fix Selected Problems’ and allow Spybot to fix the
RED entries.
9.REBOOT to complete the scan and clear memory.
10. Do not enable Tea Timer until the log is clean as it will
prevent the fix from working.
Scanning With Ad-Aware SE :
1. Download and Install Ad-Aware SE, keeping the default
options. However, some of the settings will need to be changed
before your first scan
2.Close ALL windows except Ad-Aware SE
3. Click on the‘world’ icon at the top right of the Ad-Aware SE
window and let AdAware SE update the reference list for the
adware and malware.
4. Once the update is finished click on the ‘Gear’ icon (second
from the left at the top of the window) to access the
preferences/settings window
1) In the ‘General’ window make sure the following are selected
in green:
*Automatically save log-file
*Automatically quarantine objects prior to removal
*Safe Mode (always request confirmation)
Under Definitions:
*Prompt to udate outdated definitions - set the number of days
2) Click on the ‘Scanning’ button on the left and select in
green :
Under Driver, Folders & Files:
*Scan Within Archives
Under Select drives & folders to scan -
*choose all hard drives
Under Memory & Registry: all green
*Scan Active Processes
*Scan Registry
*Deep Scan Registry
*Scan my IE favorites for banned URL’s
*Scan my Hosts file
3) Click on the ‘Advanced’ button on the left and select in
green:
Under Shell Integration:
*Move deleted files to recycle bin
Under Logfile Detail Level: (all green)
*include addtional object information
*DESELECT - include negligible objects information
*include environment information
Under Alternate Data Streams:
*Don't log streams smaller than 0 bytes
*Don't log ADS with the following names: CA_INOCULATEIT
4) Click the ‘Tweak’ button and select in green:
Under the ‘Scanning Engine’:
*Unload recognized processes during scanning
*Scan registry for all users instead of current user only
Under the ‘Cleaning Engine’:
*Let Windows remove files in use at next reboot
Under the Log Files:
*Include basic Ad-aware SE settings in logfile
*Include additional Ad-aware SE settings in logfile
*Please do not check or make green: Include Module list in
logfile
5. Click on ‘Proceed’ to save the settings.
6. Click ‘Start’
*Choose:'Perform Full System Scan'
*DESELECT "Search for negligible risk entries", as negligible
risk entries (MRU's) are not considered to be a threat.
7. Click ‘Next’ and Ad-Aware SE will scan your hard drive(s)
with the options you have selected and clean automatically.
8. If Ad-Aware SE finds bad entries, you will receive a list of
what it found in the window
9. Save the log file when it asks and then click ‘finish’
10. REBOOT to complete the removal of what Ad-Aware SE found
ironboot
I discovered this like anybody else - pop-ups and lots of them. By the time I started taking action - 5 seconds on the internet was worth about 20 surprising new was to meet woman, make money and keep a longer-firmer…. well, you can guess the rest.
Oh yeah, that and the rearing of the ugly head known as 'about:blank'.
I actually had to prop open a 'back door' to the internet via a hotel directory so that I could download Ad-aware about 2 months ago. Since than I have become quite familier with that and Spybot and CW Shredder and Stinger and others. I promise you, though, I will read all of the instructions you have supplied - just in case there is more to learn.
As far as HJT - I did open up a new folder - maybe I accidentally put the shortcut in it. Maybe I accidentally used the one from 'The Doctor' - my universal fix folder on the computers I have been working with. Either way I'll dump it and download a new one.
As far as my network (and the other infected computers) there are two other computers in my office. Both infected - both worse than mine ever was. It took about a week, but I got the pop-ups to stop - to a very, very bearable level. To add to this, there are four other computers in the office. I saw 'about:blank' on my boss' wifes computer - when I told her that was something she should let me take care of - SHE told ME that it wasn't a problem - it had been that way for sometime - and that it wasn't hurting anything.
Stupid. Stupid.
Anyway, this whole diatribe is my own little way of saying that I am home and cannot do anything until tomorrow. I thank you for your help and, by all means, your enthusiasm. I know I'll get everything fixed and the idiots will just screw it up again, but I imagine I am taking on this task because ultimately I enjoy it - certainly not because they are paying me - they ain't.
DumbTerminal
Well…good luck to you. The uninformed always seem to be the most freaked out about receiving help when the computer is concerned.
Here is a tutorial on how to use Adaware and Spybot
Its a little more simplistic than I like to use them, but it has pictures and it is good for teaching people who are not so computer savvy.
Here are some programs that you can use that help prevent infections from happening in the first place.
SpyawareBlaster
This program is not a scanner. It sets killbits that help prevent certain spyware from being installed in the first place. After you install it, check for updates about once a week or so, then after an update is installed, you then need to click on "enable all protection". Thats it…
IESPYAD2
(I always used IESPYAD, I didnt know about IESPYAD2 til just now)
The difference is the regular version only installs on the user who is logged in, IESPYAD2 installs globally on the entire machine. I used to just log in to all users and install on each one. See…I learned something from YOU!
There are some things you might want to read up on when using this. You can read HERE
I personally find that site informative, but a little hard to follow.
Here is another "pictutorial(I made that word up! heeee) for using IESPYAD
It was posted by our very good pal nellie. You'll have to scroll down a bit to see it.
Here is a tutorial on how to use Adaware and Spybot
Its a little more simplistic than I like to use them, but it has pictures and it is good for teaching people who are not so computer savvy.
Here are some programs that you can use that help prevent infections from happening in the first place.
SpyawareBlaster
This program is not a scanner. It sets killbits that help prevent certain spyware from being installed in the first place. After you install it, check for updates about once a week or so, then after an update is installed, you then need to click on "enable all protection". Thats it…
IESPYAD2
(I always used IESPYAD, I didnt know about IESPYAD2 til just now)
The difference is the regular version only installs on the user who is logged in, IESPYAD2 installs globally on the entire machine. I used to just log in to all users and install on each one. See…I learned something from YOU!
There are some things you might want to read up on when using this. You can read HERE
I personally find that site informative, but a little hard to follow.
Here is another "pictutorial(I made that word up! heeee) for using IESPYAD
It was posted by our very good pal nellie. You'll have to scroll down a bit to see it.
ironboot
Just for the record, this computer we have been (and I am presently) working on will be referred to as Comp A. The next will be Comp B, and so forth. Tough system, I know, but it will help keep things straight for me.
I decided to go through all of your instruction again, on Comp A, just to make sure I have everything well practiced before I go and take on the tough ones. So here goes.
I deleted all files related to Hijack this – so I could start that from scratch. I downloaded a new copy from majorgeeks and put it into its own file – named HJT.
I did NOT do any sort of disk cleanup to begin – as I am still chicken to erase things out of my ‘Recycle Bin’. I will probably do that early next week – as well as run these tests again.
Ran Stinger (could NOT figure out how to update) – everything came up clean.
Rebooted
Ran CW Shredder (updated) - everything came up clean.
Rebooted
Ran Spybot (updated and configured) - everything came up clean.
Rebooted
Ran Ad-aware 6.0 (updated and mostly configured) – everything came up clean
Here are the few discrepancies for configuration:
- I am using 6.0 not SE
- Couldn’t locate the ‘Definitions’ preference – so no prompt to update outdates
- Under ‘Shell Integration’ – move deleted files to RB wouldn’t go green
- Could not find ‘include negligible objects info’ to DESELECT
- No ‘Log file’ preference and couldn’t click the three items
- THOUGH did find ‘Include basic Ad-aware…’ in ‘Scanning Engines’
Began the process to run HJT, but I decided to hit the config button first. That’s when I noticed the ‘Default Start Page’ setting was set to….. about:blank.
Is that correct? Red flags flew at that one. Please advise before I continue.
I decided to go through all of your instruction again, on Comp A, just to make sure I have everything well practiced before I go and take on the tough ones. So here goes.
I deleted all files related to Hijack this – so I could start that from scratch. I downloaded a new copy from majorgeeks and put it into its own file – named HJT.
I did NOT do any sort of disk cleanup to begin – as I am still chicken to erase things out of my ‘Recycle Bin’. I will probably do that early next week – as well as run these tests again.
Ran Stinger (could NOT figure out how to update) – everything came up clean.
Rebooted
Ran CW Shredder (updated) - everything came up clean.
Rebooted
Ran Spybot (updated and configured) - everything came up clean.
Rebooted
Ran Ad-aware 6.0 (updated and mostly configured) – everything came up clean
Here are the few discrepancies for configuration:
- I am using 6.0 not SE
- Couldn’t locate the ‘Definitions’ preference – so no prompt to update outdates
- Under ‘Shell Integration’ – move deleted files to RB wouldn’t go green
- Could not find ‘include negligible objects info’ to DESELECT
- No ‘Log file’ preference and couldn’t click the three items
- THOUGH did find ‘Include basic Ad-aware…’ in ‘Scanning Engines’
Began the process to run HJT, but I decided to hit the config button first. That’s when I noticed the ‘Default Start Page’ setting was set to….. about:blank.
Is that correct? Red flags flew at that one. Please advise before I continue.
DumbTerminal
The configuration issues are because you have Adaware 6, not the latest SE version. I would strongly suggest uninstalling 6 and upgrading to SE
Lavasoft will be stopping support(Updates included) for 6 sometime before the end of the year.
Hitting the "scan" button in HJT doesnt make any changes to your computer.
Its only when you check an entry and select fix checked that it alters your computer in any way.
If you are uncertain still about Computer A, go ahead and post another log from it
ironboot
Alright. Here is where I stand.
I snuffed out the old Ad-aware 6.0 and replaced it with SE. Felt very savy doing so too. Thanks.
Made all of the configurations you suggested, though there are some discrepancies again. Sorry.
- Under Definitions - I checked 'Prompt to update' and the set the days to 7
- Under Cleaning Engines:
- I checked 'Let Windows remove…'
- I left green the already checked options of:
- Always try to unload modules before deletion
- During removal, unload Explorer and IE if necessary
- Delete quarantined objects after restoring
- Under log files
- I checked the two selections you suggested
- I left green the already checked options of:
- Include reference summary in log file
- Include alternate data stream details in log file
- 'Include Module list in logfile' is deselected
I updated then ran the scan - 55 objects found - ouch!
It didn't prompt to save the logfile, but I think it did it automatically. I'll copy and paste that at the end.
I selected all and deleted. I will shut down and finish the deletion process after I post this message.
Here is the logfile from SE:
Ad-Aware SE Build 1.05
Logfile Created on:Wednesday, November 24, 2004 2:07:24 PM
Created with Ad-Aware SE Personal, free for private use.
Using definitions file:SE1R19 14.11.2004
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
References detected during the scan:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Alexa(TAC index:5):1 total references
begin2search(TAC index:3):18 total references
BookedSpace(TAC index:10):3 total references
istbar(TAC index:6):1 total references
Pribi.bho(TAC index:6):26 total references
Tracking Cookie(TAC index:3):1 total references
TVMedia(TAC index:5):1 total references
VX2(TAC index:10):4 total references
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Definition File:
=========================
Definitions File Loaded:
Reference Number : SE1R8 13.09.2004
Internal build : 12
File location : C:\PROGRA~1\Lavasoft\AD-AWA~1\defs.ref
File size : 344723 Bytes
Total size : 1092481 Bytes
Signature data size : 1068971 Bytes
Reference data size : 22998 Bytes
Signatures total : 30122
Fingerprints total : 154
Fingerprints size : 7129 Bytes
Target categories : 15
Target families : 560
11-24-2004 2:01:43 PM Performing WebUpdate…
Installing Update…
Definitions File Loaded:
Reference Number : SE1R19 14.11.2004
Internal build : 24
File location : C:\PROGRA~1\Lavasoft\AD-AWA~1\defs.ref
File size : 399688 Bytes
Total size : 1262753 Bytes
Signature data size : 1233509 Bytes
Reference data size : 28732 Bytes
Signatures total : 35069
Fingerprints total : 513
Fingerprints size : 19898 Bytes
Target categories : 15
Target families : 617
11-24-2004 2:01:53 PM Success
Update successfully downloaded and installed.
Memory + processor status:
==========================
Number of processors : 1
Processor architecture : Intel Pentium II
Memory available:12 %
Total physical memory:196148 kb
Available physical memory:23408 kb
Total page file size:471956 kb
Available on page file:299620 kb
Total virtual memory:2097024 kb
Available virtual memory:2044568 kb
OS:Microsoft Windows 2000 Professional Service Pack 4 (Build 2195)
Ad-Aware SE Settings
===========================
Set : Move deleted files to Recycle Bin
Set : Safe mode (always request confirmation)
Set : Don't log streams smaller than 0 Bytes
Set : Scan active processes
Set : Scan registry
Set : Deep-scan registry
Set : Scan my IE Favorites for banned URLs
Set : Scan within archives
Set : Scan my Hosts file
Extended Ad-Aware SE Settings
===========================
Set : Unload recognized processes & modules during scan
Set : Scan registry for all users instead of current user only
Set : Always try to unload modules before deletion
Set : During removal, unload Explorer and IE if necessary
Set : Let Windows remove files in use at next reboot
Set : Delete quarantined objects after restoring
Set : Include basic Ad-Aware settings in log file
Set : Include additional Ad-Aware settings in log file
Set : Include reference summary in log file
Set : Include alternate data stream details in log file
Set : Play sound at scan completion if scan locates critical objects
11-24-2004 2:07:24 PM - Scan started. (Smart mode)
Listing running processes
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
#:1 [smss.exe]
FilePath : \SystemRoot\System32\
ProcessID : 136
ThreadCreationTime : 11-24-2004 4:37:19 PM
BasePriority : Normal
#:2 [csrss.exe]
FilePath : \??\C:\WINNT\system32\
ProcessID : 164
ThreadCreationTime : 11-24-2004 4:37:32 PM
BasePriority : Normal
#:3 [winlogon.exe]
FilePath : \??\C:\WINNT\system32\
ProcessID : 160
ThreadCreationTime : 11-24-2004 4:37:34 PM
BasePriority : High
#:4 [services.exe]
FilePath : C:\WINNT\system32\
ProcessID : 212
ThreadCreationTime : 11-24-2004 4:37:37 PM
BasePriority : Normal
FileVersion : 5.00.2195.6700
ProductVersion : 5.00.2195.6700
ProductName : Microsoft® Windows ® 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : Services and Controller app
InternalName : services.exe
LegalCopyright : Copyright © Microsoft Corp. 1981-1999
OriginalFilename : services.exe
#:5 [lsass.exe]
FilePath : C:\WINNT\system32\
ProcessID : 224
ThreadCreationTime : 11-24-2004 4:37:37 PM
BasePriority : Normal
FileVersion : 5.00.2195.6902
ProductVersion : 5.00.2195.6902
ProductName : Microsoft® Windows ® 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : LSA Executable and Server DLL (Export Version)
InternalName : lsasrv.dll and lsass.exe
LegalCopyright : Copyright © Microsoft Corp. 1981-1999
OriginalFilename : lsasrv.dll and lsass.exe
#:6 [svchost.exe]
FilePath : C:\WINNT\system32\
ProcessID : 404
ThreadCreationTime : 11-24-2004 4:37:42 PM
BasePriority : Normal
FileVersion : 5.00.2134.1
ProductVersion : 5.00.2134.1
ProductName : Microsoft® Windows ® 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : Copyright © Microsoft Corp. 1981-1999
OriginalFilename : svchost.exe
#:7 [spoolsv.exe]
FilePath : C:\WINNT\system32\
ProcessID : 440
ThreadCreationTime : 11-24-2004 4:37:48 PM
BasePriority : Normal
FileVersion : 5.00.2195.6659
ProductVersion : 5.00.2195.6659
ProductName : Microsoft® Windows ® 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : Spooler SubSystem App
InternalName : spoolss.exe
LegalCopyright : Copyright © Microsoft Corp. 1981-1999
OriginalFilename : spoolss.exe
#:8 [svchost.exe]
FilePath : C:\WINNT\System32\
ProcessID : 528
ThreadCreationTime : 11-24-2004 4:37:56 PM
BasePriority : Normal
FileVersion : 5.00.2134.1
ProductVersion : 5.00.2134.1
ProductName : Microsoft® Windows ® 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : Copyright © Microsoft Corp. 1981-1999
OriginalFilename : svchost.exe
#:9 [mgabg.exe]
FilePath : C:\WINNT\system32\
ProcessID : 564
ThreadCreationTime : 11-24-2004 4:37:59 PM
BasePriority : Normal
FileVersion : 1.00.023
ProductVersion : 1.00.023
ProductName : Matrox Graphics Inc. MGABG
CompanyName : Matrox Graphics Inc.
FileDescription : MGABG
InternalName : MGABG
LegalCopyright : Copyright Matrox © 2001
OriginalFilename : MGABG.exe
#:10 [ntrtscan.exe]
FilePath : C:\OfficeScan NT\
ProcessID : 588
ThreadCreationTime : 11-24-2004 4:38:00 PM
BasePriority : Normal
FileVersion : 3.54.0.1654
ProductVersion : 3.54.0
ProductName : Trend Trend OfficeScan 3.54
CompanyName : Trend Micro Inc.
LegalCopyright : Copyright © 1998-2001 Trend Micro Inc. All rights reserved.
LegalTrademarks : Copyright © Trend Micro Inc.
#:11 [regsvc.exe]
FilePath : C:\WINNT\system32\
ProcessID : 668
ThreadCreationTime : 11-24-2004 4:38:01 PM
BasePriority : Normal
FileVersion : 5.00.2195.6701
ProductVersion : 5.00.2195.6701
ProductName : Microsoft® Windows ® 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : Remote Registry Service
InternalName : regsvc
LegalCopyright : Copyright © Microsoft Corp. 1981-1999
OriginalFilename : REGSVC.EXE
#:12 [mstask.exe]
FilePath : C:\WINNT\system32\
ProcessID : 684
ThreadCreationTime : 11-24-2004 4:38:02 PM
BasePriority : Normal
FileVersion : 4.71.2195.6920
ProductVersion : 4.71.2195.6920
ProductName : Microsoft® Windows® Task Scheduler
CompanyName : Microsoft Corporation
FileDescription : Task Scheduler Engine
InternalName : TaskScheduler
LegalCopyright : Copyright © Microsoft Corp. 1997
OriginalFilename : mstask.exe
#:13 [tmlisten.exe]
FilePath : C:\OfficeScan NT\
ProcessID : 712
ThreadCreationTime : 11-24-2004 4:38:03 PM
BasePriority : Normal
#:14 [winmgmt.exe]
FilePath : C:\WINNT\System32\WBEM\
ProcessID : 824
ThreadCreationTime : 11-24-2004 4:38:08 PM
BasePriority : Normal
FileVersion : 1.50.1085.0100
ProductVersion : 1.50.1085.0100
ProductName : Windows Management Instrumentation
CompanyName : Microsoft Corporation
FileDescription : Windows Management Instrumentation
InternalName : WINMGMT
LegalCopyright : Copyright © Microsoft Corp. 1995-1999
#:15 [mspmspsv.exe]
FilePath : C:\WINNT\System32\
ProcessID : 856
ThreadCreationTime : 11-24-2004 4:38:10 PM
BasePriority : Normal
FileVersion : 7.10.00.3068
ProductVersion : 7.10.00.3068
ProductName : Microsoft ® DRM
CompanyName : Microsoft Corporation
FileDescription : WMDM PMSP Service
InternalName : MSPMSPSV.EXE
LegalCopyright : Copyright © Microsoft Corp. 1981-2000
OriginalFilename : MSPMSPSV.EXE
#:16 [svchost.exe]
FilePath : C:\WINNT\system32\
ProcessID : 868
ThreadCreationTime : 11-24-2004 4:38:10 PM
BasePriority : Normal
FileVersion : 5.00.2134.1
ProductVersion : 5.00.2134.1
ProductName : Microsoft® Windows ® 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : Copyright © Microsoft Corp. 1981-1999
OriginalFilename : svchost.exe
#:17 [explorer.exe]
FilePath : C:\WINNT\
ProcessID : 780
ThreadCreationTime : 11-24-2004 5:03:30 PM
BasePriority : Normal
FileVersion : 5.00.3700.6690
ProductVersion : 5.00.3700.6690
ProductName : Microsoft® Windows ® 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : Windows Explorer
InternalName : explorer
LegalCopyright : Copyright © Microsoft Corp. 1981-1999
OriginalFilename : EXPLORER.EXE
#:18 [wuauclt.exe]
FilePath : C:\WINNT\system32\
ProcessID : 1012
ThreadCreationTime : 11-24-2004 5:03:44 PM
BasePriority : Normal
FileVersion : 5.4.3630.2554 built by: lab04_n
ProductVersion : 5.4.3630.2554
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Windows Update AutoUpdate Client
InternalName : wuauclt.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : wuauclt.exe
#:19 [pccntmon.exe]
FilePath : C:\OfficeScan NT\
ProcessID : 1128
ThreadCreationTime : 11-24-2004 5:03:45 PM
BasePriority : Normal
FileVersion : 3.54.0.1654
ProductVersion : 3.54.0
ProductName : Trend Trend OfficeScan 3.54
CompanyName : Trend Micro Inc.
FileDescription : I/O Monitor
InternalName : PCCNTMON
LegalCopyright : Copyright © 1998-2001 Trend Micro Inc. All rights reserved.
LegalTrademarks : Copyright © Trend Micro Inc.
OriginalFilename : PCCNTMON.EXE
#:20 [qttask.exe]
FilePath : C:\Program Files\QuickTime\
ProcessID : 960
ThreadCreationTime : 11-24-2004 5:03:45 PM
BasePriority : Normal
FileVersion : 6.0.2
ProductVersion : QuickTime 6.0.2
ProductName : QuickTime
CompanyName : Apple Computer, Inc.
InternalName : QuickTime Task
LegalCopyright : © Apple Computer, Inc. 2001-2002
OriginalFilename : QTTask.exe
#:21 [pdesk.exe]
FilePath : C:\WINNT\system32\PDesk\
ProcessID : 1160
ThreadCreationTime : 11-24-2004 5:03:47 PM
BasePriority : Normal
FileVersion : 6.93.009
ProductVersion : 6.93.009
ProductName : Matrox PDesk
CompanyName : Matrox Graphics Inc.
FileDescription : PDesk
InternalName : PDesk
LegalCopyright : Copyright © 1996-2001
OriginalFilename : PDesk.exe
#:22 [ppcontrol.exe]
FilePath : C:\PROGRA~1\PESTPA~1\
ProcessID : 1180
ThreadCreationTime : 11-24-2004 5:03:48 PM
BasePriority : Normal
#:23 [ppmemcheck.exe]
FilePath : C:\PROGRA~1\PESTPA~1\
ProcessID : 1200
ThreadCreationTime : 11-24-2004 5:03:49 PM
BasePriority : Normal
#:24 [cookiepatrol.exe]
FilePath : C:\PROGRA~1\PESTPA~1\
ProcessID : 1208
ThreadCreationTime : 11-24-2004 5:03:49 PM
BasePriority : Normal
#:25 [teatimer.exe]
FilePath : C:\Program Files\Spybot - Search & Destroy\
ProcessID : 1240
ThreadCreationTime : 11-24-2004 5:03:52 PM
BasePriority : Idle
FileVersion : 1, 3, 0, 12
ProductVersion : 1, 3, 0, 12
ProductName : Spybot - Search & Destroy
CompanyName : Safer Networking Limited
FileDescription : System settings protector
InternalName : TeaTimer
LegalCopyright : © 2000-2004 Patrick M. Kolla / Safer Networking Limited. Alle Rechte vorbehalten.
LegalTrademarks : "Spybot" und "Spybot - Search & Destroy" sind registrierte Warenzeichen.
OriginalFilename : TeaTimer.exe
Comments : Schützt Systemeinstellungen vor ungewollten Änderungen.
#:26 [spysub.exe]
FilePath : C:\Program Files\InterMute\SpySubtract\
ProcessID : 1260
ThreadCreationTime : 11-24-2004 5:03:56 PM
BasePriority : Normal
FileVersion : 1, 0, 1, 49
ProductVersion : 2.60
ProductName : SpySubtract
CompanyName : InterMute, Inc.
FileDescription : SpySubtract Program EXE
InternalName : SpySub.exe
LegalCopyright : Copyright © 2004 InterMute, Inc. All rights reserved.
OriginalFilename : SpySub.exe
#:27 [wzqkpick.exe]
FilePath : C:\Program Files\WinZip\
ProcessID : 1308
ThreadCreationTime : 11-24-2004 5:03:58 PM
BasePriority : Normal
FileVersion : 1.0 (32-bit)
ProductVersion : 9.0 (6224)
ProductName : WinZip
CompanyName : WinZip Computing, Inc.
FileDescription : WinZip Executable
InternalName : WZQKPICK.EXE
LegalCopyright : Copyright © WinZip Computing, Inc. 1991-2004 - All Rights Reserved
LegalTrademarks : WinZip is a registered trademark of WinZip Computing, Inc
OriginalFilename : WZQKPICK.EXE
Comments : StringFileInfo: U.S. English
#:28 [ad-aware.exe]
FilePath : C:\PROGRA~1\Lavasoft\AD-AWA~1\
ProcessID : 1548
ThreadCreationTime : 11-24-2004 7:01:29 PM
BasePriority : Normal
FileVersion : 6.2.0.206
ProductVersion : VI.Second Edition
ProductName : Lavasoft Ad-Aware SE
CompanyName : Lavasoft Sweden
FileDescription : Ad-Aware SE Core application
InternalName : Ad-Aware.exe
LegalCopyright : Copyright © Lavasoft Sweden
OriginalFilename : Ad-Aware.exe
Comments : All Rights Reserved
Memory scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 0
Started registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
begin2search Object Recognized!
Type : Regkey
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{a797a41d-f9f0-4a32-b9b5-af927cb5ae54}
begin2search Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{a797a41d-f9f0-4a32-b9b5-af927cb5ae54}
Value :
begin2search Object Recognized!
Type : Regkey
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{17973bd7-959c-4d8a-8b2f-ab200e20a75e}
begin2search Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{17973bd7-959c-4d8a-8b2f-ab200e20a75e}
Value :
begin2search Object Recognized!
Type : Regkey
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{bf7cb2c3-55b6-44c1-9615-920d004c27f7}
begin2search Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{bf7cb2c3-55b6-44c1-9615-920d004c27f7}
Value :
begin2search Object Recognized!
Type : Regkey
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{f912c325-5b26-4ad6-bf39-84370833e972}
begin2search Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{f912c325-5b26-4ad6-bf39-84370833e972}
Value :
begin2search Object Recognized!
Type : Regkey
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{b12508ad-ca55-4238-8db3-55808ba6915a}
begin2search Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{b12508ad-ca55-4238-8db3-55808ba6915a}
Value :
begin2search Object Recognized!
Type : Regkey
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{6fe4aadf-edac-4037-9164-0b60179a4f12}
begin2search Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{6fe4aadf-edac-4037-9164-0b60179a4f12}
Value :
Pribi.bho Object Recognized!
Type : Regkey
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{a8c761d6-31f2-429a-bf1f-63b416ac87ea}
Pribi.bho Object Recognized!
Type : RegValue
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{a8c761d6-31f2-429a-bf1f-63b416ac87ea}
Value :
Pribi.bho Object Recognized!
Type : Regkey
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{5d30f537-f73a-40e4-9f57-06d51c169cc8}
Pribi.bho Object Recognized!
Type : RegValue
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{5d30f537-f73a-40e4-9f57-06d51c169cc8}
Value :
Pribi.bho Object Recognized!
Type : Regkey
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{fa1d5414-d123-4716-a39a-1e831c56e53d}
Pribi.bho Object Recognized!
Type : RegValue
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{fa1d5414-d123-4716-a39a-1e831c56e53d}
Value :
Pribi.bho Object Recognized!
Type : Regkey
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{f11126ab-5429-42a3-8fa4-d4899d23a8ea}
Pribi.bho Object Recognized!
Type : RegValue
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{f11126ab-5429-42a3-8fa4-d4899d23a8ea}
Value :
Pribi.bho Object Recognized!
Type : Regkey
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : typelib\{12da4940-557b-4dab-a1cc-e7fe615c2f89}
Pribi.bho Object Recognized!
Type : Regkey
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : g1.gz
Pribi.bho Object Recognized!
Type : RegValue
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : g1.gz
Value :
Pribi.bho Object Recognized!
Type : Regkey
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : clsid\{eff3cd67-d0b6-42d5-a68d-3f2268ed3d80}
Pribi.bho Object Recognized!
Type : RegValue
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : clsid\{eff3cd67-d0b6-42d5-a68d-3f2268ed3d80}
Value :
Pribi.bho Object Recognized!
Type : Regkey
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : typelib\{12da4940-557b-4dab-a1cc-e7fe615c2f89}\1.0
Pribi.bho Object Recognized!
Type : RegValue
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : typelib\{12da4940-557b-4dab-a1cc-e7fe615c2f89}\1.0
Value :
Pribi.bho Object Recognized!
Type : Regkey
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : g1.hjj
Pribi.bho Object Recognized!
Type : RegValue
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : g1.hjj
Value :
Pribi.bho Object Recognized!
Type : Regkey
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : clsid\{79c03bc5-6c55-4b5b-921f-c02b6f1abd7b}
Pribi.bho Object Recognized!
Type : RegValue
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : clsid\{79c03bc5-6c55-4b5b-921f-c02b6f1abd7b}
Value :
Alexa Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment : "{c95fe080-8f5d-11d2-a20b-00aa003c157a}"
Rootkey : HKEY_USERS
Object : S-1-5-21-731658980-557269150-825688854-1005\software\microsoft\internet explorer\extensions\cmdmapping
Value : {c95fe080-8f5d-11d2-a20b-00aa003c157a}
begin2search Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment : "showbar"
Rootkey : HKEY_USERS
Object : S-1-5-21-731658980-557269150-825688854-1005\software\aaa_soft
Value : showbar
BookedSpace Object Recognized!
Type : RegValue
Data :
Category : Malware
Comment : "cccc"
Rootkey : HKEY_USERS
Object : S-1-5-21-731658980-557269150-825688854-1005\software\aaa_soft
Value : cccc
TVMedia Object Recognized!
Type : RegValue
Data :
Category : Malware
Comment : "{20EC3D2D-33C1-4C9D-BC37-C2D500688DA2}"
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\internet explorer\urlsearchhooks
Value : {20EC3D2D-33C1-4C9D-BC37-C2D500688DA2}
Registry Scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 35
Objects found so far: 35
Started deep registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Deep registry scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 35
Started Tracking Cookie scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : jim@versiontracker[1].txt
Category : Data Miner
Comment : Hits:3
Value : Cookie:[removed]/
Expires : 11-24-2006 1:49:46 AM
LastSync : Hits:3
UseCount : 0
Hits : 3
Tracking cookie scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 1
Objects found so far: 36
Deep scanning and examining files…
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
VX2 Object Recognized!
Type : File
Data : kwv2.dat
Category : Malware
Comment :
Object : C:\WINNT\
Disk Scan Result for C:\WINNT
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 37
VX2 Object Recognized!
Type : File
Data : 06wu29rd.exe
Category : Malware
Comment :
Object : C:\WINNT\system32\
begin2search Object Recognized!
Type : File
Data : 449166.exe
Category : Data Miner
Comment :
Object : C:\WINNT\system32\
istbar Object Recognized!
Type : File
Data : istinstall_154074.exe
Category : Malware
Comment :
Object : C:\WINNT\system32\
BookedSpace Object Recognized!
Type : File
Data : reg6523.exe
Category : Malware
Comment :
Object : C:\WINNT\system32\
Disk Scan Result for C:\WINNT\system32
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 41
Disk Scan Result for C:\DOCUME~1\JIM~1.CAR\LOCALS~1\Temp\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 41
Scanning Hosts file……
Hosts file location:"C:\WINNT\system32\drivers\etc\hosts".
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Hosts file scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
1 entries scanned.
New critical objects:0
Objects found so far: 41
Performing conditional scans…
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
begin2search Object Recognized!
Type : Regkey
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\aaa_soft
begin2search Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\aaa_soft
Value : ffff
begin2search Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\aaa_soft
Value : cccc
begin2search Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\aaa_soft
Value : showbar
Pribi.bho Object Recognized!
Type : Folder
Category : Malware
Comment :
Object : c:\documents and settings\all users\application data\Setup
Pribi.bho Object Recognized!
Type : Folder
Category : Malware
Comment :
Object : c:\documents and settings\all users\application data\Pribi
Pribi.bho Object Recognized!
Type : File
Data : Pribi.dll
Category : Malware
Comment :
Object : c:\documents and settings\all users\application data\pribi\
FileVersion : 1.01.0001
ProductVersion : 1.01.0001
InternalName : Pribi
OriginalFilename : Pribi.dll
Pribi.bho Object Recognized!
Type : File
Data : spif.fil
Category : Malware
Comment :
Object : c:\documents and settings\all users\application data\pribi\
Pribi.bho Object Recognized!
Type : File
Data : spif.ini
Category : Malware
Comment :
Object : c:\documents and settings\all users\application data\pribi\
Pribi.bho Object Recognized!
Type : File
Data : v29.exe
Category : Malware
Comment :
Object : c:\documents and settings\all users\application data\pribi\
Pribi.bho Object Recognized!
Type : File
Data : setup.ini
Category : Malware
Comment :
Object : c:\documents and settings\all users\application data\setup\
BookedSpace Object Recognized!
Type : RegValue
Data :
Category : Malware
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\microsoft\internet explorer\media
Value : data
VX2 Object Recognized!
Type : RegValue
Data :
Category : Malware
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\microsoft\internet explorer\toolbar\webbrowser
Value : {0E5CBF21-D15F-11D0-8301-00AA005B4383}
VX2 Object Recognized!
Type : File
Data : twaintec.PNF
Category : Malware
Comment :
Object : C:\WINNT\inf\
Conditional scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 14
Objects found so far: 55
2:09:47 PM Scan Complete
Summary Of This Scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Total scanning time:00:02:22.655
Objects scanned:40998
Objects identified:55
Objects ignored:0
New critical objects:55
How do we look?
Last question (this one about HJT). Is it my understanding that I shouldn't change the default start page - or does it not matter?
Thanks again DM.
I snuffed out the old Ad-aware 6.0 and replaced it with SE. Felt very savy doing so too. Thanks.
Made all of the configurations you suggested, though there are some discrepancies again. Sorry.
- Under Definitions - I checked 'Prompt to update' and the set the days to 7
- Under Cleaning Engines:
- I checked 'Let Windows remove…'
- I left green the already checked options of:
- Always try to unload modules before deletion
- During removal, unload Explorer and IE if necessary
- Delete quarantined objects after restoring
- Under log files
- I checked the two selections you suggested
- I left green the already checked options of:
- Include reference summary in log file
- Include alternate data stream details in log file
- 'Include Module list in logfile' is deselected
I updated then ran the scan - 55 objects found - ouch!
It didn't prompt to save the logfile, but I think it did it automatically. I'll copy and paste that at the end.
I selected all and deleted. I will shut down and finish the deletion process after I post this message.
Here is the logfile from SE:
Ad-Aware SE Build 1.05
Logfile Created on:Wednesday, November 24, 2004 2:07:24 PM
Created with Ad-Aware SE Personal, free for private use.
Using definitions file:SE1R19 14.11.2004
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
References detected during the scan:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Alexa(TAC index:5):1 total references
begin2search(TAC index:3):18 total references
BookedSpace(TAC index:10):3 total references
istbar(TAC index:6):1 total references
Pribi.bho(TAC index:6):26 total references
Tracking Cookie(TAC index:3):1 total references
TVMedia(TAC index:5):1 total references
VX2(TAC index:10):4 total references
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Definition File:
=========================
Definitions File Loaded:
Reference Number : SE1R8 13.09.2004
Internal build : 12
File location : C:\PROGRA~1\Lavasoft\AD-AWA~1\defs.ref
File size : 344723 Bytes
Total size : 1092481 Bytes
Signature data size : 1068971 Bytes
Reference data size : 22998 Bytes
Signatures total : 30122
Fingerprints total : 154
Fingerprints size : 7129 Bytes
Target categories : 15
Target families : 560
11-24-2004 2:01:43 PM Performing WebUpdate…
Installing Update…
Definitions File Loaded:
Reference Number : SE1R19 14.11.2004
Internal build : 24
File location : C:\PROGRA~1\Lavasoft\AD-AWA~1\defs.ref
File size : 399688 Bytes
Total size : 1262753 Bytes
Signature data size : 1233509 Bytes
Reference data size : 28732 Bytes
Signatures total : 35069
Fingerprints total : 513
Fingerprints size : 19898 Bytes
Target categories : 15
Target families : 617
11-24-2004 2:01:53 PM Success
Update successfully downloaded and installed.
Memory + processor status:
==========================
Number of processors : 1
Processor architecture : Intel Pentium II
Memory available:12 %
Total physical memory:196148 kb
Available physical memory:23408 kb
Total page file size:471956 kb
Available on page file:299620 kb
Total virtual memory:2097024 kb
Available virtual memory:2044568 kb
OS:Microsoft Windows 2000 Professional Service Pack 4 (Build 2195)
Ad-Aware SE Settings
===========================
Set : Move deleted files to Recycle Bin
Set : Safe mode (always request confirmation)
Set : Don't log streams smaller than 0 Bytes
Set : Scan active processes
Set : Scan registry
Set : Deep-scan registry
Set : Scan my IE Favorites for banned URLs
Set : Scan within archives
Set : Scan my Hosts file
Extended Ad-Aware SE Settings
===========================
Set : Unload recognized processes & modules during scan
Set : Scan registry for all users instead of current user only
Set : Always try to unload modules before deletion
Set : During removal, unload Explorer and IE if necessary
Set : Let Windows remove files in use at next reboot
Set : Delete quarantined objects after restoring
Set : Include basic Ad-Aware settings in log file
Set : Include additional Ad-Aware settings in log file
Set : Include reference summary in log file
Set : Include alternate data stream details in log file
Set : Play sound at scan completion if scan locates critical objects
11-24-2004 2:07:24 PM - Scan started. (Smart mode)
Listing running processes
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
#:1 [smss.exe]
FilePath : \SystemRoot\System32\
ProcessID : 136
ThreadCreationTime : 11-24-2004 4:37:19 PM
BasePriority : Normal
#:2 [csrss.exe]
FilePath : \??\C:\WINNT\system32\
ProcessID : 164
ThreadCreationTime : 11-24-2004 4:37:32 PM
BasePriority : Normal
#:3 [winlogon.exe]
FilePath : \??\C:\WINNT\system32\
ProcessID : 160
ThreadCreationTime : 11-24-2004 4:37:34 PM
BasePriority : High
#:4 [services.exe]
FilePath : C:\WINNT\system32\
ProcessID : 212
ThreadCreationTime : 11-24-2004 4:37:37 PM
BasePriority : Normal
FileVersion : 5.00.2195.6700
ProductVersion : 5.00.2195.6700
ProductName : Microsoft® Windows ® 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : Services and Controller app
InternalName : services.exe
LegalCopyright : Copyright © Microsoft Corp. 1981-1999
OriginalFilename : services.exe
#:5 [lsass.exe]
FilePath : C:\WINNT\system32\
ProcessID : 224
ThreadCreationTime : 11-24-2004 4:37:37 PM
BasePriority : Normal
FileVersion : 5.00.2195.6902
ProductVersion : 5.00.2195.6902
ProductName : Microsoft® Windows ® 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : LSA Executable and Server DLL (Export Version)
InternalName : lsasrv.dll and lsass.exe
LegalCopyright : Copyright © Microsoft Corp. 1981-1999
OriginalFilename : lsasrv.dll and lsass.exe
#:6 [svchost.exe]
FilePath : C:\WINNT\system32\
ProcessID : 404
ThreadCreationTime : 11-24-2004 4:37:42 PM
BasePriority : Normal
FileVersion : 5.00.2134.1
ProductVersion : 5.00.2134.1
ProductName : Microsoft® Windows ® 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : Copyright © Microsoft Corp. 1981-1999
OriginalFilename : svchost.exe
#:7 [spoolsv.exe]
FilePath : C:\WINNT\system32\
ProcessID : 440
ThreadCreationTime : 11-24-2004 4:37:48 PM
BasePriority : Normal
FileVersion : 5.00.2195.6659
ProductVersion : 5.00.2195.6659
ProductName : Microsoft® Windows ® 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : Spooler SubSystem App
InternalName : spoolss.exe
LegalCopyright : Copyright © Microsoft Corp. 1981-1999
OriginalFilename : spoolss.exe
#:8 [svchost.exe]
FilePath : C:\WINNT\System32\
ProcessID : 528
ThreadCreationTime : 11-24-2004 4:37:56 PM
BasePriority : Normal
FileVersion : 5.00.2134.1
ProductVersion : 5.00.2134.1
ProductName : Microsoft® Windows ® 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : Copyright © Microsoft Corp. 1981-1999
OriginalFilename : svchost.exe
#:9 [mgabg.exe]
FilePath : C:\WINNT\system32\
ProcessID : 564
ThreadCreationTime : 11-24-2004 4:37:59 PM
BasePriority : Normal
FileVersion : 1.00.023
ProductVersion : 1.00.023
ProductName : Matrox Graphics Inc. MGABG
CompanyName : Matrox Graphics Inc.
FileDescription : MGABG
InternalName : MGABG
LegalCopyright : Copyright Matrox © 2001
OriginalFilename : MGABG.exe
#:10 [ntrtscan.exe]
FilePath : C:\OfficeScan NT\
ProcessID : 588
ThreadCreationTime : 11-24-2004 4:38:00 PM
BasePriority : Normal
FileVersion : 3.54.0.1654
ProductVersion : 3.54.0
ProductName : Trend Trend OfficeScan 3.54
CompanyName : Trend Micro Inc.
LegalCopyright : Copyright © 1998-2001 Trend Micro Inc. All rights reserved.
LegalTrademarks : Copyright © Trend Micro Inc.
#:11 [regsvc.exe]
FilePath : C:\WINNT\system32\
ProcessID : 668
ThreadCreationTime : 11-24-2004 4:38:01 PM
BasePriority : Normal
FileVersion : 5.00.2195.6701
ProductVersion : 5.00.2195.6701
ProductName : Microsoft® Windows ® 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : Remote Registry Service
InternalName : regsvc
LegalCopyright : Copyright © Microsoft Corp. 1981-1999
OriginalFilename : REGSVC.EXE
#:12 [mstask.exe]
FilePath : C:\WINNT\system32\
ProcessID : 684
ThreadCreationTime : 11-24-2004 4:38:02 PM
BasePriority : Normal
FileVersion : 4.71.2195.6920
ProductVersion : 4.71.2195.6920
ProductName : Microsoft® Windows® Task Scheduler
CompanyName : Microsoft Corporation
FileDescription : Task Scheduler Engine
InternalName : TaskScheduler
LegalCopyright : Copyright © Microsoft Corp. 1997
OriginalFilename : mstask.exe
#:13 [tmlisten.exe]
FilePath : C:\OfficeScan NT\
ProcessID : 712
ThreadCreationTime : 11-24-2004 4:38:03 PM
BasePriority : Normal
#:14 [winmgmt.exe]
FilePath : C:\WINNT\System32\WBEM\
ProcessID : 824
ThreadCreationTime : 11-24-2004 4:38:08 PM
BasePriority : Normal
FileVersion : 1.50.1085.0100
ProductVersion : 1.50.1085.0100
ProductName : Windows Management Instrumentation
CompanyName : Microsoft Corporation
FileDescription : Windows Management Instrumentation
InternalName : WINMGMT
LegalCopyright : Copyright © Microsoft Corp. 1995-1999
#:15 [mspmspsv.exe]
FilePath : C:\WINNT\System32\
ProcessID : 856
ThreadCreationTime : 11-24-2004 4:38:10 PM
BasePriority : Normal
FileVersion : 7.10.00.3068
ProductVersion : 7.10.00.3068
ProductName : Microsoft ® DRM
CompanyName : Microsoft Corporation
FileDescription : WMDM PMSP Service
InternalName : MSPMSPSV.EXE
LegalCopyright : Copyright © Microsoft Corp. 1981-2000
OriginalFilename : MSPMSPSV.EXE
#:16 [svchost.exe]
FilePath : C:\WINNT\system32\
ProcessID : 868
ThreadCreationTime : 11-24-2004 4:38:10 PM
BasePriority : Normal
FileVersion : 5.00.2134.1
ProductVersion : 5.00.2134.1
ProductName : Microsoft® Windows ® 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : Generic Host Process for Win32 Services
InternalName : svchost.exe
LegalCopyright : Copyright © Microsoft Corp. 1981-1999
OriginalFilename : svchost.exe
#:17 [explorer.exe]
FilePath : C:\WINNT\
ProcessID : 780
ThreadCreationTime : 11-24-2004 5:03:30 PM
BasePriority : Normal
FileVersion : 5.00.3700.6690
ProductVersion : 5.00.3700.6690
ProductName : Microsoft® Windows ® 2000 Operating System
CompanyName : Microsoft Corporation
FileDescription : Windows Explorer
InternalName : explorer
LegalCopyright : Copyright © Microsoft Corp. 1981-1999
OriginalFilename : EXPLORER.EXE
#:18 [wuauclt.exe]
FilePath : C:\WINNT\system32\
ProcessID : 1012
ThreadCreationTime : 11-24-2004 5:03:44 PM
BasePriority : Normal
FileVersion : 5.4.3630.2554 built by: lab04_n
ProductVersion : 5.4.3630.2554
ProductName : Microsoft® Windows® Operating System
CompanyName : Microsoft Corporation
FileDescription : Windows Update AutoUpdate Client
InternalName : wuauclt.exe
LegalCopyright : © Microsoft Corporation. All rights reserved.
OriginalFilename : wuauclt.exe
#:19 [pccntmon.exe]
FilePath : C:\OfficeScan NT\
ProcessID : 1128
ThreadCreationTime : 11-24-2004 5:03:45 PM
BasePriority : Normal
FileVersion : 3.54.0.1654
ProductVersion : 3.54.0
ProductName : Trend Trend OfficeScan 3.54
CompanyName : Trend Micro Inc.
FileDescription : I/O Monitor
InternalName : PCCNTMON
LegalCopyright : Copyright © 1998-2001 Trend Micro Inc. All rights reserved.
LegalTrademarks : Copyright © Trend Micro Inc.
OriginalFilename : PCCNTMON.EXE
#:20 [qttask.exe]
FilePath : C:\Program Files\QuickTime\
ProcessID : 960
ThreadCreationTime : 11-24-2004 5:03:45 PM
BasePriority : Normal
FileVersion : 6.0.2
ProductVersion : QuickTime 6.0.2
ProductName : QuickTime
CompanyName : Apple Computer, Inc.
InternalName : QuickTime Task
LegalCopyright : © Apple Computer, Inc. 2001-2002
OriginalFilename : QTTask.exe
#:21 [pdesk.exe]
FilePath : C:\WINNT\system32\PDesk\
ProcessID : 1160
ThreadCreationTime : 11-24-2004 5:03:47 PM
BasePriority : Normal
FileVersion : 6.93.009
ProductVersion : 6.93.009
ProductName : Matrox PDesk
CompanyName : Matrox Graphics Inc.
FileDescription : PDesk
InternalName : PDesk
LegalCopyright : Copyright © 1996-2001
OriginalFilename : PDesk.exe
#:22 [ppcontrol.exe]
FilePath : C:\PROGRA~1\PESTPA~1\
ProcessID : 1180
ThreadCreationTime : 11-24-2004 5:03:48 PM
BasePriority : Normal
#:23 [ppmemcheck.exe]
FilePath : C:\PROGRA~1\PESTPA~1\
ProcessID : 1200
ThreadCreationTime : 11-24-2004 5:03:49 PM
BasePriority : Normal
#:24 [cookiepatrol.exe]
FilePath : C:\PROGRA~1\PESTPA~1\
ProcessID : 1208
ThreadCreationTime : 11-24-2004 5:03:49 PM
BasePriority : Normal
#:25 [teatimer.exe]
FilePath : C:\Program Files\Spybot - Search & Destroy\
ProcessID : 1240
ThreadCreationTime : 11-24-2004 5:03:52 PM
BasePriority : Idle
FileVersion : 1, 3, 0, 12
ProductVersion : 1, 3, 0, 12
ProductName : Spybot - Search & Destroy
CompanyName : Safer Networking Limited
FileDescription : System settings protector
InternalName : TeaTimer
LegalCopyright : © 2000-2004 Patrick M. Kolla / Safer Networking Limited. Alle Rechte vorbehalten.
LegalTrademarks : "Spybot" und "Spybot - Search & Destroy" sind registrierte Warenzeichen.
OriginalFilename : TeaTimer.exe
Comments : Schützt Systemeinstellungen vor ungewollten Änderungen.
#:26 [spysub.exe]
FilePath : C:\Program Files\InterMute\SpySubtract\
ProcessID : 1260
ThreadCreationTime : 11-24-2004 5:03:56 PM
BasePriority : Normal
FileVersion : 1, 0, 1, 49
ProductVersion : 2.60
ProductName : SpySubtract
CompanyName : InterMute, Inc.
FileDescription : SpySubtract Program EXE
InternalName : SpySub.exe
LegalCopyright : Copyright © 2004 InterMute, Inc. All rights reserved.
OriginalFilename : SpySub.exe
#:27 [wzqkpick.exe]
FilePath : C:\Program Files\WinZip\
ProcessID : 1308
ThreadCreationTime : 11-24-2004 5:03:58 PM
BasePriority : Normal
FileVersion : 1.0 (32-bit)
ProductVersion : 9.0 (6224)
ProductName : WinZip
CompanyName : WinZip Computing, Inc.
FileDescription : WinZip Executable
InternalName : WZQKPICK.EXE
LegalCopyright : Copyright © WinZip Computing, Inc. 1991-2004 - All Rights Reserved
LegalTrademarks : WinZip is a registered trademark of WinZip Computing, Inc
OriginalFilename : WZQKPICK.EXE
Comments : StringFileInfo: U.S. English
#:28 [ad-aware.exe]
FilePath : C:\PROGRA~1\Lavasoft\AD-AWA~1\
ProcessID : 1548
ThreadCreationTime : 11-24-2004 7:01:29 PM
BasePriority : Normal
FileVersion : 6.2.0.206
ProductVersion : VI.Second Edition
ProductName : Lavasoft Ad-Aware SE
CompanyName : Lavasoft Sweden
FileDescription : Ad-Aware SE Core application
InternalName : Ad-Aware.exe
LegalCopyright : Copyright © Lavasoft Sweden
OriginalFilename : Ad-Aware.exe
Comments : All Rights Reserved
Memory scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 0
Started registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
begin2search Object Recognized!
Type : Regkey
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{a797a41d-f9f0-4a32-b9b5-af927cb5ae54}
begin2search Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{a797a41d-f9f0-4a32-b9b5-af927cb5ae54}
Value :
begin2search Object Recognized!
Type : Regkey
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{17973bd7-959c-4d8a-8b2f-ab200e20a75e}
begin2search Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{17973bd7-959c-4d8a-8b2f-ab200e20a75e}
Value :
begin2search Object Recognized!
Type : Regkey
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{bf7cb2c3-55b6-44c1-9615-920d004c27f7}
begin2search Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{bf7cb2c3-55b6-44c1-9615-920d004c27f7}
Value :
begin2search Object Recognized!
Type : Regkey
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{f912c325-5b26-4ad6-bf39-84370833e972}
begin2search Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{f912c325-5b26-4ad6-bf39-84370833e972}
Value :
begin2search Object Recognized!
Type : Regkey
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{b12508ad-ca55-4238-8db3-55808ba6915a}
begin2search Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{b12508ad-ca55-4238-8db3-55808ba6915a}
Value :
begin2search Object Recognized!
Type : Regkey
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{6fe4aadf-edac-4037-9164-0b60179a4f12}
begin2search Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{6fe4aadf-edac-4037-9164-0b60179a4f12}
Value :
Pribi.bho Object Recognized!
Type : Regkey
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{a8c761d6-31f2-429a-bf1f-63b416ac87ea}
Pribi.bho Object Recognized!
Type : RegValue
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{a8c761d6-31f2-429a-bf1f-63b416ac87ea}
Value :
Pribi.bho Object Recognized!
Type : Regkey
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{5d30f537-f73a-40e4-9f57-06d51c169cc8}
Pribi.bho Object Recognized!
Type : RegValue
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{5d30f537-f73a-40e4-9f57-06d51c169cc8}
Value :
Pribi.bho Object Recognized!
Type : Regkey
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{fa1d5414-d123-4716-a39a-1e831c56e53d}
Pribi.bho Object Recognized!
Type : RegValue
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{fa1d5414-d123-4716-a39a-1e831c56e53d}
Value :
Pribi.bho Object Recognized!
Type : Regkey
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{f11126ab-5429-42a3-8fa4-d4899d23a8ea}
Pribi.bho Object Recognized!
Type : RegValue
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : interface\{f11126ab-5429-42a3-8fa4-d4899d23a8ea}
Value :
Pribi.bho Object Recognized!
Type : Regkey
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : typelib\{12da4940-557b-4dab-a1cc-e7fe615c2f89}
Pribi.bho Object Recognized!
Type : Regkey
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : g1.gz
Pribi.bho Object Recognized!
Type : RegValue
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : g1.gz
Value :
Pribi.bho Object Recognized!
Type : Regkey
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : clsid\{eff3cd67-d0b6-42d5-a68d-3f2268ed3d80}
Pribi.bho Object Recognized!
Type : RegValue
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : clsid\{eff3cd67-d0b6-42d5-a68d-3f2268ed3d80}
Value :
Pribi.bho Object Recognized!
Type : Regkey
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : typelib\{12da4940-557b-4dab-a1cc-e7fe615c2f89}\1.0
Pribi.bho Object Recognized!
Type : RegValue
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : typelib\{12da4940-557b-4dab-a1cc-e7fe615c2f89}\1.0
Value :
Pribi.bho Object Recognized!
Type : Regkey
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : g1.hjj
Pribi.bho Object Recognized!
Type : RegValue
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : g1.hjj
Value :
Pribi.bho Object Recognized!
Type : Regkey
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : clsid\{79c03bc5-6c55-4b5b-921f-c02b6f1abd7b}
Pribi.bho Object Recognized!
Type : RegValue
Data :
Category : Malware
Comment :
Rootkey : HKEY_CLASSES_ROOT
Object : clsid\{79c03bc5-6c55-4b5b-921f-c02b6f1abd7b}
Value :
Alexa Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment : "{c95fe080-8f5d-11d2-a20b-00aa003c157a}"
Rootkey : HKEY_USERS
Object : S-1-5-21-731658980-557269150-825688854-1005\software\microsoft\internet explorer\extensions\cmdmapping
Value : {c95fe080-8f5d-11d2-a20b-00aa003c157a}
begin2search Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment : "showbar"
Rootkey : HKEY_USERS
Object : S-1-5-21-731658980-557269150-825688854-1005\software\aaa_soft
Value : showbar
BookedSpace Object Recognized!
Type : RegValue
Data :
Category : Malware
Comment : "cccc"
Rootkey : HKEY_USERS
Object : S-1-5-21-731658980-557269150-825688854-1005\software\aaa_soft
Value : cccc
TVMedia Object Recognized!
Type : RegValue
Data :
Category : Malware
Comment : "{20EC3D2D-33C1-4C9D-BC37-C2D500688DA2}"
Rootkey : HKEY_LOCAL_MACHINE
Object : software\microsoft\internet explorer\urlsearchhooks
Value : {20EC3D2D-33C1-4C9D-BC37-C2D500688DA2}
Registry Scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 35
Objects found so far: 35
Started deep registry scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Deep registry scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 35
Started Tracking Cookie scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Tracking Cookie Object Recognized!
Type : IECache Entry
Data : jim@versiontracker[1].txt
Category : Data Miner
Comment : Hits:3
Value : Cookie:[removed]/
Expires : 11-24-2006 1:49:46 AM
LastSync : Hits:3
UseCount : 0
Hits : 3
Tracking cookie scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 1
Objects found so far: 36
Deep scanning and examining files…
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
VX2 Object Recognized!
Type : File
Data : kwv2.dat
Category : Malware
Comment :
Object : C:\WINNT\
Disk Scan Result for C:\WINNT
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 37
VX2 Object Recognized!
Type : File
Data : 06wu29rd.exe
Category : Malware
Comment :
Object : C:\WINNT\system32\
begin2search Object Recognized!
Type : File
Data : 449166.exe
Category : Data Miner
Comment :
Object : C:\WINNT\system32\
istbar Object Recognized!
Type : File
Data : istinstall_154074.exe
Category : Malware
Comment :
Object : C:\WINNT\system32\
BookedSpace Object Recognized!
Type : File
Data : reg6523.exe
Category : Malware
Comment :
Object : C:\WINNT\system32\
Disk Scan Result for C:\WINNT\system32
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 41
Disk Scan Result for C:\DOCUME~1\JIM~1.CAR\LOCALS~1\Temp\
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 0
Objects found so far: 41
Scanning Hosts file……
Hosts file location:"C:\WINNT\system32\drivers\etc\hosts".
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Hosts file scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
1 entries scanned.
New critical objects:0
Objects found so far: 41
Performing conditional scans…
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
begin2search Object Recognized!
Type : Regkey
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\aaa_soft
begin2search Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\aaa_soft
Value : ffff
begin2search Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\aaa_soft
Value : cccc
begin2search Object Recognized!
Type : RegValue
Data :
Category : Data Miner
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\aaa_soft
Value : showbar
Pribi.bho Object Recognized!
Type : Folder
Category : Malware
Comment :
Object : c:\documents and settings\all users\application data\Setup
Pribi.bho Object Recognized!
Type : Folder
Category : Malware
Comment :
Object : c:\documents and settings\all users\application data\Pribi
Pribi.bho Object Recognized!
Type : File
Data : Pribi.dll
Category : Malware
Comment :
Object : c:\documents and settings\all users\application data\pribi\
FileVersion : 1.01.0001
ProductVersion : 1.01.0001
InternalName : Pribi
OriginalFilename : Pribi.dll
Pribi.bho Object Recognized!
Type : File
Data : spif.fil
Category : Malware
Comment :
Object : c:\documents and settings\all users\application data\pribi\
Pribi.bho Object Recognized!
Type : File
Data : spif.ini
Category : Malware
Comment :
Object : c:\documents and settings\all users\application data\pribi\
Pribi.bho Object Recognized!
Type : File
Data : v29.exe
Category : Malware
Comment :
Object : c:\documents and settings\all users\application data\pribi\
Pribi.bho Object Recognized!
Type : File
Data : setup.ini
Category : Malware
Comment :
Object : c:\documents and settings\all users\application data\setup\
BookedSpace Object Recognized!
Type : RegValue
Data :
Category : Malware
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\microsoft\internet explorer\media
Value : data
VX2 Object Recognized!
Type : RegValue
Data :
Category : Malware
Comment :
Rootkey : HKEY_CURRENT_USER
Object : software\microsoft\internet explorer\toolbar\webbrowser
Value : {0E5CBF21-D15F-11D0-8301-00AA005B4383}
VX2 Object Recognized!
Type : File
Data : twaintec.PNF
Category : Malware
Comment :
Object : C:\WINNT\inf\
Conditional scan result:
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
New critical objects: 14
Objects found so far: 55
2:09:47 PM Scan Complete
Summary Of This Scan
»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
Total scanning time:00:02:22.655
Objects scanned:40998
Objects identified:55
Objects ignored:0
New critical objects:55
How do we look?
Last question (this one about HJT). Is it my understanding that I shouldn't change the default start page - or does it not matter?
Thanks again DM.
ironboot
I've got all 3 computers on my sales side updated and cleaned - per your suggestions. I have run the Hijackthis log. Do you want to see them all at once or one at a time.
DumbTerminal
Ironboot, you're a madman!!
Lets just go with one at a time.
I dont need the Adaware log files. I dont really understand them!
Those instructions are actually a canned response that I cut and paste to save time.
Go ahead and post whichever HJT log you want next. I've got a long weekend, but hopefully I'll be able to pop in to help
ironboot
Madman - naw, just trying to do what I am told. Plus, I lose points for thanking DM instead of DT.
I learn.
Might as well finish Comp A (since this is where it all began). On this one I also added the SpyawareBlaster and the IEspyad - per your suggestion. Haven't to the other computers yet.
Logfile of HijackThis v1.98.2
Scan saved at 3:26:16 PM, on 11/24/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\mgabg.exe
C:\OfficeScan NT\ntrtscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\OfficeScan NT\tmlisten.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\OfficeScan NT\pccntmon.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINNT\system32\PDesk\PDesk.exe
C:\PROGRA~1\PESTPA~1\PPControl.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\InterMute\SpySubtract\SpySub.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINNT\system32\wuauclt.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Jim.CARPET\Local Settings\Temp\HijackThis.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\OfficeScan NT\pccntmon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINNT\system32\PDesk\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200305…meInstaller.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D1E3E61D-D493-45D2-94C7-1F13DF184EB7}: NameServer = 166.102.165.11,166.102.165.13
I'll have you know I am documenting everything, so that I can repeat these steps over and over again without making too many errors. Someday, someday… I'll convince somebody to teach me how to read that nonsense I just posted.
I learn.
Might as well finish Comp A (since this is where it all began). On this one I also added the SpyawareBlaster and the IEspyad - per your suggestion. Haven't to the other computers yet.
Logfile of HijackThis v1.98.2
Scan saved at 3:26:16 PM, on 11/24/2004
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\mgabg.exe
C:\OfficeScan NT\ntrtscan.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\OfficeScan NT\tmlisten.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\OfficeScan NT\pccntmon.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINNT\system32\PDesk\PDesk.exe
C:\PROGRA~1\PESTPA~1\PPControl.exe
C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\InterMute\SpySubtract\SpySub.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINNT\system32\wuauclt.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Jim.CARPET\Local Settings\Temp\HijackThis.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\System32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [OfficeScanNT Monitor] "C:\OfficeScan NT\pccntmon.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [Matrox Powerdesk] C:\WINNT\system32\PDesk\PDesk.exe /Autolaunch
O4 - HKLM\..\Run: [PestPatrol Control Center] C:\PROGRA~1\PESTPA~1\PPControl.exe
O4 - HKLM\..\Run: [PPMemCheck] C:\PROGRA~1\PESTPA~1\PPMemCheck.exe
O4 - HKLM\..\Run: [CookiePatrol] C:\PROGRA~1\PESTPA~1\CookiePatrol.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: SpySubtract.lnk = C:\Program Files\InterMute\SpySubtract\SpySub.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200305…meInstaller.exe
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{D1E3E61D-D493-45D2-94C7-1F13DF184EB7}: NameServer = 166.102.165.11,166.102.165.13
I'll have you know I am documenting everything, so that I can repeat these steps over and over again without making too many errors. Someday, someday… I'll convince somebody to teach me how to read that nonsense I just posted.
DumbTerminal
I think its safe to say you have a clean computer on your hands.
Now I want you to do this.
Right click on your desktop and click on New
Then click on Folder
Name it HijackThis
Then go to C:\Documents and Settings\Jim.CARPET\Local Settings\Temp
Right click on HijackThis.exe
Select "Cut"
Open the HijackThis folder you just made on your desktop
Right-click anywhere in there and select "Paste"
Lets see another log!!
Go ahead and keep it in this thread also, since I have already subscribed to it.
Unless the mods object?
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI