Jump to content

Build Theme!
  •  
  • Infected?

WE'RE SURE THAT YOU'LL LOVE US!

Hey there! :wub: Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. :D Join 93101 other members! Anybody can ask, anybody can answer. Consistently helpful members may be invited to become staff. Here's how it works. Virus cleanup? Start here -> Malware Removal Forum.

Try What the Tech -- It's free!


Photo

100% CPU and system freezes and broadband freezes


  • This topic is locked This topic is locked
9 replies to this topic

#1 SmashOne

SmashOne

    New Member

  • New Member
  • Pip
  • 5 posts

Posted 20 May 2006 - 06:03 PM

Hi All,

Desperately need some help. My pc seems to be running at 100% for no reason, then all my internet traffic stops and i cant navigate to any pages. When i disconnect my dsl and try to reconnect it doesn't go through. Nothing works till i reboot my pc. Any help would be appreciated. It seems to do this between 1 - 2 hours after i start up the pc. I'm including my Hijack This logfile below. Thanks. Oh, and i've run all the recommended programs and antivirus.



Logfile of HijackThis v1.99.1
Scan saved at 00:46:15, on 21/05/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\BullGuard Software\BullGuard\BullGuardUpdate.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\NetLimiter 2 Pro\nlsvc.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\ehome\RMSvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\SM1BG.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Digital Media Reader\shwiconem.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\program files\powerstrip\pstrip.exe
C:\Program Files\RGB Labs\GalleryPlayer\Assemblies\GalleryPlayerCM.exe
C:\Program Files\RGB Labs\GalleryPlayer\Assemblies\GalleryPlayerDM.exe
C:\Program Files\GoodWay\USBPhone4Skype\USBPhone4Skype.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\BullGuard Software\BullGuard\bullguard.exe
C:\Program Files\SEC\MagicTune3.5_Client\GammaTray.exe
C:\WINDOWS\ehome\RMSysTry.exe
C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
C:\Program Files\RALINK\Common\RaUI.exe
C:\Program Files\Dun74\VLC360\vlc.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\wuauclt.exe
C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.pcservicecall.co.uk
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SiSRaid] C:\Program Files\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PowerStrip] c:\program files\powerstrip\pstrip.exe
O4 - HKLM\..\Run: [EPSON Stylus C64 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2C1.EXE /P23 "EPSON Stylus C64 Series" /O6 "USB001" /M "Stylus C64"
O4 - HKLM\..\Run: [GalleryPlayerCM] "C:\Program Files\RGB Labs\GalleryPlayer\Assemblies\GalleryPlayerCM.exe"
O4 - HKLM\..\Run: [GalleryPlayerDM] "C:\Program Files\RGB Labs\GalleryPlayer\Assemblies\GalleryPlayerDM.exe"
O4 - HKLM\..\Run: [USBPhone4Skype] C:\Program Files\GoodWay\USBPhone4Skype\USBPhone4Skype.exe
O4 - HKLM\..\Run: [BCWipeTM Startup] "C:\Program Files\Jetico\BCWipe\BCWipeTM.exe" startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [BullGuard] "C:\Program Files\BullGuard Software\BullGuard\bullguard.exe"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Color Calibration.lnk = ?
O4 - Global Startup: Extender Resource Monitor.lnk = C:\WINDOWS\ehome\RMSysTry.exe
O4 - Global Startup: FreeventsSchedule.lnk = C:\Freevents\FreeventsSchedule.exe
O4 - Global Startup: MagicTune3.5.lnk = ?
O4 - Global Startup: MCE Video Settings.lnk = C:\Program Files\OABsoftware\MCE VideoProcAmp\MCEVideoProcAmp.exe
O4 - Global Startup: NaturalColorLoad.lnk = ?
O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe
O4 - Global Startup: VLC360.lnk = C:\Program Files\Dun74\VLC360\VLC360.bat
O8 - Extra context menu item: Download Using &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.pcservicecall.co.uk
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1143933827046
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BullGuard LiveUpdate (BGLiveSvc) - BullGuard Software - C:\Program Files\BullGuard Software\BullGuard\BullGuardUpdate.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Program Files\NetLimiter 2 Pro\nlsvc.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: PMounter - Unknown owner - C:\WINDOWS\system32\PMounter.exe

    Advertisements

Register to Remove


#2 Siggyx

Siggyx

    SuperHelper

  • Authentic Member
  • PipPipPipPipPipPip
  • 6,776 posts

Posted 21 May 2006 - 08:20 AM

Please download the trial version of Ewido Security Suite here:

http://www.ewido.net/en/

Install it, and update the definitions to the newest files.

Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.

Then please run Ewido, and run a full scan. Save the logfile from the scan.

Restart your computer in normal mode and please post a new HijackThis log, as well as the log from the Ewido scan.

#3 SmashOne

SmashOne

    New Member

  • New Member
  • Pip
  • 5 posts

Posted 21 May 2006 - 04:54 PM

Hey Siggyx,

thanks for the reply. Did exactly as you said and the ewido and hijackthis logs are pasted below. Didn't fix the issues found in the scan as i wanted to see what you thought first. Thanks.




---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------

+ Created on: 23:14:31, 21/05/2006
+ Report-Checksum: ABA1391

+ Scan result:

C:\Documents and Settings\Admin\Cookies\admin@112.2o7[1].txt -> TrackingCookie.2o7 : Ignored
C:\Documents and Settings\Admin\Cookies\admin@com[1].txt -> TrackingCookie.Com : Ignored
C:\Documents and Settings\Admin\Cookies\admin@e-2dj6wglougazagq.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Ignored
C:\Documents and Settings\Admin\Cookies\admin@microsofteup.112.2o7[1].txt -> TrackingCookie.2o7 : Ignored
C:\Documents and Settings\Admin\Cookies\admin@microsoftuk.122.2o7[1].txt -> TrackingCookie.2o7 : Ignored
C:\Documents and Settings\Admin\Cookies\admin@tacoda[1].txt -> TrackingCookie.Tacoda : Ignored
:mozilla.8:C:\Documents and Settings\Admin 2\Application Data\Mozilla\Firefox\Profiles\yw2oezl6.default\cookies.txt -> TrackingCookie.2o7 : Ignored
:mozilla.17:C:\Documents and Settings\Admin 2\Application Data\Mozilla\Firefox\Profiles\yw2oezl6.default\cookies.txt -> TrackingCookie.Yieldmanager : Ignored
:mozilla.18:C:\Documents and Settings\Admin 2\Application Data\Mozilla\Firefox\Profiles\yw2oezl6.default\cookies.txt -> TrackingCookie.Yieldmanager : Ignored
:mozilla.19:C:\Documents and Settings\Admin 2\Application Data\Mozilla\Firefox\Profiles\yw2oezl6.default\cookies.txt -> TrackingCookie.Clickhype : Ignored
:mozilla.21:C:\Documents and Settings\Admin 2\Application Data\Mozilla\Firefox\Profiles\yw2oezl6.default\cookies.txt -> TrackingCookie.Euroclick : Ignored
:mozilla.22:C:\Documents and Settings\Admin 2\Application Data\Mozilla\Firefox\Profiles\yw2oezl6.default\cookies.txt -> TrackingCookie.Euroclick : Ignored
:mozilla.23:C:\Documents and Settings\Admin 2\Application Data\Mozilla\Firefox\Profiles\yw2oezl6.default\cookies.txt -> TrackingCookie.Euroclick : Ignored
:mozilla.64:C:\Documents and Settings\Admin 2\Application Data\Mozilla\Firefox\Profiles\yw2oezl6.default\cookies.txt -> TrackingCookie.Com : Ignored
:mozilla.69:C:\Documents and Settings\Admin 2\Application Data\Mozilla\Firefox\Profiles\yw2oezl6.default\cookies.txt -> TrackingCookie.Esomniture : Ignored
:mozilla.70:C:\Documents and Settings\Admin 2\Application Data\Mozilla\Firefox\Profiles\yw2oezl6.default\cookies.txt -> TrackingCookie.Esomniture : Ignored
:mozilla.71:C:\Documents and Settings\Admin 2\Application Data\Mozilla\Firefox\Profiles\yw2oezl6.default\cookies.txt -> TrackingCookie.Esomniture : Ignored
:mozilla.72:C:\Documents and Settings\Admin 2\Application Data\Mozilla\Firefox\Profiles\yw2oezl6.default\cookies.txt -> TrackingCookie.Esomniture : Ignored
:mozilla.136:C:\Documents and Settings\Admin 2\Application Data\Mozilla\Firefox\Profiles\yw2oezl6.default\cookies.txt -> TrackingCookie.2o7 : Ignored
:mozilla.143:C:\Documents and Settings\Admin 2\Application Data\Mozilla\Firefox\Profiles\yw2oezl6.default\cookies.txt -> TrackingCookie.2o7 : Ignored
:mozilla.170:C:\Documents and Settings\Admin 2\Application Data\Mozilla\Firefox\Profiles\yw2oezl6.default\cookies.txt -> TrackingCookie.Overture : Ignored
:mozilla.176:C:\Documents and Settings\Admin 2\Application Data\Mozilla\Firefox\Profiles\yw2oezl6.default\cookies.txt -> TrackingCookie.Questionmarket : Ignored
:mozilla.199:C:\Documents and Settings\Admin 2\Application Data\Mozilla\Firefox\Profiles\yw2oezl6.default\cookies.txt -> TrackingCookie.2o7 : Ignored
:mozilla.204:C:\Documents and Settings\Admin 2\Application Data\Mozilla\Firefox\Profiles\yw2oezl6.default\cookies.txt -> TrackingCookie.Tacoda : Ignored
:mozilla.205:C:\Documents and Settings\Admin 2\Application Data\Mozilla\Firefox\Profiles\yw2oezl6.default\cookies.txt -> TrackingCookie.Tacoda : Ignored
:mozilla.206:C:\Documents and Settings\Admin 2\Application Data\Mozilla\Firefox\Profiles\yw2oezl6.default\cookies.txt -> TrackingCookie.Tribalfusion : Ignored
:mozilla.248:C:\Documents and Settings\Admin 2\Application Data\Mozilla\Firefox\Profiles\yw2oezl6.default\cookies.txt -> TrackingCookie.Googleadservices : Ignored
:mozilla.249:C:\Documents and Settings\Admin 2\Application Data\Mozilla\Firefox\Profiles\yw2oezl6.default\cookies.txt -> TrackingCookie.Googleadservices : Ignored
C:\Documents and Settings\Admin 2\Cookies\admin 2@112.2o7[2].txt -> TrackingCookie.2o7 : Ignored
C:\Documents and Settings\Admin 2\Cookies\admin 2@247realmedia[2].txt -> TrackingCookie.247realmedia : Ignored
C:\Documents and Settings\Admin 2\Cookies\admin 2@2o7[1].txt -> TrackingCookie.2o7 : Ignored
C:\Documents and Settings\Admin 2\Cookies\admin 2@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Ignored
C:\Documents and Settings\Admin 2\Cookies\admin 2@ad1.clickhype[2].txt -> TrackingCookie.Clickhype : Ignored
C:\Documents and Settings\Admin 2\Cookies\admin 2@adrevolver[2].txt -> TrackingCookie.Adrevolver : Ignored
C:\Documents and Settings\Admin 2\Cookies\admin 2@ads.addynamix[1].txt -> TrackingCookie.Addynamix : Ignored
C:\Documents and Settings\Admin 2\Cookies\admin 2@ads1.revenue[1].txt -> TrackingCookie.Revenue : Ignored
C:\Documents and Settings\Admin 2\Cookies\admin 2@adtech[2].txt -> TrackingCookie.Adtech : Ignored
C:\Documents and Settings\Admin 2\Cookies\admin 2@advertising[1].txt -> TrackingCookie.Advertising : Ignored
C:\Documents and Settings\Admin 2\Cookies\admin 2@as-us.falkag[1].txt -> TrackingCookie.Falkag : Ignored
C:\Documents and Settings\Admin 2\Cookies\admin 2@atdmt[2].txt -> TrackingCookie.Atdmt : Ignored
C:\Documents and Settings\Admin 2\Cookies\admin 2@bluestreak[2].txt -> TrackingCookie.Bluestreak : Ignored
C:\Documents and Settings\Admin 2\Cookies\admin 2@bs.serving-sys[1].txt -> TrackingCookie.Serving-sys : Ignored
C:\Documents and Settings\Admin 2\Cookies\admin 2@burstnet[2].txt -> TrackingCookie.Burstnet : Ignored
C:\Documents and Settings\Admin 2\Cookies\admin 2@casalemedia[2].txt -> TrackingCookie.Casalemedia : Ignored
C:\Documents and Settings\Admin 2\Cookies\admin 2@com[1].txt -> TrackingCookie.Com : Ignored
C:\Documents and Settings\Admin 2\Cookies\admin 2@cz3.clickzs[2].txt -> TrackingCookie.Clickzs : Ignored
C:\Documents and Settings\Admin 2\Cookies\admin 2@cz7.clickzs[2].txt -> TrackingCookie.Clickzs : Ignored
C:\Documents and Settings\Admin 2\Cookies\admin 2@data2.perf.overture[2].txt -> TrackingCookie.Overture : Ignored
C:\Documents and Settings\Admin 2\Cookies\admin 2@doubleclick[1].txt -> TrackingCookie.Doubleclick : Ignored
C:\Documents and Settings\Admin 2\Cookies\admin 2@login.tracking101[2].txt -> TrackingCookie.Tracking101 : Ignored
C:\Documents and Settings\Admin 2\Cookies\admin 2@microsofteup.112.2o7[1].txt -> TrackingCookie.2o7 : Ignored
C:\Documents and Settings\Admin 2\Cookies\admin 2@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Ignored
C:\Documents and Settings\Admin 2\Cookies\admin 2@perf.overture[1].txt -> TrackingCookie.Overture : Ignored
C:\Documents and Settings\Admin 2\Cookies\admin 2@qksrv[1].txt -> TrackingCookie.Qksrv : Ignored
C:\Documents and Settings\Admin 2\Cookies\admin 2@questionmarket[1].txt -> TrackingCookie.Questionmarket : Ignored
C:\Documents and Settings\Admin 2\Cookies\admin 2@reduxads.valuead[2].txt -> TrackingCookie.Valuead : Ignored
C:\Documents and Settings\Admin 2\Cookies\admin 2@revenue[2].txt -> TrackingCookie.Revenue : Ignored
C:\Documents and Settings\Admin 2\Cookies\admin 2@rotator.adjuggler[1].txt -> TrackingCookie.Adjuggler : Ignored
C:\Documents and Settings\Admin 2\Cookies\admin 2@serving-sys[2].txt -> TrackingCookie.Serving-sys : Ignored
C:\Documents and Settings\Admin 2\Cookies\admin 2@statcounter[1].txt -> TrackingCookie.Statcounter : Ignored
C:\Documents and Settings\Admin 2\Cookies\admin 2@stats1.reliablestats[2].txt -> TrackingCookie.Reliablestats : Ignored
C:\Documents and Settings\Admin 2\Cookies\admin 2@tacoda[1].txt -> TrackingCookie.Tacoda : Ignored
C:\Documents and Settings\Admin 2\Cookies\admin 2@trafic[1].txt -> TrackingCookie.Trafic : Ignored
C:\Documents and Settings\Admin 2\Cookies\admin 2@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Ignored
C:\Documents and Settings\Admin 2\Cookies\admin 2@valueclick[2].txt -> TrackingCookie.Valueclick : Ignored
C:\Documents and Settings\Admin 2\Cookies\admin 2@www.myaffiliateprogram[2].txt -> TrackingCookie.Myaffiliateprogram : Ignored
C:\Documents and Settings\Admin 2\Cookies\admin 2@zedo[1].txt -> TrackingCookie.Zedo : Ignored
C:\Documents and Settings\MCX1\Cookies\admin 2@microsofteup.112.2o7[1].txt -> TrackingCookie.2o7 : Ignored


::Report End








Logfile of HijackThis v1.99.1
Scan saved at 23:34:57, on 21/05/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\BullGuard Software\BullGuard\BullGuardUpdate.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\NetLimiter 2 Pro\nlsvc.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\ehome\RMSvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\SM1BG.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Digital Media Reader\shwiconem.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\program files\powerstrip\pstrip.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\RGB Labs\GalleryPlayer\Assemblies\GalleryPlayerCM.exe
C:\Program Files\RGB Labs\GalleryPlayer\Assemblies\GalleryPlayerDM.exe
C:\Program Files\GoodWay\USBPhone4Skype\USBPhone4Skype.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\PeerGuardian2\pg2.exe
C:\Program Files\BullGuard Software\BullGuard\bullguard.exe
C:\Program Files\SEC\MagicTune3.5_Client\GammaTray.exe
C:\WINDOWS\ehome\RMSysTry.exe
C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
C:\Program Files\RALINK\Common\RaUI.exe
C:\Program Files\Dun74\VLC360\vlc.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Documents and Settings\Admin 2\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.pcservicecall.co.uk
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SiSRaid] C:\Program Files\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PowerStrip] c:\program files\powerstrip\pstrip.exe
O4 - HKLM\..\Run: [EPSON Stylus C64 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2C1.EXE /P23 "EPSON Stylus C64 Series" /O6 "USB001" /M "Stylus C64"
O4 - HKLM\..\Run: [GalleryPlayerCM] "C:\Program Files\RGB Labs\GalleryPlayer\Assemblies\GalleryPlayerCM.exe"
O4 - HKLM\..\Run: [GalleryPlayerDM] "C:\Program Files\RGB Labs\GalleryPlayer\Assemblies\GalleryPlayerDM.exe"
O4 - HKLM\..\Run: [USBPhone4Skype] C:\Program Files\GoodWay\USBPhone4Skype\USBPhone4Skype.exe
O4 - HKLM\..\Run: [BCWipeTM Startup] "C:\Program Files\Jetico\BCWipe\BCWipeTM.exe" startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [BullGuard] "C:\Program Files\BullGuard Software\BullGuard\bullguard.exe"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Color Calibration.lnk = ?
O4 - Global Startup: Extender Resource Monitor.lnk = C:\WINDOWS\ehome\RMSysTry.exe
O4 - Global Startup: FreeventsSchedule.lnk = C:\Freevents\FreeventsSchedule.exe
O4 - Global Startup: MagicTune3.5.lnk = ?
O4 - Global Startup: MCE Video Settings.lnk = C:\Program Files\OABsoftware\MCE VideoProcAmp\MCEVideoProcAmp.exe
O4 - Global Startup: NaturalColorLoad.lnk = ?
O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe
O4 - Global Startup: VLC360.lnk = C:\Program Files\Dun74\VLC360\VLC360.bat
O8 - Extra context menu item: Download Using &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.pcservicecall.co.uk
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1143933827046
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BullGuard LiveUpdate (BGLiveSvc) - BullGuard Software - C:\Program Files\BullGuard Software\BullGuard\BullGuardUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Program Files\NetLimiter 2 Pro\nlsvc.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: PMounter - Unknown owner - C:\WINDOWS\system32\PMounter.exe

#4 Siggyx

Siggyx

    SuperHelper

  • Authentic Member
  • PipPipPipPipPipPip
  • 6,776 posts

Posted 21 May 2006 - 07:19 PM

Run eiwdo again allowing it to fix what it finds this time.

NEXT

Please do an online scan with Kaspersky Online Scanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.
  • The program will launch and then start to download the latest definition files.
  • Once the scanner is installed and the definitions downloaded, click Next.
  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
    • Scan using the following Anti-Virus database:
      • Extended (If available otherwise Standard)
    • Scan Options:
      • Scan Archives
      • Scan Mail Bases
  • Click OK
  • Now under select a target to scan select My Computer
  • The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button:
  • Save the file to your desktop.
  • Copy and paste that information in your next post as well as a bew hijackthis log please.


#5 SmashOne

SmashOne

    New Member

  • New Member
  • Pip
  • 5 posts

Posted 22 May 2006 - 07:01 AM

Hi,

Did as you said and the logs are listed below. Thanks again.


-------------------------------------------------------------------------------
KASPERSKY ON-LINE SCANNER REPORT
Monday, May 22, 2006 1:39:51 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky On-line Scanner version: 5.0.78.0
Kaspersky Anti-Virus database last update: 22/05/2006
Kaspersky Anti-Virus database records: 195550
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\
E:\
F:\
G:\
H:\
I:\

Scan Statistics:
Total number of scanned objects: 88453
Number of viruses found: 1
Number of infected objects: 7
Number of suspicious objects: 0
Duration of the scan process: 00:54:03

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\Admin 2\Desktop\New Folder\bitdefender_isecurity_v9.exe/bdis.msi/bdprof.cab.AE3C3951_7A91_4185_B6E7_BA9F78BFE365/regspy.sys Infected: not-a-virus:Monitor.Win32.PCAcme.61 skipped
C:\Documents and Settings\Admin 2\Desktop\New Folder\bitdefender_isecurity_v9.exe/bdis.msi/bdprof.cab.AE3C3951_7A91_4185_B6E7_BA9F78BFE365 Infected: not-a-virus:Monitor.Win32.PCAcme.61 skipped
C:\Documents and Settings\Admin 2\Desktop\New Folder\bitdefender_isecurity_v9.exe/bdis.msi Infected: not-a-virus:Monitor.Win32.PCAcme.61 skipped
C:\Documents and Settings\Admin 2\Desktop\New Folder\bitdefender_isecurity_v9.exe CAB: infected - 3 skipped
C:\Program Files\Common Files\Softwin\Setup Information\{BEC78BCE-1500-4433-97DD-1DD8D239DB80}\bdprof.msi/bdprof.cab.AE3C3951_7A91_4185_B6E7_BA9F78BFE365/regspy.sys Infected: not-a-virus:Monitor.Win32.PCAcme.61 skipped
C:\Program Files\Common Files\Softwin\Setup Information\{BEC78BCE-1500-4433-97DD-1DD8D239DB80}\bdprof.msi/bdprof.cab.AE3C3951_7A91_4185_B6E7_BA9F78BFE365 Infected: not-a-virus:Monitor.Win32.PCAcme.61 skipped
C:\Program Files\Common Files\Softwin\Setup Information\{BEC78BCE-1500-4433-97DD-1DD8D239DB80}\bdprof.msi Embedded: infected - 2 skipped

Scan process completed.






Logfile of HijackThis v1.99.1
Scan saved at 13:54:12, on 22/05/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\BullGuard Software\BullGuard\BullGuardUpdate.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\NetLimiter 2 Pro\nlsvc.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\ehome\RMSvc.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\SM1BG.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Digital Media Reader\shwiconem.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\program files\powerstrip\pstrip.exe
C:\Program Files\RGB Labs\GalleryPlayer\Assemblies\GalleryPlayerCM.exe
C:\Program Files\RGB Labs\GalleryPlayer\Assemblies\GalleryPlayerDM.exe
C:\Program Files\GoodWay\USBPhone4Skype\USBPhone4Skype.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\PeerGuardian2\pg2.exe
C:\Program Files\BullGuard Software\BullGuard\bullguard.exe
C:\Program Files\SEC\MagicTune3.5_Client\GammaTray.exe
C:\WINDOWS\ehome\RMSysTry.exe
C:\WINDOWS\system32\dllhost.exe
C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
C:\Program Files\RALINK\Common\RaUI.exe
C:\Program Files\Dun74\VLC360\vlc.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Admin 2\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.pcservicecall.co.uk
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SiSRaid] C:\Program Files\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PowerStrip] c:\program files\powerstrip\pstrip.exe
O4 - HKLM\..\Run: [EPSON Stylus C64 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2C1.EXE /P23 "EPSON Stylus C64 Series" /O6 "USB001" /M "Stylus C64"
O4 - HKLM\..\Run: [GalleryPlayerCM] "C:\Program Files\RGB Labs\GalleryPlayer\Assemblies\GalleryPlayerCM.exe"
O4 - HKLM\..\Run: [GalleryPlayerDM] "C:\Program Files\RGB Labs\GalleryPlayer\Assemblies\GalleryPlayerDM.exe"
O4 - HKLM\..\Run: [USBPhone4Skype] C:\Program Files\GoodWay\USBPhone4Skype\USBPhone4Skype.exe
O4 - HKLM\..\Run: [BCWipeTM Startup] "C:\Program Files\Jetico\BCWipe\BCWipeTM.exe" startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [BullGuard] "C:\Program Files\BullGuard Software\BullGuard\bullguard.exe"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Color Calibration.lnk = ?
O4 - Global Startup: Extender Resource Monitor.lnk = C:\WINDOWS\ehome\RMSysTry.exe
O4 - Global Startup: FreeventsSchedule.lnk = C:\Freevents\FreeventsSchedule.exe
O4 - Global Startup: MagicTune3.5.lnk = ?
O4 - Global Startup: MCE Video Settings.lnk = C:\Program Files\OABsoftware\MCE VideoProcAmp\MCEVideoProcAmp.exe
O4 - Global Startup: NaturalColorLoad.lnk = ?
O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe
O4 - Global Startup: VLC360.lnk = C:\Program Files\Dun74\VLC360\VLC360.bat
O8 - Extra context menu item: Download Using &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.pcservicecall.co.uk
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1143933827046
O17 - HKLM\System\CCS\Services\Tcpip\..\{45E3923B-0779-44B0-AC2D-FCFEA6387771}: NameServer = 83.146.21.5 212.158.248.6
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BullGuard LiveUpdate (BGLiveSvc) - BullGuard Software - C:\Program Files\BullGuard Software\BullGuard\BullGuardUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Program Files\NetLimiter 2 Pro\nlsvc.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: PMounter - Unknown owner - C:\WINDOWS\system32\PMounter.exe

#6 Siggyx

Siggyx

    SuperHelper

  • Authentic Member
  • PipPipPipPipPipPip
  • 6,776 posts

Posted 22 May 2006 - 07:56 AM

Click here to run ActiveScan.
  • Once you are on the Panda site click the Scan your PC button
  • A new window will open...click the Check Now button
  • Enter your Country
  • Enter your State/Province
  • Enter your e-mail address and click send
  • Select either Home User or Company
  • Click the big Scan Now button
  • If it wants to install an ActiveX component allow it
  • It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
  • When download is complete, click on My Computer to start the scan
  • When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.
Paste the contents of the Panda scan report along with a new HijackThis Log in your next reply.

#7 SmashOne

SmashOne

    New Member

  • New Member
  • Pip
  • 5 posts

Posted 22 May 2006 - 02:13 PM

Hey Siggyx,

Ran the panda scan and then deleted the cookies it found manually. I then ran hijackthis again and both logs are posted below.



Incident Status Location

Spyware:Cookie/Hbmediapro Not disinfected C:\Documents and Settings\Admin 2\Application Data\Mozilla\Firefox\Profiles\yw2oezl6.default\cookies.txt[.adopt.hbmediapro.com/]
Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\Admin 2\Application Data\Mozilla\Firefox\Profiles\yw2oezl6.default\cookies.txt[.adultfriendfinder.com/]
Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Admin 2\Application Data\Mozilla\Firefox\Profiles\yw2oezl6.default\cookies.txt[.atwola.com/]
Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Admin 2\Cookies\admin 2@adrevolver[1].txt
Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Admin 2\Cookies\admin 2@ads.pointroll[1].txt
Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Admin 2\Cookies\admin 2@advertising[2].txt
Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Admin 2\Cookies\admin 2@apmebf[1].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Admin 2\Cookies\admin 2@atdmt[1].txt
Spyware:Cookie/did-it Not disinfected C:\Documents and Settings\Admin 2\Cookies\admin 2@did-it[2].txt
Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Admin 2\Cookies\admin 2@doubleclick[1].txt
Spyware:Cookie/Screensavers Not disinfected C:\Documents and Settings\Admin 2\Cookies\admin 2@i.screensavers[1].txt
Spyware:Cookie/Maxserving Not disinfected C:\Documents and Settings\Admin 2\Cookies\admin 2@maxserving[1].txt
Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Admin 2\Cookies\admin 2@mediaplex[1].txt
Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Admin 2\Cookies\admin 2@realmedia[1].txt
Spyware:Cookie/Searchportal Not disinfected C:\Documents and Settings\Admin 2\Cookies\admin 2@searchportal.information[1].txt
Spyware:Cookie/Versiontracker Not disinfected C:\Documents and Settings\Admin 2\Cookies\admin 2@versiontracker[2].txt
Spyware:Cookie/Xmts Not disinfected C:\Documents and Settings\Admin 2\Cookies\admin 2@xmts[2].txt





Logfile of HijackThis v1.99.1
Scan saved at 20:33:00, on 22/05/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\BullGuard Software\BullGuard\BullGuardUpdate.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\NetLimiter 2 Pro\nlsvc.exe
C:\WINDOWS\system32\oodag.exe
C:\WINDOWS\ehome\RMSvc.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\SM1BG.EXE
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Digital Media Reader\shwiconem.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe
C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\program files\powerstrip\pstrip.exe
C:\Program Files\RGB Labs\GalleryPlayer\Assemblies\GalleryPlayerCM.exe
C:\Program Files\RGB Labs\GalleryPlayer\Assemblies\GalleryPlayerDM.exe
C:\Program Files\GoodWay\USBPhone4Skype\USBPhone4Skype.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\PeerGuardian2\pg2.exe
C:\Program Files\BullGuard Software\BullGuard\bullguard.exe
C:\Program Files\SEC\MagicTune3.5_Client\GammaTray.exe
C:\WINDOWS\ehome\RMSysTry.exe
C:\Program Files\SEC\Natural Color\NaturalColorLoad.exe
C:\Program Files\RALINK\Common\RaUI.exe
C:\Program Files\Dun74\VLC360\vlc.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Documents and Settings\Admin 2\Desktop\HijackThis.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\dwwin.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.pcservicecall.co.uk
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SM1BG] C:\WINDOWS\SM1BG.EXE
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SiSRaid] C:\Program Files\Silicon Integrated Systems\SiSRaidPackage\SRaid.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [PowerStrip] c:\program files\powerstrip\pstrip.exe
O4 - HKLM\..\Run: [EPSON Stylus C64 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_S4I2C1.EXE /P23 "EPSON Stylus C64 Series" /O6 "USB001" /M "Stylus C64"
O4 - HKLM\..\Run: [GalleryPlayerCM] "C:\Program Files\RGB Labs\GalleryPlayer\Assemblies\GalleryPlayerCM.exe"
O4 - HKLM\..\Run: [GalleryPlayerDM] "C:\Program Files\RGB Labs\GalleryPlayer\Assemblies\GalleryPlayerDM.exe"
O4 - HKLM\..\Run: [USBPhone4Skype] C:\Program Files\GoodWay\USBPhone4Skype\USBPhone4Skype.exe
O4 - HKLM\..\Run: [BCWipeTM Startup] "C:\Program Files\Jetico\BCWipe\BCWipeTM.exe" startup
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exe
O4 - HKCU\..\Run: [BullGuard] "C:\Program Files\BullGuard Software\BullGuard\bullguard.exe"
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Color Calibration.lnk = ?
O4 - Global Startup: Extender Resource Monitor.lnk = C:\WINDOWS\ehome\RMSysTry.exe
O4 - Global Startup: FreeventsSchedule.lnk = C:\Freevents\FreeventsSchedule.exe
O4 - Global Startup: MagicTune3.5.lnk = ?
O4 - Global Startup: MCE Video Settings.lnk = C:\Program Files\OABsoftware\MCE VideoProcAmp\MCEVideoProcAmp.exe
O4 - Global Startup: NaturalColorLoad.lnk = ?
O4 - Global Startup: Ralink Wireless Utility.lnk = C:\Program Files\RALINK\Common\RaUI.exe
O4 - Global Startup: VLC360.lnk = C:\Program Files\Dun74\VLC360\VLC360.bat
O8 - Extra context menu item: Download Using &BitSpirit - C:\Program Files\BitSpirit\bsurl.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.pcservicecall.co.uk
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1143933827046
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{45E3923B-0779-44B0-AC2D-FCFEA6387771}: NameServer = 83.146.21.5 212.158.248.6
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: BullGuard LiveUpdate (BGLiveSvc) - BullGuard Software - C:\Program Files\BullGuard Software\BullGuard\BullGuardUpdate.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Program Files\NetLimiter 2 Pro\nlsvc.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: PMounter - Unknown owner - C:\WINDOWS\system32\PMounter.exe

#8 Siggyx

Siggyx

    SuperHelper

  • Authentic Member
  • PipPipPipPipPipPip
  • 6,776 posts

Posted 22 May 2006 - 02:16 PM

Download ATF Cleaner:
http://www.atribune....tent/view/19/2/
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

When done a prompt appears informing of such.

(If you use FireFox or the Opera browser
To keep saved passwords, click No at the prompt.)

Then reboot. How is it running after the reboot?

#9 SmashOne

SmashOne

    New Member

  • New Member
  • Pip
  • 5 posts

Posted 23 May 2006 - 11:14 AM

Hey Siggyx, Decided to run my system for a while to make sure all was well and it all seems good. Thanks a lot. I'll be running all those scans and programs frequently. Thanks :wavey:

#10 Siggyx

Siggyx

    SuperHelper

  • Authentic Member
  • PipPipPipPipPipPip
  • 6,776 posts

Posted 23 May 2006 - 11:18 AM

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoy...showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Related Topics



0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users