What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Malware removal

1 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Hi Folks,

my problem seems to be, that i downloaded a program from shareaza which seem to have injected a trojan in my system. this trojan has installed a program , which runs as an application named Setup.
i managed after a reading a forum, to re start my taskmgr.exe after i created a copy of it … that way i could see the 'setup' application in the taskmgr.
this setup kept the original taskmgr (as well as regedit) to not being startable, because they held some file busy, which taskmgr needed , at least thats what the error message said.
after stopping this setup app, everythings fine again , also shareaza doesnt restart itself constantly, after being stopped.

now after a reboot the thing comes up again , naturally, and i wasnt unable to stop it yet… therefore i am posting my hijackthis output here …

so here it goes… :

Logfile of HijackThis v1.99.1
Scan saved at 20:29:04, on 16.07.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
E:\WINDXPN\System32\smss.exe
E:\WINDXPN\system32\winlogon.exe
E:\WINDXPN\system32\services.exe
E:\WINDXPN\system32\lsass.exe
E:\WINDXPN\system32\Ati2evxx.exe
E:\WINDXPN\system32\svchost.exe
E:\WINDXPN\System32\svchost.exe
E:\WINDXPN\system32\spoolsv.exe
E:\Programme\AntiVir PersonalEdition Classic\sched.exe
E:\Programme\AntiVir PersonalEdition Classic\avguard.exe
E:\Programme\Analog Devices\SoundMAX\SMAgent.exe
E:\WINDXPN\system32\svchost.exe
E:\WINDXPN\System32\TPHDEXLG.EXE
E:\WINDXPN\system32\Ati2evxx.exe
E:\WINDXPN\Explorer.EXE
E:\Programme\Analog Devices\SoundMAX\SMax4PNP.exe
E:\Programme\Analog Devices\SoundMAX\SMax4.exe
E:\WINDXPN\system32\TpShocks.exe
E:\WINDXPN\AGRSMMSG.exe
E:\Programme\Java\jre1.5.0_02\bin\jusched.exe
E:\Programme\D-Tools\daemon.exe
E:\Programme\Elaborate Bytes\CloneCD\CloneCDTray.exe
E:\WINDXPN\system32\rundll32.exe
E:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
E:\Programme\iTunes\iTunesHelper.exe
E:\Programme\QuickTime\qttask.exe
E:\Programme\iPod\bin\iPodService.exe
E:\WINDXPN\system32\ctfmon.exe
E:\PROGRA~1\COOLSPOT\PERSON~1\PID.EXE
E:\Programme\Microsoft Location Finder\LocationFinder.exe
E:\Programme\Google\Google Desktop Search\GoogleDesktop.exe
E:\Programme\The Weather Channel FW\Desktop Weather\DesktopWeather.exe
E:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
E:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe
E:\Programme\Multidesk\MultiDesk.exe
E:\WINDXPN\system32\wuauclt.exe
E:\Programme\Google\Google Desktop Search\GoogleDesktopIndex.exe
E:\Programme\Google\Google Desktop Search\GoogleDesktopDisplay.exe
E:\Programme\Google\Google Desktop Search\GoogleDesktopCrawl.exe
E:\WINDXPN\system32\wuauclt.exe
E:\Programme\MSN Messenger\msnmsgr.exe
E:\Dokumente und Einstellungen\*****\Desktop\HijackThis.exe

R3 - URLSearchHook: _URLHandler - {7FF23285-DBBC-49B6-818C-34AC459D5BB3} - E:\WINDXPN\system32\pidd.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - E:\Programme\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - E:\Programme\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - E:\Programme\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - e:\programme\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - E:\Programme\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\programme\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SoundMAXPnP] E:\Programme\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "E:\Programme\Analog Devices\SoundMAX\SMax4.exe" /tray
O4 - HKLM\..\Run: [ATIPTA] E:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] E:\Programme\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\Programme\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDXPN\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "E:\Programme\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [CloneCDTray] "E:\Programme\Elaborate Bytes\CloneCD\CloneCDTray.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [avgnt] "E:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [iTunesHelper] "E:\Programme\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "E:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDXPN\system32\ctfmon.exe
O4 - HKCU\..\Run: [Personal ID] E:\PROGRA~1\COOLSPOT\PERSON~1\PID.EXE
O4 - HKCU\..\Run: [Microsoft Location Finder] "E:\Programme\Microsoft Location Finder\LocationFinder.exe"
O4 - HKCU\..\Run: [Google Desktop Search] "E:\Programme\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [DW4] "E:\Programme\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
O4 - Startup: Multidesk Desktop Manager.lnk = E:\Programme\Multidesk\MultiDesk.exe
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = E:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = E:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe
O4 - Global Startup: svchost.exe
O8 - Extra context menu item: &Google Search - res://e:\programme\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://e:\programme\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: &Yahoo! Search - file:///E:\Programme\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://e:\programme\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://e:\programme\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://e:\programme\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://e:\programme\google\GoogleToolbar2.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///E:\Programme\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///E:\Programme\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///E:\Programme\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - E:\Programme\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Programme\Messenger\msmsgs.exe
O16 - DPF: {0F9B4CA4-A30F-480A-841D-69B45C50A8F8} (SekureL0gin.SekureKontrol) - http://secure2.comned.com/signuptemplates/AktiveSekurity.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - E:\Programme\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comned.com/signuptemplates/…login-devel.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse…pdownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "E:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O20 - AppInit_DLLs: pushow12.dll
O23 - Service: ACU Configuration Service (ACS) - Unknown owner - E:\WINDXPN\system32\acs.exe
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - E:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - E:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - E:\WINDXPN\system32\Ati2evxx.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - E:\Programme\iPod\bin\iPodService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - E:\Programme\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: IBM HDD APS Logging Service (TPHDEXLGSVC) - IBM Corporation - E:\WINDXPN\System32\TPHDEXLG.EXE



Many thanks, Mickey
Post #2
Welcome to the forum :wavey:

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

R3 - URLSearchHook: _URLHandler - {7FF23285-DBBC-49B6-818C-34AC459D5BB3} - E:\WINDXPN\system32\pidd.dll

O4 - Global Startup: svchost.exe

Then click "Fix checked" and close Hijack This!.

Reboot in "safe" mode.

Delete all of the following noted (in red) file(s)/FOLDER(s) you can find:

E:\Documents and Settings\All Users\Start Menu\Programs\Startup\svchost.exe <— file

DELETE THIS SVCHOST.EXE IN THIS FOLDER ONLY!!!

Not sure what that path translates to, in your language….
:scratch:

I hope you can translate…

Some malware files may be "hidden".
Be sure to show hidden files when looking for these file(s) and/or folder(s).

Reboot in normal mode and "copy/paste" a new HijackThis! log file into this thread. :)

Also please do this:

Please go to these free online file checkers:

Kaspersky Online File Scanner

Jotti Online File Scanner

VirusTotal Online File Scanner

And submit this file for a virus scan:

pushow12.dll

Most likely in your E:\WINDXPN\system32 folder.

Let me know the results.

You don't have to try all three. If it comes back "infected", you can stop there.
:)
Post #3
Hi Micah,

thanks for your help, think i got this restarting thing stopped.

i checked the 2 things you mentioned :
R3 - URLSearchHook: _URLHandler - {7FF23285-DBBC-49B6-818C-34AC459D5BB3} - E:\WINDXPN\system32\pidd.dll

O4 - Global Startup: svchost.exe
and let hijackthis fix them .

then i rebooted in safe mode, and tried to find this svchost.exe under the path you mentioned :-)
i could translate pretty good , i guess … however … it wasnt there…
as far as i know, the dos program attrib should even show hidden things so i used this to check .
here's the output (piped the output of : attrib svc* /s to a file ) :
E:\>type svc.lst
A E:\Programme\Microsoft Office\OFFICE11\INFFORMS\1031\SVCREQ.XSN
A E:\WINDXPN\inf\svcpack.inf
A E:\WINDXPN\inf\SVCPACK.PNF
A E:\WINDXPN\Prefetch\SVCHOST.EXE-134F32CE.pf
A E:\WINDXPN\system32\svchost.exe
A E:\WINDXPN\system32\svcpack.dll
A E:\svc.lst
so the only one is the original in system32, and this *.pf file … in the prefetch folder …
this is probably a relict of the install of it…
but .. the problem seems to be gone.
so i figured to start in normal mode again , and reran hijackthis , here's the output :

Logfile of HijackThis v1.99.1
Scan saved at 04:43:03, on 17.07.2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
E:\WINDXPN\System32\smss.exe
E:\WINDXPN\system32\winlogon.exe
E:\WINDXPN\system32\services.exe
E:\WINDXPN\system32\lsass.exe
E:\WINDXPN\system32\Ati2evxx.exe
E:\WINDXPN\system32\svchost.exe
E:\WINDXPN\System32\svchost.exe
E:\WINDXPN\system32\spoolsv.exe
E:\Programme\AntiVir PersonalEdition Classic\sched.exe
E:\Programme\AntiVir PersonalEdition Classic\avguard.exe
E:\Programme\Analog Devices\SoundMAX\SMAgent.exe
E:\WINDXPN\system32\svchost.exe
E:\WINDXPN\system32\Ati2evxx.exe
E:\WINDXPN\Explorer.EXE
E:\WINDXPN\System32\TPHDEXLG.EXE
E:\Programme\Analog Devices\SoundMAX\SMax4PNP.exe
E:\Programme\Analog Devices\SoundMAX\SMax4.exe
E:\WINDXPN\system32\TpShocks.exe
E:\WINDXPN\AGRSMMSG.exe
E:\Programme\Java\jre1.5.0_02\bin\jusched.exe
E:\Programme\D-Tools\daemon.exe
E:\Programme\Elaborate Bytes\CloneCD\CloneCDTray.exe
E:\WINDXPN\system32\rundll32.exe
E:\Programme\AntiVir PersonalEdition Classic\avgnt.exe
E:\Programme\iTunes\iTunesHelper.exe
E:\Programme\QuickTime\qttask.exe
E:\WINDXPN\system32\ctfmon.exe
E:\PROGRA~1\COOLSPOT\PERSON~1\PID.EXE
E:\Programme\Microsoft Location Finder\LocationFinder.exe
E:\Programme\Google\Google Desktop Search\GoogleDesktop.exe
E:\Programme\The Weather Channel FW\Desktop Weather\DesktopWeather.exe
E:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe
E:\Programme\Multidesk\MultiDesk.exe
E:\Programme\iPod\bin\iPodService.exe
E:\Programme\Google\Google Desktop Search\GoogleDesktopIndex.exe
E:\Programme\Google\Google Desktop Search\GoogleDesktopDisplay.exe
E:\Programme\Google\Google Desktop Search\GoogleDesktopCrawl.exe
E:\Programme\Mozilla Firefox\firefox.exe
E:\WINDXPN\system32\wuauclt.exe
E:\WINDXPN\system32\cmd.exe
E:\Dokumente und Einstellungen\Achim\Desktop\HijackThis.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - E:\Programme\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - E:\Programme\Yahoo!\Companion\Installs\cpn1\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - E:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - E:\Programme\Yahoo!\Common\yiesrvc.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - e:\programme\google\googletoolbar2.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - E:\Programme\Yahoo!\Companion\Installs\cpn1\yt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - e:\programme\google\googletoolbar2.dll
O4 - HKLM\..\Run: [SoundMAXPnP] E:\Programme\Analog Devices\SoundMAX\SMax4PNP.exe
O4 - HKLM\..\Run: [SoundMAX] "E:\Programme\Analog Devices\SoundMAX\SMax4.exe" /tray
O4 - HKLM\..\Run: [ATIPTA] E:\Programme\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] E:\Programme\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [DAEMON Tools-1033] "E:\Programme\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [NeroFilterCheck] E:\WINDXPN\system32\NeroCheck.exe
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "E:\Programme\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [CloneCDTray] "E:\Programme\Elaborate Bytes\CloneCD\CloneCDTray.exe"
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [avgnt] "E:\Programme\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [iTunesHelper] "E:\Programme\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "E:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [CTFMON.EXE] E:\WINDXPN\system32\ctfmon.exe
O4 - HKCU\..\Run: [Personal ID] E:\PROGRA~1\COOLSPOT\PERSON~1\PID.EXE
O4 - HKCU\..\Run: [Microsoft Location Finder] "E:\Programme\Microsoft Location Finder\LocationFinder.exe"
O4 - HKCU\..\Run: [Google Desktop Search] "E:\Programme\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [DW4] "E:\Programme\The Weather Channel FW\Desktop Weather\DesktopWeather.exe"
O4 - Startup: Multidesk Desktop Manager.lnk = E:\Programme\Multidesk\MultiDesk.exe
O4 - Global Startup: Adobe Reader - Schnellstart.lnk = E:\Programme\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: InterVideo WinCinema Manager.lnk = E:\Programme\InterVideo\Common\Bin\WinCinemaMgr.exe
O8 - Extra context menu item: &Google Search - res://e:\programme\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: &Translate English Word - res://e:\programme\google\GoogleToolbar2.dll/cmwordtrans.html
O8 - Extra context menu item: &Yahoo! Search - file:///E:\Programme\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Backward Links - res://e:\programme\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://e:\programme\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://E:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://e:\programme\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate Page into English - res://e:\programme\google\GoogleToolbar2.dll/cmtrans.html
O8 - Extra context menu item: Yahoo! &Dictionary - file:///E:\Programme\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///E:\Programme\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///E:\Programme\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\Programme\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - E:\Programme\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - E:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - E:\Programme\Messenger\msmsgs.exe
O16 - DPF: {0F9B4CA4-A30F-480A-841D-69B45C50A8F8} (SekureL0gin.SekureKontrol) - http://secure2.comned.com/signuptemplates/AktiveSekurity.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - E:\Programme\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) - http://secure2.comned.com/signuptemplates/…login-devel.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse…pdownloader.cab
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "E:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: ACU Configuration Service (ACS) - Unknown owner - E:\WINDXPN\system32\acs.exe
O23 - Service: AntiVir PersonalEdition Classic Planer (AntiVirScheduler) - Avira GmbH - E:\Programme\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - E:\Programme\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - E:\WINDXPN\system32\Ati2evxx.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - E:\Programme\iPod\bin\iPodService.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - E:\Programme\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: IBM HDD APS Logging Service (TPHDEXLGSVC) - IBM Corporation - E:\WINDXPN\System32\TPHDEXLG.EXE

btw. i also checked the pushow12.dll before, so its entry is gone too now. .. however, the file itself did
not alarm my antivir scanner (AntiVir® PersonalEdition Classic from www.avira.de)
but Kaspersky online scanner did tell :
Scanned file: pushow12.dll - Infected
pushow12.dll - infected by not-a-virus:AdWare.Win32.AdvertMen.a
so … yes, once again you were correct …

Thanks for your help so far …
Post #4
The log looks good. :thumbup:

Your Java needs updated:

The latest version out is jre1.5.0_07

After updating you must remove previous versions via "Add/Remove Programs".

jre1.5.0_07 update link

Thank you for choosing TomCoyote for your malware removal solutions.

M68 :)

Securing Your PC After An Attack
Post #5
This topic is now closed.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI