Spyware / Malware / Virus Removal

Help with log file

2 min read

Looking for the outcome? Ask AI

Tamerz Topic Starter

Post #1September 14, 2006, 10:13 PM UTC

This system got infected something fierce. I ran AdAware and that got a lot of stuff. But Spybot S&D would close and Housecall stops. Pop-ups have slowed down but still have quite a few. Thanks for the help.

Logfile of HijackThis v1.99.1
Scan saved at 5:06:03 PM, on 9/14/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\QuickTime\qttask.exe
C:\kybrdff_18.exe
C:\dfndrff_e2.exe
C:\program files\popupwithcast\septpop06apsept.exe
C:\WINDOWS\biygfivA.exe
C:\WINDOWS\system32\crunner\cproc.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\PPATCH~1\explorer.exe
C:\Program Files\Citrix\GoToMeeting\189\g2mstart.exe
C:\Program Files\Citrix\GoToMeeting\189\g2mcomm.exe
C:\Program Files\Citrix\GoToMeeting\189\g2mlauncher.exe
C:\Program Files\Citrix\GoToMeeting\127\g2mstart.exe
C:\Program Files\Citrix\GoToMeeting\127\g2mcomm.exe
C:\Program Files\Citrix\GoToMeeting\127\g2mlauncher.exe
C:\Program Files\Citrix\GoToMeeting\127\g2msessioncontrol.exe
C:\Program Files\Citrix\GoToMeeting\127\g2mui.exe
C:\Program Files\Citrix\GoToMeeting\127\g2mchat.exe
C:\Program Files\Citrix\GoToMeeting\127\g2mhost.exe
C:\WINDOWS\M?crosoft.NET\n?lookup.exe
C:\Documents and Settings\tliceaga.SBCHICAGO.000\Desktop\hijackthis\HijackThis.exe

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.compaq.com/1Q00CDT/0409/bl7.asp
R3 - URLSearchHook: (no name) - _{A8B28872-3324-4CD2-8AA3-7D555C872D96} - (no file)
R3 - URLSearchHook: (no name) - _{02EE5B04-F144-47BB-83FB-A60BD91B74A9} - (no file)
R3 - URLSearchHook: (no name) - {02EE5B04-F144-47BB-83FB-A60BD91B74A9} - (no file)
R3 - URLSearchHook: DeskbarBHO - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - C:\Program Files\Deskbar\deskbar.dll
R3 - URLSearchHook: (no name) - {E883C48C-7B6F-0DB6-6A9C-57800B300EE5} - C:\WINDOWS\system32\lbpbu.dll
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
F2 - REG:system.ini: UserInit=userinit.exe
O2 - BHO: CFG32S - {7564B020-44E8-4c9b-A887-C6EC41AC67DA} - C:\WINDOWS\cfg32r.dll (file missing)
O2 - BHO: DeskbarBHO - {A8B28872-3324-4CD2-8AA3-7D555C872D96} - C:\Program Files\Deskbar\deskbar.dll
O2 - BHO: (no name) - {E883C48C-7B6F-0DB6-6A9C-57800B300EE5} - C:\WINDOWS\system32\lbpbu.dll
O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINDOWS\system32\kwinspex.exe GID002
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [keyboard] C:\\kybrdff_18.exe
O4 - HKLM\..\Run: [ACTX1] C:\WINDOWS\v1201.exe
O4 - HKLM\..\Run: [win3208054669695] C:\WINDOWS\win3208054669695.exe
O4 - HKLM\..\Run: [loaddr] c:\topaff.exe
O4 - HKLM\..\Run: [pop06apelt] C:\WINDOWS\thiselt.exe
O4 - HKLM\..\Run: [webHancer Survey Companion] "C:\Program Files\webHancer\Programs\whSurvey.exe"
O4 - HKLM\..\Run: [ms03696950546] C:\WINDOWS\ms03696950546.exe
O4 - HKLM\..\Run: [TheMonitor] C:\WINDOWS\Duce6.exe
O4 - HKLM\..\Run: [septpop06apsept] C:\program files\popupwithcast\septpop06apsept.exe
O4 - HKLM\..\Run: [Configuration Manager] C:\WINDOWS\cfg32.exe
O4 - HKLM\..\Run: [biygfivA] C:\WINDOWS\biygfivA.exe
O4 - HKLM\..\Run: [ms05695054669] C:\WINDOWS\ms05695054669.exe
O4 - HKLM\..\Run: [SurfSideKick 3] C:\Program Files\SurfSideKick 3\Ssk.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\WALGRE~1\WALGRE~1\data\Xtras\mssysmgr.exe
O4 - HKCU\..\Run: [uikf] C:\PROGRA~1\COMMON~1\uikf\uikfm.exe
O4 - HKCU\..\Run: [cprocsvc] C:\WINDOWS\system32\crunner\cproc.exe
O4 - HKCU\..\Run: [Snte] "C:\WINDOWS\PPATCH~1\explorer.exe" -vt ndrv
O4 - HKCU\..\Run: [Eszphjp] C:\WINDOWS\M?crosoft.NET\n?lookup.exe
O4 - HKCU\..\Run: [PSCloner] "C:\Program Files\PSCloner\PSCloner.exe"
O4 - HKCU\..\Run: [CMFibula] "C:\Program Files\CMFibula\CMFibula.exe"
O4 - Startup: Think-Adz.lnk = C:\WINDOWS\system32\kwinspex.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - C:\WINDOWS\system32\dmonwv.dll (file missing)
O9 - Extra 'Tools' menuitem: Java - {4ABF810A-F11D-4169-9D5F-7D274F2270A1} - C:\WINDOWS\system32\dmonwv.dll (file missing)
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.adgate.info (HKLM)
O15 - Trusted Zone: *.adsextend.net (HKLM)
O15 - Trusted Zone: *.dollarrevenue.com (HKLM)
O15 - Trusted Zone: *.elitemediagroup.net (HKLM)
O15 - Trusted Zone: *.imagesrvr.com (HKLM)
O15 - Trusted Zone: *.matcash.com (HKLM)
O15 - Trusted Zone: *.media-motor.com (HKLM)
O15 - Trusted Zone: *.mediatickets.net (HKLM)
O15 - Trusted Zone: *.snipernet.biz (HKLM)
O15 - Trusted Zone: *.systemdoctor.com (HKLM)
O15 - Trusted Zone: *.winantivirus.com (HKLM)
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecal…ivex/hcImpl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedC…bin/AvSniff.cab
O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://www.drivecleaner.com/.freeware/inst…leanerstart.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedC…n/bin/cabsa.cab
O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - http://download.cdn.winsoftware.com/files/…FreeInstall.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/…ro.cab34246.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = sbchicago.com
O17 - HKLM\Software\..\Telephony: DomainName = sbchicago.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = sbchicago.com
O20 - AppInit_DLLs: repairs303169590.dll
O20 - Winlogon Notify: RunOnce - C:\WINDOWS\system32\r4p80e7ueh.dll (file missing)
O20 - Winlogon Notify: SharedDlls - C:\WINDOWS\system32\n24slch71f4.dll (file missing)
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

Micah_6:8

Post #2September 15, 2006, 12:31 AM UTC

Download combofix.exe from the link below:

Combofix.exe

Save it to your desktop.

Run it.

When finished, it will produce a log for you.

Post that log in your next reply, along with a new HijackThis! log.

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Tamerz

Post #3September 15, 2006, 10:21 PM UTC

Thanks!

Here is the ComboFix log:

tliceaga - 06-09-15 17:05:25.07	Service Pack 2
ComboFix 06.09.14 - Running from: C:\Documents and Settings\[removed]\Desktop

(((((((((((((((((((((((((((((((((((((((((((((   Look2Me's Log   ))))))))))))))))))))))))))))))))))))))))))))))))))
 
REGISTRY ENTRIES REMOVED:

[HKEY_CLASSES_ROOT\CLSID\{16B6A472-73ED-4EF3-A037-F0332E211694}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{16B6A472-73ED-4EF3-A037-F0332E211694}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{16B6A472-73ED-4EF3-A037-F0332E211694}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{16B6A472-73ED-4EF3-A037-F0332E211694}\InprocServer32]
@="C:\\WINDOWS\\system32\\CXPAIG32.DLL"
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{E8B6EB3B-8351-4756-808E-B7ADC794CA4F}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{E8B6EB3B-8351-4756-808E-B7ADC794CA4F}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{E8B6EB3B-8351-4756-808E-B7ADC794CA4F}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{E8B6EB3B-8351-4756-808E-B7ADC794CA4F}\InprocServer32]
@="C:\\WINDOWS\\system32\\wnnstrm.dll"
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{8BE15538-BF8F-4732-A5A1-6D67A4CCF20E}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{8BE15538-BF8F-4732-A5A1-6D67A4CCF20E}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{8BE15538-BF8F-4732-A5A1-6D67A4CCF20E}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{8BE15538-BF8F-4732-A5A1-6D67A4CCF20E}\InprocServer32]
@="C:\\WINDOWS\\system32\\pyintui.dll"
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{B3E06EBE-0738-40B7-BB69-BF202DEED7BB}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B3E06EBE-0738-40B7-BB69-BF202DEED7BB}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B3E06EBE-0738-40B7-BB69-BF202DEED7BB}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{B3E06EBE-0738-40B7-BB69-BF202DEED7BB}\InprocServer32]
@="C:\\WINDOWS\\system32\\mfdscli.dll"
"ThreadingModel"="Apartment"

[HKEY_CLASSES_ROOT\CLSID\{EB956BC7-4E90-4456-928F-C4C37F628CF7}]
@=""
"IDEx"="AD"

[HKEY_CLASSES_ROOT\CLSID\{EB956BC7-4E90-4456-928F-C4C37F628CF7}\Implemented Categories]
@=""

[HKEY_CLASSES_ROOT\CLSID\{EB956BC7-4E90-4456-928F-C4C37F628CF7}\Implemented Categories\{00021492-0000-0000-C000-000000000046}]
@=""

[HKEY_CLASSES_ROOT\CLSID\{EB956BC7-4E90-4456-928F-C4C37F628CF7}\InprocServer32]
@="C:\\WINDOWS\\system32\\guard.tmp"
"ThreadingModel"="Apartment"
 
* * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *

 
 Granting sedebugprivilege to Administrators   … successful
 
 
(((((((((((((((((((((((((((((((((((((((((((   E-Give / Ssk's Log   )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\repairs303169590.dll


* * *  POST RUN FILES/FOLDERS  * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *


((((((((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
 

C:\WINDOWS\teller2.chk
C:\dfndrff_e4.exe
C:\deskbar3.exe
C:\kybrdff_e4.exe
C:\WINDOWS\system32y3aqsoepa.exe
C:\WINDOWS\uninstall_nmon.vbs
C:\Documents and Settings\LocalService\Application Data\NetMon
C:\Documents and Settings\NetworkService\Application Data\NetMon
C:\Program Files\Common Files\misc002
C:\Program Files\network monitor
C:\Program Files\Common Files\{2095EEF6-0AE9-1033-1220-040203200001}
C:\Program Files\Deskbar

 ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~	Purity	~ ~ ~ ~ ~ ~ ~ ~~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ 

Folders Quarantined:

C:\QooBox\Purity\Program Files\CROSOF~1
C:\QooBox\Purity\Program Files\Common Files\ASKS~1
C:\QooBox\Purity\WINDOWS\MCROSO~1.NET
C:\QooBox\Purity\WINDOWS\PPATCH~1
C:\QooBox\Purity\WINDOWS\MCROSO~1.NET\n?lookup.exe
C:\QooBox\Purity\WINDOWS\PPATCH~1\explorer.exe
C:\QooBox\Purity\WINDOWS\PPATCH~1\??pPatch

 
(((((((((((((((((((((((((((((((   Files Created from 2006-08-15 to 2006-09-15  ))))))))))))))))))))))))))))))))))
 

2006-09-14	15:58	126,976	–a——	C:\WINDOWS\system32\lbpbu.dll
2006-09-14	14:33	32,768	–a——	C:\WINDOWS\mwziatnd.exe
2006-09-14	14:09	186,381	–a——	C:\WINDOWS\srvwgrqikn.exe
2006-09-14	14:08	913,576	–a——	C:\WINDOWS\system32\WinNB66.dll
2006-09-14	14:08	126,976	–ah—–	C:\WINDOWS\system32\tbhogt.dll
2006-09-14	14:07	690,000	-r-hs—-	C:\WINDOWS\yqhaggx.exe
2006-09-14	14:07	397,824	-r-hs—-	C:\WINDOWS\biygfiv.exe
2006-09-14	14:07	386,864	-r-hs—-	C:\WINDOWS\biygfivA.exe
 

((((((((((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-09-15 17:11	——–	d——–	C:\Program Files\Symantec AntiVirus
2006-09-15 17:06	——–	d——–	C:\Program Files\Common Files
2006-09-15 17:04	931	–a——	C:\WINDOWS\system32\winpfg32.sys
2006-09-15 16:16	——–	d——–	C:\Program Files\Sunbelt Software
2006-09-15 16:12	——–	d——–	C:\Documents and Settings\tliceaga.SBCHICAGO.000\Application Data\AdobeUM
2006-09-14 16:49	——–	d——–	C:\Program Files\Internet Explorer
2006-09-14 15:58	2	–a——	C:\WINDOWS\system32\wnsapicc.exe
2006-09-14 15:05	——–	d——–	C:\Program Files\NetMeeting
2006-09-14 15:05	——–	d——–	C:\Program Files\Movie Maker
2006-09-14 15:02	——–	d——–	C:\Program Files\ComPlus Applications
2006-09-14 14:39	——–	d——–	C:\Program Files\Citrix
2006-09-14 14:09	32178	—hs—-	C:\Program Files\Common Files\Yazzle1119OinUninstaller.exe
2006-08-21 07:21	16896	–a——	C:\WINDOWS\system32\fltlib.dll
2006-08-21 04:14	23040	–a——	C:\WINDOWS\system32\fltmc.exe
2006-08-21 04:14	128896	–a——	C:\WINDOWS\system32\drivers\fltmgr.sys
2006-08-10 12:14	——–	d——–	C:\Program Files\Common Files\uikf
2006-08-10 11:52	——–	d——–	C:\Program Files\Alwil Software
2006-08-10 00:35	168044	–a——	C:\WINDOWS\system32\kwinspex.exe
2006-08-09 18:02	28672	–a——	C:\WINDOWS\system32\drivers\CO_Mon.sys
2006-08-09 17:12	——–	d——–	C:\Documents and Settings\tliceaga.SBCHICAGO.000\Application Data\Lavasoft
2006-08-09 17:11	——–	d——–	C:\Program Files\Lavasoft
2006-08-09 16:57	1167	–a——	C:\WINDOWS\system32\hnxc3ca9.sys
2006-08-09 16:43	——–	d——–	C:\Program Files\Compaq
2006-08-08 11:53	635520	–a——	C:\WINDOWS\system32\aswBoot.exe
2006-08-07 10:17	61440	–a——	C:\WINDOWS\system32\BattyRun2.dll
2006-08-06 23:16	76560	–a——	C:\WINDOWS\system32\drivers\tmcomm.sys
2006-08-05 10:25	87424	–a——	C:\WINDOWS\system32\drivers\aswmon2.sys
2006-08-05 10:25	85952	–a——	C:\WINDOWS\system32\drivers\aswmon.sys
2006-08-05 10:24	16352	–a——	C:\WINDOWS\system32\drivers\aswRdr.sys
2006-08-05 10:22	36176	–a——	C:\WINDOWS\system32\drivers\aswTdi.sys
2006-08-05 10:20	24304	–a——	C:\WINDOWS\system32\drivers\aavmker4.sys
2006-08-05 01:18	90112	–a——	C:\WINDOWS\system32\AVASTSS.scr
2006-07-27 08:24	679424	–a——	C:\WINDOWS\system32\inetcomm.dll
2006-07-21 03:24	72704	–a——	C:\WINDOWS\system32\hlink.dll
2006-07-19 12:44	——–	d—s—-	C:\Documents and Settings\tliceaga.SBCHICAGO.000\Application Data\Microsoft
2006-06-22 00:06	69120	–a——	C:\WINDOWS\system32\ciodm.dll
2006-06-22 00:06	1435648	–a——	C:\WINDOWS\system32\query.dll
 

((((((((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))
 
*Note* empty entries are not shown

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"PhotoShow Deluxe Media Manager"="C:\\PROGRA~1\\WALGRE~1\\WALGRE~1\\data\\Xtras\\mssysmgr.exe"
"uikf"="C:\\PROGRA~1\\COMMON~1\\uikf\\uikfm.exe"
"Snte"="\"C:\\WINDOWS\\PPATCH~1\\explorer.exe\" -vt ndrv"
"Eszphjp"="C:\\WINDOWS\\M?crosoft.NET\\n?lookup.exe"
"PSCloner"="\"C:\\Program Files\\PSCloner\\PSCloner.exe\""
"CMFibula"="\"C:\\Program Files\\CMFibula\\CMFibula.exe\""

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe"
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"win3208054669695"="C:\\WINDOWS\\win3208054669695.exe"
"loaddr"="c:\\topaff.exe"
"ms03696950546"="C:\\WINDOWS\\ms03696950546.exe"
"biygfivA"="C:\\WINDOWS\\biygfivA.exe"
"ms05695054669"="C:\\WINDOWS\\ms05695054669.exe"
"SunServer"="C:\\Program Files\\Sunbelt Software\\CounterSpy\\Consumer\\sunserver.exe"

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000000

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="C:\\Program Files\\ComPlus Applications\\tenykig.html"
"SubscribedURL"=""
"FriendlyName"=""
"Flags"=dword:00002000
"Position"=hex:2c,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,00,00,e8,\
  03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,14,00,00,00,14,00,00,00
"CurrentState"=dword:40000001
"OriginalStateInfo"=hex:18,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,\
  00,00,01,00,00,00
"RestoredStateInfo"=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\1]
"Source"="C:\\Program Files\\NetMeeting\\rylohadyd.html"
"SubscribedURL"=""
"FriendlyName"=""
"Flags"=dword:00002000
"Position"=hex:2c,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,00,00,ea,\
  03,00,00,00,00,00,00,00,00,00,00,00,00,00,00,14,00,00,00,14,00,00,00
"CurrentState"=dword:00000001
"OriginalStateInfo"=hex:18,00,00,00,64,00,00,00,64,00,00,00,58,02,00,00,c8,00,\
  00,00,01,00,00,00
"RestoredStateInfo"=hex:00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,00,\
  00,00,00,00,00,00

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\Desktop\Components\2]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,ec,\
  03,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=dword:40000004
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
  ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
  00,00,01,00,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""
"{076394AD-7FDD-44EF-A075-32C68DBAB99B}"=""

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoWelcomeScreen"=dword:00000001

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\run]

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"CDRAutoRun"=dword:00000000

[HKEY_USERS\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091
"CDRAutoRun"=dword:00000000

[HKEY_USERS\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"


HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders
securityproviders REG_SZ  msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll

 
Completion time: Fri 09/15/2006 17:12:27.29 
ComboFix.txt

And here is the HijackThis! log again:

Logfile of HijackThis v1.99.1
Scan saved at 5:16:25 PM, on 9/15/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Symantec AntiVirus\SavRoam.exe
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\biygfivA.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\WINDOWS\system32\kwinspex.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\msiexec.exe
C:\Documents and Settings\tliceaga.SBCHICAGO.000\Desktop\Spyware\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.compaq.com/1Q00CDT/0409/bl7.asp
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com
R3 - URLSearchHook: (no name) - _{A8B28872-3324-4CD2-8AA3-7D555C872D96} - (no file)
R3 - URLSearchHook: (no name) - {E883C48C-7B6F-0DB6-6A9C-57800B300EE5} - C:\WINDOWS\system32\lbpbu.dll
R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)
F2 - REG:system.ini: UserInit=userinit.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [win3208054669695] C:\WINDOWS\win3208054669695.exe
O4 - HKLM\..\Run: [loaddr] c:\topaff.exe
O4 - HKLM\..\Run: [ms03696950546] C:\WINDOWS\ms03696950546.exe
O4 - HKLM\..\Run: [biygfivA] C:\WINDOWS\biygfivA.exe
O4 - HKLM\..\Run: [ms05695054669] C:\WINDOWS\ms05695054669.exe
O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINDOWS\system32\kwinspex.exe GID002
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\WALGRE~1\WALGRE~1\data\Xtras\mssysmgr.exe
O4 - HKCU\..\Run: [uikf] C:\PROGRA~1\COMMON~1\uikf\uikfm.exe
O4 - HKCU\..\Run: [Snte] "C:\WINDOWS\PPATCH~1\explorer.exe" -vt ndrv
O4 - HKCU\..\Run: [Eszphjp] C:\WINDOWS\M?crosoft.NET\n?lookup.exe
O4 - HKCU\..\Run: [PSCloner] "C:\Program Files\PSCloner\PSCloner.exe"
O4 - HKCU\..\Run: [CMFibula] "C:\Program Files\CMFibula\CMFibula.exe"
O4 - Startup: Think-Adz.lnk = C:\WINDOWS\system32\kwinspex.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.adgate.info (HKLM)
O15 - Trusted Zone: *.adsextend.net (HKLM)
O15 - Trusted Zone: *.dollarrevenue.com (HKLM)
O15 - Trusted Zone: *.elitemediagroup.net (HKLM)
O15 - Trusted Zone: *.imagesrvr.com (HKLM)
O15 - Trusted Zone: *.matcash.com (HKLM)
O15 - Trusted Zone: *.media-motor.com (HKLM)
O15 - Trusted Zone: *.mediatickets.net (HKLM)
O15 - Trusted Zone: *.snipernet.biz (HKLM)
O15 - Trusted Zone: *.systemdoctor.com (HKLM)
O15 - Trusted Zone: *.winantivirus.com (HKLM)
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.5) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://www.drivecleaner.com/.freeware/installdrivecleanerstart.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {B64F4A7C-97C9-11DA-8BDE-F66BAD1E3F3A} - http://download.cdn.winsoftware.com/files/installers/cab/WinAntiVirusPro2006FreeInstall.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramework/v10/ZIntro.cab34246.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = sbchicago.com
O17 - HKLM\Software\..\Telephony: DomainName = sbchicago.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = sbchicago.com
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe

Micah_6:8

Post #4September 15, 2006, 11:26 PM UTC

CLOSE ALL WINDOWS (even this one) AND PROGRAMS!!!!

Run Hijack This!
Click "Do a systen scan only".
Then "check" the box to the left of these item(s):

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://searchbar.findthewebsiteyouneed.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://searchbar.findthewebsiteyouneed.com

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://searchbar.findthewebsiteyouneed.com

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = http://searchbar.findthewebsiteyouneed.com

R3 - URLSearchHook: (no name) - _{A8B28872-3324-4CD2-8AA3-7D555C872D96} - (no file)

R3 - URLSearchHook: (no name) - {E883C48C-7B6F-0DB6-6A9C-57800B300EE5} - C:\WINDOWS\system32\lbpbu.dll

R3 - URLSearchHook: (no name) - _{CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file)

F2 - REG:system.ini: UserInit=userinit.exe

O4 - HKLM\..\Run: [win3208054669695] C:\WINDOWS\win3208054669695.exe

O4 - HKLM\..\Run: [loaddr] c:\topaff.exe

O4 - HKLM\..\Run: [ms03696950546] C:\WINDOWS\ms03696950546.exe

O4 - HKLM\..\Run: [biygfivA] C:\WINDOWS\biygfivA.exe

O4 - HKLM\..\Run: [ms05695054669] C:\WINDOWS\ms05695054669.exe

O4 - HKLM\..\Run: [ExploreUpdSched] C:\WINDOWS\system32\kwinspex.exe GID002

O4 - HKCU\..\Run: [uikf] C:\PROGRA~1\COMMON~1\uikf\uikfm.exe

O4 - HKCU\..\Run: [Snte] "C:\WINDOWS\PPATCH~1\explorer.exe" -vt ndrv

O4 - HKCU\..\Run: [Eszphjp] C:\WINDOWS\M?crosoft.NET\n?lookup.exe

O4 - HKCU\..\Run: [CMFibula] "C:\Program Files\CMFibula\CMFibula.exe"

O4 - Startup: Think-Adz.lnk = C:\WINDOWS\system32\kwinspex.exe

O15 - Trusted Zone: *.adgate.info (HKLM)

O15 - Trusted Zone: *.adsextend.net (HKLM)

O15 - Trusted Zone: *.dollarrevenue.com (HKLM)

O15 - Trusted Zone: *.elitemediagroup.net (HKLM)

O15 - Trusted Zone: *.imagesrvr.com (HKLM)

O15 - Trusted Zone: *.matcash.com (HKLM)

O15 - Trusted Zone: *.media-motor.com (HKLM)

O15 - Trusted Zone: *.mediatickets.net (HKLM)

O15 - Trusted Zone: *.snipernet.biz (HKLM)

O15 - Trusted Zone: *.systemdoctor.com (HKLM)

O15 - Trusted Zone: *.winantivirus.com (HKLM)

O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://www.drivecleaner.com/.freeware/inst…leanerstart.cab

Then click "Fix checked" and close Hijack This!.

Reboot in "safe" mode.

Delete all of the following noted (in red) file(s)/FOLDER(s) you can find:

c:\program files\cmfibula <— FOLDER

c:\program files\common files\uikf <— FOLDER

c:\topaff.exe <— file

c:\windows\biygfiva.exe <— file

c:\windows\m?crosoft.net\n?lookup.exe <— file

c:\windows\ms03696950546.exe <— file

c:\windows\ms05695054669.exe <— file

c:\windows\system32\kwinspex.exe <— file

c:\windows\system32\lbpbu.dll <— file

c:\windows\win3208054669695.exe <— file

Some malware files may be "hidden".
Be sure to show hidden files when looking for these file(s) and/or folder(s).

Reboot in normal mode and "copy/paste" a new HijackThis! log file into this thread.

Micah_6:8

Post #5October 9, 2006, 4:52 PM UTC

Due to lack of feedback:

This topic is now closed.

If you need this topic reopened, please request this by sending an email to us at the following link
(Click for address)
Include your post user name and detail why you need it reopened with a valid link to your post.
Any bad links or emails that are not from the original poster will be deleted without response.
Any emails without the subject "Reopen" will be deleted without being looked at.

If this is not your thread please start a New Topic.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Help with log file

✨ Ask AI

Ask AI