What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

Any help please :P

17 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
Logfile of HijackThis v1.99.1
Scan saved at 08:18:23 AM, on 2006/11/03
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\gearsec.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\volumec.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Winamp\winamp.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 168.167.21.8:8080
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Qtime] C:\WINDOWS\nrchk.exe /i
O4 - HKLM\..\Run: [Communicator] C:\WINDOWS\fw_304.exe /i
O4 - HKLM\..\Run: [SoundMano] C:\WINDOWS\sndmano.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [VolControl] C:\WINDOWS\volumec.exe -i
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Qms] C:\WINDOWS\System32\m?iexec.exe
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [Xnqvqg] C:\WINDOWS\System32\t?skmgr.exe
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Stbt] "C:\WINDOWS\SCURIT~1\mshta.exe" -vt mt
O4 - HKCU\..\Run: [Oeuw] "C:\WINDOWS\system32\RACLE~1\javaw.exe" -vt mt
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {11111111-1111-1111-1111-111111113457} - file://c:\ied_s7m.cab
O16 - DPF: {11111111-1111-1111-1111-511111113457} - file://c:\x.cab
O16 - DPF: {11111111-1111-1111-1111-511111113458} - file://c:\x.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse…pdownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A0ABBD57-988E-4C4D-A606-3F05300856C0}: NameServer = 196.43.46.190 196.43.38.190
O17 - HKLM\System\CCS\Services\Tcpip\..\{E69336E1-E304-4238-94B1-F52A325F75A8}: NameServer = 192.168.0.25
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: -hrbsqdwg - C:\WINDOWS\system32\phqghu.dll
O20 - Winlogon Notify: App Paths - C:\WINDOWS\
O20 - Winlogon Notify: WindowsUpdate - C:\WINDOWS\system32\svdll.dll (file missing)
O20 - Winlogon Notify: winhjd32 - C:\WINDOWS\SYSTEM32\winhjd32.dll
O23 - Service: GearSecurity - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Post #2
1.
Download and install CCleaner
(you don't have to install the CCleaner Yahoo Toolbar)
Don't use the program at this moment.

2.
Please download Look2Me-Destroyer.exe to your desktop.
  • Close all windows before continuing.
  • Double-click Look2Me-Destroyer.exe to run it.
  • Put a check next to Run this program as a task.
  • You will receive a message saying Look2Me-Destroyer will close and re-open in approximately 10 seconds. Click OK
  • When Look2Me-Destroyer re-opens, click the Scan for L2M button, your desktop icons will disappear, this is normal.
  • Once it's done scanning, click the Remove L2M button.
  • You will receive a Done Scanning message, click OK.
  • When completed, you will receive this message: Done removing infected files! Look2Me-Destroyer will now shutdown your computer, click OK.
  • Your computer will then shutdown.
  • Turn your computer back on.
If you receive a message from your firewall about this program accessing the internet please allow it.

If you receive a runtime error '339' please download MSWINSCK.OCX from the link below and place it in your C:\Windows\System32 Directory.
http://www.ascentive.com/support/new/images/lib/MSWINSCK.OCX

3.
1) Please download Killbox.
Unzip it to the desktop and run it.

2) Select "Delete on Reboot".

3) Copy the file names below to the clipboard by highlighting them and pressing Control-C:
C:\WINDOWS\SYSTEM32\winhjd32.dll
C:\WINDOWS\system32\phqghu.dll

4) Return to Killbox, go to the File menu, and choose "Paste from Clipboard".

5) Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.

If you have any issues with this method you can copy and paste the lines one at a time into the killbox top box. Then click the Single File button. Then click the Red X …and for the confirmation message that will appear, you will need to click Yes. A second message will ask to Reboot now? you will need to click No until the last one at which time you click Yes to allow the reboot.

Killbox will tell you that all listed files will be removed on next reboot and asks if you would like to Reboot now, click YES
If you don't get that message, reboot manually.

4.
Run Hijackthis, click on 'Do a system scan only'
check only the items listed below:

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = about:blank
R1 - HKCU\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - Default URLSearchHook is missing
O4 - HKLM\..\Run: [Qtime] C:\WINDOWS\nrchk.exe /i
O4 - HKLM\..\Run: [Communicator] C:\WINDOWS\fw_304.exe /i
O4 - HKCU\..\Run: [Qms] C:\WINDOWS\System32\m?iexec.exe
O4 - HKCU\..\Run: [Xnqvqg] C:\WINDOWS\System32\t?skmgr.exe
O4 - HKCU\..\Run: [Stbt] "C:\WINDOWS\SCURIT~1\mshta.exe" -vt mt
O4 - HKCU\..\Run: [Oeuw] "C:\WINDOWS\system32\RACLE~1\javaw.exe" -vt mt
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O16 - DPF: {11111111-1111-1111-1111-111111113457} - file://c:\ied_s7m.cab
O16 - DPF: {11111111-1111-1111-1111-511111113457} - file://c:\x.cab
O16 - DPF: {11111111-1111-1111-1111-511111113458} - file://c:\x.cab
O20 - Winlogon Notify: -hrbsqdwg - C:\WINDOWS\system32\phqghu.dll
O20 - Winlogon Notify: App Paths - C:\WINDOWS\
O20 - Winlogon Notify: WindowsUpdate - C:\WINDOWS\system32\svdll.dll (file missing)
O20 - Winlogon Notify: winhjd32 - C:\WINDOWS\SYSTEM32\winhjd32.dll

Click on 'Fix checked' and close the program.

5.
Remove all files from C:\Windows\Temp (or use Ccleaner)

6.
Make sure your explorer is set to show hidden and system files and folders:
Open Explorer or "My Computer" and click Tools -> Folder Options… and then select the View tab and check the next settings:

Uncheck: Hide protected operating system files
Uncheck: Hide file extensions for known file types
Select: Display the contents of system folders (Windows XP)
Select: Show hidden files and folders

Remove the next folders/files:
C:\WINDOWS\fw_304.exe /i
C:\WINDOWS\SCURIT~1
C:\WINDOWS\system32\RACLE~1
C:\WINDOWS\nrchk.exe
C:\WINDOWS\System32\m?iexec.exe
C:\WINDOWS\System32\t?skmgr.exe
c:\ied_s7m.cab
c:\x.cab

7.
You have to upgrade your Java software.
Sun's Java is updated in order to eliminate the exploitation of vulnerabilities. For this reason, it's extremely important that you remove the older more vulnerable versions from your system.
Then update with the new version of Sun Java: Java Runtime Environment Version 5.0 Update 9.

Click Start -> (Settings) -> Control Panel -> Add/Remove Programs
Uninstall the next program:
J2SE Runtime Environment

Download and install the latest version 1.5.0.9 from here: http://java.sun.com/javase/downloads/index.jsp

8.
Start Ccleaner.
Select in "Windows" only the next items:
Internet Explorer:
- Temporary Internet Files
System:
- Empty Recycle bin
- Temporary Files
Click in Ccleaner on "Run Cleaner".

9.
Start HijackThis

Click "Open the Misc Tools section".
Click "Open Uninstall Manager"
Then click on the rightside on "Save list…"
Save the file and post the content of the notepad window together with the contents of C:\Look2Me-Destroyer.txt :)
Post #3
Thanks alot man :) Ad-Aware SE Personal Adobe Reader 6.0 BitComet 0.56 Cakewalk Pyro Plus 1 CCleaner (remove only) CloneCD C-Media WDM Audio Driver DivX Player DivX Pro Trial Enable S3 for USB Device GhostMouse 2.0 Google Toolbar for Internet Explorer GrabIt 1.6.2 Beta (build 940) Guitar Pro 4 HijackThis 1.99.1 Internet Explorer Security Plugin 2006 Internet Security Add-On iTunes J2SE Runtime Environment 5.0 Update 5 Jasc Paint Shop Pro 8 LightWave 7 Full Install LimeWire 4.10.9 Microsoft Office XP Professional mIRC Mozilla Firefox (1.0.7) Public Messenger ver 2.03 QuickTime RealPlayer Realtek AC'97 Audio RegCure [removed] RTLSetup Security Update for Windows XP (KB883939) Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896422) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896424) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB896688) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB901214) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB903235) Security Update for Windows XP (KB904706) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB905915) Spybot - Search & Destroy 1.4 Steinberg Cubase SX v2.2.0.33 StyleBuilder (remove only) StyleXP (remove only) UOGateway Update for Windows XP (KB894391) Update for Windows XP (KB898461) Wasp Winamp (remove only) Windows Driver Package - MSN (usbccgp) USB (04/19/2006 1.1.0.2) Windows Installer 3.1 (KB893803) Windows Installer 3.1 (KB893803) Windows Live Messenger Windows Live Sign-in Assistant Windows Media Format Runtime Windows Media Player 10 Windows XP Hotfix - KB834707 Windows XP Hotfix - KB867282 Windows XP Hotfix - KB873333 Windows XP Hotfix - KB873339 Windows XP Hotfix - KB885250 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB885884 Windows XP Hotfix - KB886185 Windows XP Hotfix - KB887472 Windows XP Hotfix - KB887742 Windows XP Hotfix - KB888113 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB890047 Windows XP Hotfix - KB890175 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB890923 Windows XP Hotfix - KB891781 Windows XP Hotfix - KB893066 Windows XP Hotfix - KB893086 Windows XP Service Pack 2 WinRAR archiver XoftSpy Yahoo! Internet Mail ZoneAlarm Pro Look2Me-Destroyer V1.0.12 Scanning for infected files….. Scan started at 04/11/2006 10:49:15 Infected! C:\WINDOWS\system32\svdll.dll Attempting to delete infected files… Making registry repairs. Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\App Paths Removing: HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WindowsUpdate Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{19542E12-4143-40BC-919B-AF6838FD2CBF}" HKCR\Clsid\{19542E12-4143-40BC-919B-AF6838FD2CBF} Removing: HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved "{95C7BBC3-3B0E-4742-9A9A-476BCBE36D76}" HKCR\Clsid\{95C7BBC3-3B0E-4742-9A9A-476BCBE36D76} Restoring Windows certificates. Replaced hosts file with default windows hosts file Restoring SeDebugPrivilege for Administrators - Succeeded
Post #4
Please do read this article about XoftSpy:
http://www.spywarewarrior.com/rogue_anti-s…re.htm#xos_note

Download, install, and update AVG anti-spyware 7.5 (This is a 30 days trial)
  • Install AVG anti-spyware.
  • Start the program but don't scan for virus at this moment.
  • On the main screen select the icon "Update" then select the "Update now" link.
  • Next select the "Start Update" button, the update will start and a progress bar will show the updates being installed.
  • Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab.
  • Once in the Settings screen click on "Recommended actions" and then select "Quarantine".
Close AVG anti-spyware, Do Not run a scan at this moment.

Reboot your pc into safe mode

Safe mode for Windows XP
  • Restart the computer.
  • As soon as BIOS is loaded and before Windows is loaded, begin tapping the F8 (or F5) key until the Advanced Options menu appears.
  • Use the arrow keys to select the Safe mode menu item
  • Press Enter.
To clean temporary files:
Go > start > run and type cleanmgr and click OK
Scan your system for files to remove.
Make sure Temporary Files, Temporary Internet Files and Recycle Bin are the only things checked.
Click OK to remove those files.
Click Yes to confirm deletion.

Start AVG anti-spyware.
  • Click on Scanner
  • Click on Complete System Scan
  • Let the program scan your pc, be patient this may take a little time.
  • If you have any infections you will prompted, click “set all elements to: recommended action” and choose Quarantine
  • Click "Apply all actions"
  • Next select the button "Save Report".
  • Click the "Save report as" button and save the report to your desktop.
  • Close AVG and reboot your system back into Normal Mode.
Post the results of the AVG report scan along with a new HijackThis log. :)
Post #5
Logfile of HijackThis v1.99.1
Scan saved at 04:02:21 PM, on 2006/11/04
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\gearsec.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\MsPMSPSv.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\volumec.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\wscntfy.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 168.167.21.8:8080
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SoundMano] C:\WINDOWS\sndmano.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [VolControl] C:\WINDOWS\volumec.exe -i
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse…pdownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A0ABBD57-988E-4C4D-A606-3F05300856C0}: NameServer = 196.43.46.190 196.43.38.190
O17 - HKLM\System\CCS\Services\Tcpip\..\{E69336E1-E304-4238-94B1-F52A325F75A8}: NameServer = 192.168.0.25
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: GearSecurity - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe




AVG Anti-Spyware - Scan Report
———————————————————

+ Created at: 03:56:42 PM 2006/11/04

+ Scan result:



C:\System Volume Information\_restore{AB0F0869-8D69-4025-B8E0-3A978AE25883}\RP618\A0154334.exe -> Adware.ClickSpring : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{AB0F0869-8D69-4025-B8E0-3A978AE25883}\RP621\A0154363.exe -> Adware.ClickSpring : Cleaned with backup (quarantined).
C:\Documents and Settings\test\Local Settings\Temp\dkw75D7.tmp.tst -> Adware.EliteBar : Cleaned with backup (quarantined).
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\WNHD6OQA\silent_setup[1].exe -> Adware.EliteBar : Cleaned with backup (quarantined).
C:\WINDOWS\system32\shawn_1.dll -> Adware.EliteBar : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\CLSID\{202a961f-23ae-42b1-9505-ffe3c818d717} -> Adware.Generic : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\CLSID\{a2595f37-48d0-46a1-9b51-478591a97764} -> Adware.Generic : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Security Add-On -> Adware.Generic : Cleaned with backup (quarantined).
HKU\S-1-5-21-842925246-838170752-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{202A961F-23AE-42B1-9505-FFE3C818D717} -> Adware.Generic : Cleaned with backup (quarantined).
HKU\S-1-5-21-842925246-838170752-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5A5B6916-ED71-4531-8018-E792DD44156E} -> Adware.Generic : Cleaned with backup (quarantined).
HKU\S-1-5-21-842925246-838170752-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E8EDB60C-951E-4130-93DC-FAF1AD25F8E7} -> Adware.Generic : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\IntCodec -> Adware.IntCodec : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Internet Explorer Security Plugin 2006 -> Adware.IntCodec : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Public Messenger ver 2.03 -> Adware.IntCodec : Cleaned with backup (quarantined).
HKU\S-1-5-21-842925246-838170752-839522115-1004\Software\Internet Security -> Adware.IntCodec : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{AB0F0869-8D69-4025-B8E0-3A978AE25883}\RP629\A0157484.dll -> Adware.Softomate : Cleaned with backup (quarantined).
HKU\S-1-5-21-842925246-838170752-839522115-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{A8B28872-3324-4CD2-8AA3-7D555C872D96} -> Adware.Softomate : Cleaned with backup (quarantined).
C:\WINDOWS\system32\gebxywt.dll -> Adware.Virtumonde : Cleaned with backup (quarantined).
C:\Program Files\whInstall -> Adware.Webhancer : Cleaned with backup (quarantined).
HKLM\SOFTWARE\Classes\PROTOCOLS\Name-Space Handler\res -> Adware.WebSearch : Cleaned with backup (quarantined).
C:\winhl5.pif -> Backdoor.Aimbot.ad : Cleaned with backup (quarantined).
C:\winhlp.pif -> Backdoor.Aimbot.ad : Cleaned with backup (quarantined).
C:\update30.pif -> Backdoor.Rbot.zj : Cleaned with backup (quarantined).
C:\update31.pif -> Backdoor.Rbot.zj : Cleaned with backup (quarantined).
C:\update32.pif -> Backdoor.Rbot.zj : Cleaned with backup (quarantined).
C:\update33.pif -> Backdoor.Rbot.zj : Cleaned with backup (quarantined).
C:\update34.pif -> Backdoor.Rbot.zj : Cleaned with backup (quarantined).
C:\update35.pif -> Backdoor.Rbot.zj : Cleaned with backup (quarantined).
C:\update36.pif -> Backdoor.Rbot.zj : Cleaned with backup (quarantined).
C:\update37.pif -> Backdoor.Rbot.zj : Cleaned with backup (quarantined).
C:\update38.pif -> Backdoor.Rbot.zj : Cleaned with backup (quarantined).
C:\update39.pif -> Backdoor.Rbot.zj : Cleaned with backup (quarantined).
C:\syste0.pif -> Backdoor.Rbot.zk : Cleaned with backup (quarantined).
C:\syste1.pif -> Backdoor.Rbot.zk : Cleaned with backup (quarantined).
C:\syste2.pif -> Backdoor.Rbot.zk : Cleaned with backup (quarantined).
C:\syste3.pif -> Backdoor.Rbot.zk : Cleaned with backup (quarantined).
C:\syste4.pif -> Backdoor.Rbot.zk : Cleaned with backup (quarantined).
C:\syste6.pif -> Backdoor.Rbot.zk : Cleaned with backup (quarantined).
C:\syste7.pif -> Backdoor.Rbot.zk : Cleaned with backup (quarantined).
C:\syste8.pif -> Backdoor.Rbot.zk : Cleaned with backup (quarantined).
C:\system.pif -> Backdoor.Rbot.zk : Cleaned with backup (quarantined).
C:\winlogi0.pif -> Backdoor.SdBot.adh : Cleaned with backup (quarantined).
C:\winlogi7.pif -> Backdoor.SdBot.adh : Cleaned with backup (quarantined).
C:\winlogin.pif -> Backdoor.SdBot.adh : Cleaned with backup (quarantined).
C:\cmmo1.pif -> Backdoor.SdBot.adp : Cleaned with backup (quarantined).
C:\cmmo4.pif -> Backdoor.SdBot.adp : Cleaned with backup (quarantined).
C:\cmmo7.pif -> Backdoor.SdBot.adp : Cleaned with backup (quarantined).
C:\cmmo8.pif -> Backdoor.SdBot.adp : Cleaned with backup (quarantined).
C:\cmmon.pif -> Backdoor.SdBot.adp : Cleaned with backup (quarantined).
C:\updater.pif -> Backdoor.SdBot.adr : Cleaned with backup (quarantined).
C:\updating.pif -> Backdoor.SdBot.ady : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{AB0F0869-8D69-4025-B8E0-3A978AE25883}\RP631\A0158045.exe -> Backdoor.Webdor.aa : Cleaned with backup (quarantined).
C:\WINDOWS\svchost2.exe -> Backdoor.Webdor.ag : Cleaned with backup (quarantined).
C:\Documents and Settings\test\Local Settings\Temp\msmsng.exe -> Backdoor.Webdor.ai : Cleaned with backup (quarantined).
C:\Documents and Settings\CJ\My Documents\Regcure 1.0.0.43.rar/keygen.exe -> Downloader.Adload.fu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{AB0F0869-8D69-4025-B8E0-3A978AE25883}\RP630\A0157580.exe -> Downloader.Adload.fu : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{AB0F0869-8D69-4025-B8E0-3A978AE25883}\RP629\A0157486.exe -> Downloader.Agent.is : Cleaned with backup (quarantined).
C:\WINDOWS\newsd32.exe -> Downloader.Agent.is : Cleaned with backup (quarantined).
C:\WINDOWS\ramex.exe -> Downloader.Agent.is : Cleaned with backup (quarantined).
C:\WINDOWS\rec.exe -> Downloader.Agent.yg : Cleaned with backup (quarantined).
C:\Documents and Settings\CJ\Local Settings\Application Data\de2ddb4c.exe -> Downloader.Obfuscated.a : Cleaned with backup (quarantined).
C:\WINDOWS\system32\de2ddb4c.exe -> Downloader.Obfuscated.a : Cleaned with backup (quarantined).
C:\WINDOWS\system32\Оracle\javaw.exe -> Downloader.PurityScan.by : Cleaned with backup (quarantined).
C:\WINDOWS\sеcurity\mshta.exe -> Downloader.PurityScan.by : Cleaned with backup (quarantined).
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\I3G9K3AT\pre[2].exe -> Downloader.Small.bnd : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{AB0F0869-8D69-4025-B8E0-3A978AE25883}\RP629\A0157491.exe -> Downloader.Zlob.rf : Cleaned with backup (quarantined).
C:\backups\backup-20061101-120841-996.dll -> Downloader.Zlob.ri : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{AB0F0869-8D69-4025-B8E0-3A978AE25883}\RP629\A0157487.exe -> Downloader.Zlob.rk : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{AB0F0869-8D69-4025-B8E0-3A978AE25883}\RP629\A0157492.tlb -> Downloader.Zlob.rk : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{AB0F0869-8D69-4025-B8E0-3A978AE25883}\RP629\A0157488.exe -> Downloader.Zlob.yj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{AB0F0869-8D69-4025-B8E0-3A978AE25883}\RP629\A0157489.exe -> Downloader.Zlob.yj : Cleaned with backup (quarantined).
C:\WINDOWS\system32\in8PwrScrMs1086.dll -> Dropper.Small.abd : Cleaned with backup (quarantined).
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\GDOTQTW9\pre[4].exe -> Dropper.Small.aeq : Cleaned with backup (quarantined).
C:\Documents and Settings\CJ\My Documents\Regcure 1.0.0.43.rar/crack.exe -> Dropper.Small.asx : Cleaned with backup (quarantined).
C:\Documents and Settings\CJ\My Documents\Regcure 1.0.0.43.rar/patch.exe -> Dropper.Small.asx : Cleaned with backup (quarantined).
C:\WINDOWS\system32\saie321.dll -> Dropper.Small.nj : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{AB0F0869-8D69-4025-B8E0-3A978AE25883}\RP629\A0157480.dll -> Hijacker.Agent.ac : Cleaned with backup (quarantined).
C:\WINDOWS\system32\vbsys2.dll.bck -> Hijacker.Agent.ac : Cleaned with backup (quarantined).
C:\WINDOWS\system32:lzx32.sys -> Hijacker.Costrat.e : Cleaned with backup (quarantined).
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\CJYDMP2X\protector_update[3].exe -> Hijacker.StartPage.nk : Cleaned with backup (quarantined).
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\5IL34AY6\protector_update[1].exe -> Hijacker.StartPage.nk : Cleaned with backup (quarantined).
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\GPOKXJYZ\protector_update[9].exe -> Hijacker.StartPage.nk : Cleaned with backup (quarantined).
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\WNHD6OQA\protector_update[1].exe -> Hijacker.StartPage.nk : Cleaned with backup (quarantined).
C:\WINDOWS\system32\temperror32.dat -> Hijacker.StartPage.nk : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{AB0F0869-8D69-4025-B8E0-3A978AE25883}\RP628\A0157391.dll -> Not-A-Virus.Hoax.Win32.Renos.dp : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{AB0F0869-8D69-4025-B8E0-3A978AE25883}\RP629\A0157494.dll -> Not-A-Virus.Hoax.Win32.Renos.dp : Cleaned with backup (quarantined).
C:\backups\viruxz.dll.bck -> Not-A-Virus.Hoax.Win32.Renos.dp : Cleaned with backup (quarantined).
C:\WINDOWS\system32\stonedrv.exe -> Proxy.Small.bo : Cleaned with backup (quarantined).
:mozilla.6:C:\Documents and Settings\test\Application Data\Mozilla\Firefox\Profiles\982lytb4.default\cookies.txt -> TrackingCookie.Sextracker : Cleaned.
:mozilla.7:C:\Documents and Settings\test\Application Data\Mozilla\Firefox\Profiles\982lytb4.default\cookies.txt -> TrackingCookie.Sextracker : Cleaned.
C:\WINDOWS\lsasss.dll -> Trojan.Agent.cl : Cleaned with backup (quarantined).
C:\WINDOWS\smsrss.dll -> Trojan.Agent.cl : Cleaned with backup (quarantined).
C:\WINDOWS\svchost.dll.tmp -> Trojan.Agent.cl : Cleaned with backup (quarantined).
C:\WINDOWS\svchost2.dll.tmp -> Trojan.Agent.cl : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{AB0F0869-8D69-4025-B8E0-3A978AE25883}\RP631\A0157599.dll -> Trojan.Agent.fk : Cleaned with backup (quarantined).
C:\WINDOWS\system32\cmlgyq.dll -> Trojan.Agent.fk : Cleaned with backup (quarantined).
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\I3G9K3AT\south_africa[1].exe -> Trojan.Dialer.az : Cleaned with backup (quarantined).
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\GPOKXJYZ\south_africa[2].exe -> Trojan.Dialer.az : Cleaned with backup (quarantined).
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\WNHD6OQA\SouthAfrica[1].exe -> Trojan.Dialer.jr : Cleaned with backup (quarantined).
C:\WINDOWS\system32\config\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\WNHD6OQA\SouthAfrica[2].exe -> Trojan.Dialer.jr : Cleaned with backup (quarantined).
C:\Documents and Settings\test\Local Settings\Temp\k_6F95.tmp -> Trojan.EliteBar.f : Cleaned with backup (quarantined).
C:\Documents and Settings\test\Local Settings\Temp\k_A095.tmp -> Trojan.EliteBar.f : Cleaned with backup (quarantined).
C:\Documents and Settings\test\Local Settings\Temp\k_B86A.tmp -> Trojan.EliteBar.f : Cleaned with backup (quarantined).
C:\Documents and Settings\test\Local Settings\Temp\131700_3924_3088_4084_79.41.tst -> Trojan.EliteBar.h : Cleaned with backup (quarantined).
C:\Documents and Settings\test\Local Settings\Temp\131830_660_1288_2376_79.41.tst -> Trojan.EliteBar.h : Cleaned with backup (quarantined).
C:\Documents and Settings\test\Local Settings\Temp\198046_2148_1804_3172_79.41.tst -> Trojan.EliteBar.h : Cleaned with backup (quarantined).
C:\Documents and Settings\test\Local Settings\Temp\65742_864_420_2320_79.41.tst -> Trojan.EliteBar.h : Cleaned with backup (quarantined).
C:\Documents and Settings\test\Local Settings\Temp\65760_540_2040_2352_79.41.tst -> Trojan.EliteBar.h : Cleaned with backup (quarantined).
C:\Documents and Settings\test\Local Settings\Temp\66174_1508_1708_1168_79.41.tst -> Trojan.EliteBar.h : Cleaned with backup (quarantined).
C:\Documents and Settings\test\Local Settings\Temp\721590_3404_1404_2276_79.41.tst -> Trojan.EliteBar.h : Cleaned with backup (quarantined).
C:\Documents and Settings\test\Local Settings\Temp\918154_152_1636_2160_79.41.tst -> Trojan.EliteBar.h : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{AB0F0869-8D69-4025-B8E0-3A978AE25883}\RP629\A0157481.dll -> Trojan.Fakealert : Cleaned with backup (quarantined).
C:\WINDOWS\system32\imfdfcj.dll.bck -> Trojan.Fakealert : Cleaned with backup (quarantined).
C:\!KillBox\winhjd32.dll -> Trojan.Klone.f : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{AB0F0869-8D69-4025-B8E0-3A978AE25883}\RP631\A0157598.dll -> Trojan.Klone.f : Cleaned with backup (quarantined).
C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\ibm00004.dll (1).dll.bck -> Trojan.Sinowal.am : Cleaned with backup (quarantined).
C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00003.dll -> Trojan.Sinowal.am : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{AB0F0869-8D69-4025-B8E0-3A978AE25883}\RP617\A0153295.dll -> Trojan.Sinowal.am : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{AB0F0869-8D69-4025-B8E0-3A978AE25883}\RP628\A0157393.dll -> Trojan.Sinowal.am : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{AB0F0869-8D69-4025-B8E0-3A978AE25883}\RP628\A0157394.dll -> Trojan.Sinowal.am : Cleaned with backup (quarantined).
C:\Program Files\Common Files\Microsoft Shared\Web Folders\1033\ibm00004.dll.bck -> Trojan.Sinowal.ap : Cleaned with backup (quarantined).
C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00004.dll -> Trojan.Sinowal.ap : Cleaned with backup (quarantined).
C:\System Volume Information\_restore{AB0F0869-8D69-4025-B8E0-3A978AE25883}\RP617\A0153296.dll -> Trojan.Sinowal.ap : Cleaned with backup (quarantined).
C:\WINDOWS\system32\1024 -> Trojan.Small : Cleaned with backup (quarantined).
C:\WINDOWS\system32\1024\ld1DC0.tmp -> Trojan.Small : Cleaned with backup (quarantined).
C:\WINDOWS\system32\1024\ld2FA7.tmp -> Trojan.Small : Cleaned with backup (quarantined).
C:\WINDOWS\system32\1024\ld514A.tmp -> Trojan.Small : Cleaned with backup (quarantined).
C:\WINDOWS\system32\1024\ld5496.tmp -> Trojan.Small : Cleaned with backup (quarantined).
C:\WINDOWS\system32\1024\ld5E5A.tmp -> Trojan.Small : Cleaned with backup (quarantined).
C:\WINDOWS\system32\1024\ld5F6A.tmp -> Trojan.Small : Cleaned with backup (quarantined).
C:\WINDOWS\system32\1024\ld783B.tmp -> Trojan.Small : Cleaned with backup (quarantined).
C:\WINDOWS\system32\1024\ld7B60.tmp -> Trojan.Small : Cleaned with backup (quarantined).
C:\WINDOWS\system32\1024\ld7E73.tmp -> Trojan.Small : Cleaned with backup (quarantined).
C:\WINDOWS\system32\1024\ld83DD.tmp -> Trojan.Small : Cleaned with backup (quarantined).
C:\WINDOWS\system32\1024\ld8797.tmp -> Trojan.Small : Cleaned with backup (quarantined).
C:\WINDOWS\system32\1024\ld9A96.tmp -> Trojan.Small : Cleaned with backup (quarantined).
C:\WINDOWS\system32\1024\ldB2C1.tmp -> Trojan.Small : Cleaned with backup (quarantined).
C:\WINDOWS\system32\1024\ldCDA0.tmp -> Trojan.Small : Cleaned with backup (quarantined).
C:\WINDOWS\system32\1024\ldCDCB.tmp -> Trojan.Small : Cleaned with backup (quarantined).
C:\WINDOWS\system32\1024\ldDF30.tmp -> Trojan.Small : Cleaned with backup (quarantined).
C:\WINDOWS\system32\1024\ldE3F.tmp -> Trojan.Small : Cleaned with backup (quarantined).
C:\WINDOWS\system32\1024\ldEBC.tmp -> Trojan.Small : Cleaned with backup (quarantined).
C:\Program Files\Common Files\{A8927219-07E3-7177-0925-03092900001b}\Update.exe -> Trojan.Starter.65 : Cleaned with backup (quarantined).


::Report end
Post #6 last edited
Looks like a lot of malware has been removed now :)


Download Panda activescan
  • Once you are on the Panda site click the Scan your PC button
  • A new window will open…click the Check Now button
  • Enter your Country > Enter your State/Province >Enter your e-mail address and click send
  • Select either Home User or Company
  • Click the big Scan Now button
  • If it wants to install an ActiveX component allow it
  • It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
  • When download is complete, click on Local Disks to start the scan
  • When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.
Reboot the computer

Please post this report in together with a fresh HijackThis log in your next reply. :)
Post #7
Logfile of HijackThis v1.99.1
Scan saved at 01:01:41 PM, on 2006/11/05
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\gearsec.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\MsPMSPSv.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 168.167.21.8:8080
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll (file missing)
O4 - HKLM\..\Run: [CloneCDElbyCDFL] "C:\Program Files\Elaborate Bytes\CloneCD\ElbyCheck.exe" /L ElbyCDFL
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SoundMano] C:\WINDOWS\sndmano.exe
O4 - HKLM\..\Run: [Zone Labs Client] C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_05\bin\jusched.exe
O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [STYLEXP] C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_05\bin\npjpi150_05.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab31267.cab
O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe…nt.cab31267.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmesse…pdownloader.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{A0ABBD57-988E-4C4D-A606-3F05300856C0}: NameServer = 196.43.46.190 196.43.38.190
O17 - HKLM\System\CCS\Services\Tcpip\..\{E69336E1-E304-4238-94B1-F52A325F75A8}: NameServer = 192.168.0.25
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: GearSecurity - GEAR Software - C:\WINDOWS\system32\gearsec.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe







Incident Status Location

Dialer:Dialer.HZP Not disinfected C:\backups\backup-20061104-110734-252.inf
Dialer:Dialer.HZP Not disinfected C:\backups\backup-20061104-110736-292.inf
Adware:Adware/PurityScan Not disinfected C:\backups\backup-20061104-110737-707.inf
Adware:adware/tvmedia Not disinfected C:\Documents and Settings\CJ\Application Data\tvmuknwrd.dll
Adware:adware/securityerror Not disinfected C:\Documents and Settings\CJ\Favorites\Antivirus Test Online.url
Potentially unwanted tool:Application/MotherboardMonitor.A Not disinfected C:\Documents and Settings\CJ\My Documents\CJ's Stuff\My Documents\fractal.zip[fractal/system/dll/moo/moo.dll]
Potentially unwanted tool:Application/MotherboardMonitor.A Not disinfected C:\Documents and Settings\CJ\My Documents\fractal.zip[fractal/system/dll/moo/moo.dll]
Virus:Bck/Webdor.AV Disinfected C:\Documents and Settings\test\Local Settings\Temp\mscmsgn.exe
Potentially unwanted tool:Application/MotherboardMonitor.A Not disinfected C:\fractal\fractal\system\dll\moo\moo.dll
Potentially unwanted tool:Application/MotherboardMonitor.A Not disinfected C:\fractal\fractal.rar[fractal\system\dll\moo\moo.dll]
Virus:W32/Oscarbot.BO.worm Disinfected C:\MS-DOS.PIF
Spyware:Spyware/Virtumonde Not disinfected C:\Program Files\Common Files\{A8927219-07E3-7177-0925-03092900001b}\services.dll
Adware:Adware/NetPals Not disinfected C:\WINDOWS\Downloaded Program Files\ATPartners.inf
Adware:Adware/Wazzup Not disinfected C:\WINDOWS\nnx32.dll.tmp
Dialer:Dialer.Gen Not disinfected C:\WINDOWS\switchagreement.txt
Adware:Adware/PurityScan Not disinfected C:\WINDOWS\system32\ddp.dll
Adware:Adware/PurityScan Not disinfected C:\WINDOWS\system32\jwi.dll
Virus:Bck/Webdor.AV Disinfected C:\WINDOWS\volumec.exe
Virus:W32/Gaobot.gen.worm Disinfected C:\WINPRO0.EXE
Virus:W32/Gaobot.gen.worm Disinfected C:\WINPRO1.EXE
Virus:W32/Gaobot.gen.worm Disinfected C:\WINPRO3.EXE
Virus:W32/Gaobot.gen.worm Disinfected C:\WINPRO9.EXE
Virus:W32/Gaobot.gen.worm Disinfected C:\WINPROC.EXE
Post #8
Download en run TV Media removal

Download Combofix to your desktop.
  • Doubleclick combo.exe and follow the prompts.
  • Type Y and click “enter”.
Don't click on the window while the fix is running, because that will cause your system to hang!
  • Reboot the computer after the fix is done
  • Automaticle a log should open named combofix.txt. (location: C:\combofix.txt)
  • Post this log in your next reply together with a new HijackThislog
:)
Post #9
hmmm When I run The TVmedia program, it say T.V media is not installed. I guess thats ok? The Combofix just opens an msdos window and say access denied, and disappears?
Post #10 last edited
Abt TV media thats okay :thumbup:

Abt Combo: If the DOS box is black, that means command line extensions is disabled.
If blue, extensions are enabled.

Make sure that ComboFix is on your desktop.

Then run the tool from Start -> Run and type (or copy and paste) the following:

"%userprofile%\desktop\combofix.exe"

Click OK.


Edit….

Download Regsrch.vbs and scroll down (the download programs are listed in alphabetical order) to:
Registry Search Tool.
Note! If your antivirus program gives a reaction please disable Script blocking.
Unzip and run RegSrch.vbs
Copy and paste this string in bold into the dialog box: A8927219-07E3-7177-0925-03092900001b
After a while a prompt will come up. Click OK to write the results to Wordpad and post the log which is generated. :)
Post #11
Hey. With combofix, the exact same thing is happening (except now it say access denied twice instead of once before closing). you said something about line extentions, how do I turn them on if it is off? With regsrch, it say no Instances of A8927219-07E3-7177-0925-03092900001b could be found.
Post #12
I wonder if your account runs under insufficient user rights (running under limited account).
Did you check wether you have all the needed rights?

Lets do a little test.
Go to Start > run and type: CMD
You probably will see a black DOS window with C:>
Please give a simple order like ping to your IP address and click enter.
See what happens en tell me in your next reply.
Post #14
Something is still uploading from my computer like crazy :/ Its a concern, because I have a download limit and then I get capped. What do you think could be causing it?
Post #15
I think it is still this Backdoor.Win32.Rbot, but there was/is a lot of malware at your computer and unfortunately you cannot run the Combofix who would kill a great deal of that malware and show me some reports about the files that were installed lately'

1. Please download Brute Force Uninstaller to your desktop.
  • Right click the BFU folder on your desktop, and choose Extract All
  • Click "Next"
  • In the box to choose where to extract the files to,
  • Click "Browse"
  • Click on the + sign next to "My Computer"
  • Click on "Local Disk (C:) or whatever your primary drive is
  • Click "Make New Folder"
  • Type in BFU
  • Click "Next", and Uncheck the "Show Extracted Files" box and then click "Finish".

2. RIGHT-CLICK HERE and choose "Save As" (in IE it's "Save Target As") in order to download Alcra PLUS Remover.
Save it in the same folder you made earlier (c:\BFU).

3. Open My Computer and navigate to the c:\BFU folder.
  • Start the Brute Force Uninstaller by double-clicking BFU.exe
  • Behind the scriptline to execute field click the folder icon [external image: Posted Image]
    and select alcanshorty.bfu
  • Press Execute and let the program do it’s job. (You ought to see a progress bar if you did this correctly.)
  • Wait for the complete script execution box to pop up and press OK.
  • Press exit to terminate the BFU program.
If you have any questions about the use of BFU please read here:
http://metallica.geekstogo.com/BFUinstructions.html

Reboot the computer and post back with a fresh HJT log :)

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI