Spyware / Malware / Virus Removal

Help, for a Dialer (i-Dialer or WinXX.tmp.exe)

4 min read

Looking for the outcome? Ask AI

sb69 Topic Starter

Post #1November 17, 2006, 9:37 AM UTC

Hi everybody,
I don't know ho it happens but I was infected by one or two dialer.
I scanned PC with AVG Antivirus, Avast Antivirus, Adware SE, Spy Bot (all of them are updated).
I hope here someone can help me.

Thanks in advance for the help.

Logfile of HijackThis v1.99.1
Scan saved at 9.40.03, on 17/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\oodag.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Programmi\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\acer\epm\epm-dm.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\Programmi\Logitech\MouseWare\system\em_exec.exe
C:\Programmi\TomTom HOME\TomTomHOME.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Programmi\File comuni\PCSuite\Services\ServiceLayer.exe
C:\PROGRA~1\FILECO~1\Nokia\MPAPI\MPAPI3s.exe
C:\PROGRA~1\Webshots\webshots.scr
C:\PROGRA~1\MICROS~2\OFFICE11\OUTLOOK.EXE
C:\Documents and Settings\simone\Desktop\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gambabruno.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 172.30.1.1:8002
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programmi\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [AzMixerSel] C:\Programmi\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RemoteControl] C:\Programmi\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Programmi\Acer\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [WinVNC] "C:\Programmi\UltraVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Programmi\TomTom HOME\TomTomHOME.exe" -s
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PcSync] C:\Programmi\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - Startup: Webshots.lnk = C:\Programmi\Webshots\Launcher.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1137579774765
O16 - DPF: {C45B1500-7B63-47C2-AB25-C28CB46AFDEE} (Net Music Media Bar) - http://sib1.od2.com/common/musicmanager/in…nagerPlugin.CAB
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = milanodomain.com
O17 - HKLM\Software\..\Telephony: DomainName = milanodomain.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = milanodomain.com
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: winmfu32 - C:\WINDOWS\SYSTEM32\winmfu32.dll
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programmi\File comuni\PCSuite\Services\ServiceLayer.exe
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Programmi\UltraVNC\WinVNC.exe" -service (file missing)

Susan528

Post #2November 17, 2006, 8:24 PM UTC

Hello sb69 and Welcome to TomCoyote,

Please do the following:

Use a Firewall – I do not see a firewall application installed. Please do not rely upon the Windows XP firewall. For a tutorial on Firewalls and a listing of some available ones see the link below:
Understanding and Using Firewalls

Test your Firewall - Please test your firewall and make sure it is working properly.
Test Firewall

Combofix

Download this file - combofix.exe
Double click combofix.exe & follow the prompts.
When finished, it shall produce a log for you. Post that log in your next reply

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Please post the ComboFix log, and a new hijackthis log.

sb69

Post #3November 19, 2006, 12:27 AM UTC

Hi,

COMBOFIXLOG:

simone - 06-11-19 1.04.12,18 Service Pack 2
ComboFix 06.11.9 - Running from: "D:\Temp"

((((((((((((((((((((((((((((((( Files Created from 2006-10-19 to 2006-11-19 ))))))))))))))))))))))))))))))))))

2006-11-16 15:41 90,112 –a—— C:\WINDOWS\system32\AVASTSS.scr
2006-11-16 15:41 87,424 –a—— C:\WINDOWS\system32\drivers\aswmon2.sys
2006-11-16 15:41 85,952 –a—— C:\WINDOWS\system32\drivers\aswmon.sys
2006-11-16 15:41 666,240 –a—— C:\WINDOWS\system32\aswBoot.exe
2006-11-16 15:41 36,176 –a—— C:\WINDOWS\system32\drivers\aswTdi.sys
2006-11-16 15:41 24,560 –a—— C:\WINDOWS\system32\drivers\aavmker4.sys
2006-11-16 15:41 16,352 –a—— C:\WINDOWS\system32\drivers\aswRdr.sys
2006-11-14 22:17 15,872 –a—— C:\WINDOWS\system32\winmfu32.dll
2006-11-09 14:42 2,560 ——— C:\WINDOWS\system32\drivers\cdralw2k.sys
2006-11-09 14:42 2,432 ——— C:\WINDOWS\system32\drivers\cdr4_xp.sys
2006-11-09 14:42 129,784 ——— C:\WINDOWS\system32\pxafs.dll
2006-11-06 15:34 299,582 –a—— C:\WINDOWS\uninst.exe
2006-11-04 14:14 1,245,696 –a—— C:\WINDOWS\system32\msxml4.dll
2006-11-02 23:39 36,528 ——— C:\WINDOWS\system32\drivers\PxHelp20.sys
2006-11-02 23:39 115,880 ——— C:\WINDOWS\system32\pxinsi64.exe
2006-11-02 23:39 108,544 ——— C:\WINDOWS\system32\pxcpyi64.exe
2006-10-20 18:42 20,096 –a—— C:\WINDOWS\system32\drivers\AnyDVD.sys

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

2006-11-17 09:55 ——– d——– C:\Programmi\MSXML 4.0
2006-11-16 15:41 ——– d——– C:\Programmi\Alwil Software
2006-11-09 14:42 ——– d——– C:\Programmi\Winamp
2006-11-09 14:23 40 —hs—- C:\Documents and Settings\simone\Dati applicazioni\.zreglib
2006-10-13 13:35 65536 –a—— C:\WINDOWS\system32\nwwks.dll
2006-10-13 13:35 64000 –a—— C:\WINDOWS\system32\nwapi32.dll
2006-10-13 13:35 143360 –a—— C:\WINDOWS\system32\nwprovau.dll
2006-10-13 11:23 163584 –a—— C:\WINDOWS\system32\drivers\nwrdr.sys
2006-10-02 20:04 806912 –a—— C:\WINDOWS\system32\divx_xx0c.dll
2006-10-02 20:04 806912 –a—— C:\WINDOWS\system32\divx_xx07.dll
2006-10-02 20:04 790528 –a—— C:\WINDOWS\system32\divx_xx11.dll
2006-10-02 20:04 635486 –a—— C:\WINDOWS\system32\DivX.dll
2006-09-13 07:03 1084416 –a—— C:\WINDOWS\system32\msxml3.dll
2006-08-25 17:51 617472 –a—— C:\WINDOWS\system32\comctl32.dll
2006-08-21 14:26 16896 –a—— C:\WINDOWS\system32\fltlib.dll
2006-08-21 11:14 23040 –a—— C:\WINDOWS\system32\fltMc.exe

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\ctfmon.exe"
"MSMSGS"="\"C:\\Programmi\\Messenger\\msmsgs.exe\" /background"
"PcSync"="C:\\Programmi\\Nokia\\Nokia PC Suite 6\\PcSync2.exe /NoDialog"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"LaunchApp"="Alaunch"
"High Definition Audio Property Page Shortcut"="HDAShCut.exe"
"AzMixerSel"="C:\\Programmi\\Realtek\\InstallShield\\AzMixerSel.exe"
"SynTPLpr"="C:\\Programmi\\Synaptics\\SynTP\\SynTPLpr.exe"
"SynTPEnh"="C:\\Programmi\\Synaptics\\SynTP\\SynTPEnh.exe"
"RemoteControl"="C:\\Programmi\\CyberLink\\PowerDVD\\PDVDServ.exe"
"BluetoothAuthenticationAgent"="rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent"
"IMJPMIG8.1"="\"C:\\WINDOWS\\IME\\imjp8_1\\IMJPMIG.EXE\" /Spoil /RemAdvDef /Migration32"
"MSPY2002"="C:\\WINDOWS\\system32\\IME\\PINTLGNT\\ImScInst.exe /SYNC"
"PHIME2002ASync"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /SYNC"
"PHIME2002A"="C:\\WINDOWS\\system32\\IME\\TINTLGNT\\TINTSETP.EXE /IMEName"
"RTHDCPL"="RTHDCPL.EXE"
"Alcmtr"="ALCMTR.EXE"
"igfxtray"="C:\\WINDOWS\\system32\\igfxtray.exe"
"igfxhkcmd"="C:\\WINDOWS\\system32\\hkcmd.exe"
"igfxpers"="C:\\WINDOWS\\system32\\igfxpers.exe"
"EPM-DM"="c:\\acer\\epm\\epm-dm.exe"
"ePowerManagement"="C:\\Acer\\ePM\\ePM.exe boot"
"LManager"="C:\\PROGRA~1\\LAUNCH~1\\QtZgAcer.EXE"
"eRecoveryService"="C:\\Programmi\\Acer\\eRecovery\\Monitor.exe"
"Logitech Utility"="Logi_MwX.Exe"
"WinVNC"="\"C:\\Programmi\\UltraVNC\\WinVNC.exe\" -servicehelper"
"PCSuiteTrayApplication"="C:\\PROGRA~1\\Nokia\\NOKIAP~1\\LAUNCH~1.EXE -startup"
"TomTomHOME.exe"="\"C:\\Programmi\\TomTom HOME\\TomTomHOME.exe\" -s"
"Synchronization Manager"=hex(2):25,53,79,73,74,65,6d,52,6f,6f,74,25,5c,73,79,\
73,74,65,6d,33,32,5c,6d,6f,62,73,79,6e,63,2e,65,78,65,20,2f,6c,6f,67,6f,6e,\
00
"avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000005

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="Pagina iniziale corrente"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,00,01,00,00,00,00,00,00,00,04,00,00,02,03,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,4e,00,00,00,00,00,00,00,b2,03,00,00,e2,02,\
00,00,04,00,00,40
"RestoredStateInfo"=hex:18,00,00,00,4e,00,00,00,00,00,00,00,b2,03,00,00,e2,02,\
00,00,01,00,00,00

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\run]
"CTFMON.EXE"="C:\\WINDOWS\\system32\\CTFMON.EXE"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Precaricatore Browseui"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Daemon di cache delle categorie di componenti"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winmfu32

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

Completion time: 06-11-19 1:05:09.75
C:\ComboFix.txt … 06-11-19 01:05

HIJACKTHIS LOG:Logfile of HijackThis v1.99.1
Scan saved at 1.13.31, on 19/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Acer\eManager\anbmServ.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\oodag.exe
C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Programmi\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\acer\epm\epm-dm.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\WINDOWS\Logi_MwX.Exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\Programmi\TomTom HOME\TomTomHOME.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\PROGRA~1\Webshots\webshots.scr
C:\PROGRA~1\FILECO~1\Nokia\MPAPI\MPAPI3s.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\Programmi\File comuni\PCSuite\Services\ServiceLayer.exe
C:\Programmi\Internet Explorer\iexplore.exe
C:\Documents and Settings\simone\Menu Avvio\Programmi\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gambabruno.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 172.30.1.1:8002
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [AzMixerSel] C:\Programmi\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RemoteControl] C:\Programmi\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Programmi\Acer\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [WinVNC] "C:\Programmi\UltraVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE -startup
O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Programmi\TomTom HOME\TomTomHOME.exe" -s
O4 - HKLM\..\Run: [Synchronization Manager] %SystemRoot%\system32\mobsync.exe /logon
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PcSync] C:\Programmi\Nokia\Nokia PC Suite 6\PcSync2.exe /NoDialog
O4 - Startup: Webshots.lnk = C:\Programmi\Webshots\Launcher.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1137579774765
O16 - DPF: {C45B1500-7B63-47C2-AB25-C28CB46AFDEE} (Net Music Media Bar) - http://sib1.od2.com/common/musicmanager/in…nagerPlugin.CAB
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = milanodomain.com
O17 - HKLM\Software\..\Telephony: DomainName = milanodomain.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = milanodomain.com
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: winmfu32 - C:\WINDOWS\SYSTEM32\winmfu32.dll
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: O&O Defrag - O&O Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programmi\File comuni\PCSuite\Services\ServiceLayer.exe
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Programmi\UltraVNC\WinVNC.exe" -service (file missing)

I founded this file in Windows\temp : Perflib_Perfdata_194.dat that I can't delete. It's connected to the dialer becuse I see Perfdata in Process Explorer when dialer appear.
Could this help ?

Thanks

Susan528

Post #4November 19, 2006, 12:58 AM UTC last edited November 19, 2006, 12:59 AM UTC

Please do the following:

STEP 1.
======
SpySweeper
Download the trial version of Spy Sweeper from Here

Install it using the Standard Install option. (You will be asked for your e-mail address, it is safe to give it. If you receive alerts from your firewall, allow all activities for Spy Sweeper)

If you are taken to the internet page, just close the page.
You will be prompted to check for updated definitions, please do so.
(This may take several minutes)
Click on Options > Sweep Options and check Sweep all Folders on Selected drives. Check Local Disc C. Under What to Sweep, check every box.
Click on Sweep and allow it to fully scan your system.If you are prompted to restart the computer, do so immediately. This is a necessary step to kill the infection!
When the sweep has finished, click Remove. Click Select All and then Next
From 'Results', select the Session Log tab. Click Save to File and save the log somewhere convenient.

STEP 2.
======
The AVG anti-spyware program’s detection rate is excellent. After the Trial has expired, the auto updates and real time protection stop but you can still update it manually and run scans anytime you want.

First download AVG anti-spyware 7.5 from HERE and save that file to your
desktop.
This is a 30 day trial of the program

Once you have downloaded AVG anti-spyware , locate the icon on the desktop
and double-click it to launch the set up program.
Once the setup is complete you will need run AVG anti-spyware and update the definition
files.
On the main screen select the icon "Update" then select the "
Update now" link.
- Next select the "Start Update" button, the update will start and a
  progress bar will show the updates being installed.
Once the update has completed select the "Scanner" icon at the top of
the screen, then select the "Settings" tab.
Once in the Settings screen click on "Recommended actions" and then
select "Quarantine".
Under "Reports"
- Select "Automatically generate report after every scan"
- Un-Select "Only if threats were found"

Close AVG anti-spyware , Do Not run a scan just yet, we will shortly.

Reboot your computer into SafeMode. You can do this by restarting
your computer and continually tapping the F8 key until a menu appears.

Use your up arrow key to highlight SafeMode then hit enter.
IMPORTANT: Do not open any other windows or
programs while AVG anti-spyware is scanning, it may interfere with the scanning proccess:
Lauch ewido-anti-spyware by double-clicking the icon on your desktop.
Select the "Scanner" icon at the top and then the "Scan" tab
then click on "Complete System Scan".
AVG anti-spyware will now begin the scanning process, be patient this may take a little
time.
Once the scan is complete do the following:
If you have any infections you will prompted, then select "Apply all
actions"
Next select the "Reports" icon at the top.
Select the "Save report as" button in the lower left hand of the
screen and save it to a text file on your system (make sure to remember where
you saved that file, this is important).
Close AVG anti-spyware and reboot your system back into Normal Mode and post the
results of the AVG anti-spyware report scan.

Please post the results from SpySweeper, AVG anti-spyware and a new hijackthis log.

sb69

Post #5November 20, 2006, 12:10 AM UTC

Hello Susan528,

thanks again for your help.
As soon as I installed AVG Antyspy, it founded the dialers.
Anyway I followed your intruction and here are the 3 logs.

AVG under win in safe mode seems that have cleaned my laptop.

SPY SWEEPER LOG:

23.28: Removal process completed. Elapsed time 00.00.05
23.28: Quarantining All Traces: yieldmanager cookie
23.28: Quarantining All Traces: yadro cookie
23.28: Quarantining All Traces: toplist cookie
23.28: Quarantining All Traces: hbmediapro cookie
23.28: Quarantining All Traces: burstnet cookie
23.28: Quarantining All Traces: freestats.net cookie
23.28: Quarantining All Traces: casalemedia cookie
23.28: Quarantining All Traces: clicktracks cookie
23.28: Quarantining All Traces: adjuggler cookie
23.28: Quarantining All Traces: web-stat cookie
23.28: Quarantining All Traces: l2m.net cookie
23.28: Quarantining All Traces: 123count cookie
23.28: Quarantining All Traces: azjmp cookie
23.28: Quarantining All Traces: atwola cookie
23.28: Quarantining All Traces: webtrends cookie
23.28: Quarantining All Traces: xiti cookie
23.28: Quarantining All Traces: bpath cookie
23.28: Quarantining All Traces: seeq cookie
23.28: Quarantining All Traces: a cookie
23.28: Quarantining All Traces: touchclarity cookie
23.28: Quarantining All Traces: servlet cookie
23.28: Quarantining All Traces: 2o7.net cookie
23.28: Quarantining All Traces: 190dotcom cookie
23.28: Quarantining All Traces: trojan agent winlogonhook
23.28: Removal process initiated
23.26: Traces Found: 45
23.26: Full Sweep has completed. Elapsed time 00.24.10
23.26: File Sweep Complete, Elapsed Time: 00.18.28
23.24: Warning: Failed to access drive E:
23.15: Warning: Failed to open file "c:\documents and settings\simone\impostazioni locali\dati applicazioni\microsoft\windows\usrclass.dat". Impossibile accedere al file. Il file è utilizzato da un altro processo
23.15: Warning: Failed to open file "c:\documents and settings\simone\impostazioni locali\dati applicazioni\microsoft\windows\usrclass.dat.log". Impossibile accedere al file. Il file è utilizzato da un altro processo
23.15: Warning: Failed to open file "c:\documents and settings\simone\ntuser.dat.log". Impossibile accedere al file. Il file è utilizzato da un altro processo
23.15: Warning: Failed to open file "c:\documents and settings\simone\ntuser.dat". Impossibile accedere al file. Il file è utilizzato da un altro processo
23.14: Warning: Failed to open file "c:\documents and settings\localservice\dati applicazioni\webroot\spy sweeper\data\settings.dat". Impossibile accedere al file. Il file è utilizzato da un altro processo
23.14: Warning: Failed to open file "c:\documents and settings\localservice\impostazioni locali\dati applicazioni\microsoft\windows\usrclass.dat.log". Impossibile accedere al file. Il file è utilizzato da un altro processo
23.14: Warning: Failed to open file "c:\documents and settings\localservice\impostazioni locali\dati applicazioni\microsoft\windows\usrclass.dat". Impossibile accedere al file. Il file è utilizzato da un altro processo
23.14: Warning: Failed to open file "c:\documents and settings\localservice\ntuser.dat.log". Impossibile accedere al file. Il file è utilizzato da un altro processo
23.14: Warning: Failed to open file "c:\documents and settings\localservice\ntuser.dat". Impossibile accedere al file. Il file è utilizzato da un altro processo
23.14: Warning: Failed to open file "c:\documents and settings\networkservice\impostazioni locali\dati applicazioni\microsoft\windows\usrclass.dat.log". Impossibile accedere al file. Il file è utilizzato da un altro processo
23.14: Warning: Failed to open file "c:\documents and settings\networkservice\impostazioni locali\dati applicazioni\microsoft\windows\usrclass.dat". Impossibile accedere al file. Il file è utilizzato da un altro processo
23.14: Warning: Failed to open file "c:\documents and settings\networkservice\ntuser.dat.log". Impossibile accedere al file. Il file è utilizzato da un altro processo
23.14: Warning: Failed to open file "c:\documents and settings\networkservice\ntuser.dat". Impossibile accedere al file. Il file è utilizzato da un altro processo
23.13: Warning: Failed to open file "c:\windows\softwaredistribution\eventcache\{29a9a251-e75f-4e1f-80a4-6fdc7bdfc727}.bin". Impossibile accedere al file. Il file è utilizzato da un altro processo
23.13: Warning: Failed to open file "c:\windows\temp\_avast4_\webshlock.txt". Impossibile accedere al file. Il file è utilizzato da un altro processo
23.13: Warning: Failed to open file "c:\windows\temp\perflib_perfdata_6e0.dat". Impossibile accedere al file. Il file è utilizzato da un altro processo
23.09: Warning: Failed to open file "c:\windows\system32\config\default". Impossibile accedere al file. Il file è utilizzato da un altro processo
23.09: Warning: Failed to open file "c:\windows\system32\config\software". Impossibile accedere al file. Il file è utilizzato da un altro processo
23.09: Warning: Failed to open file "c:\windows\system32\config\system". Impossibile accedere al file. Il file è utilizzato da un altro processo
23.09: Warning: Failed to open file "c:\windows\system32\config\security.log". Impossibile accedere al file. Il file è utilizzato da un altro processo
23.09: Warning: Failed to open file "c:\windows\system32\config\sam.log". Impossibile accedere al file. Il file è utilizzato da un altro processo
23.09: Warning: Failed to open file "c:\windows\system32\config\sam". Impossibile accedere al file. Il file è utilizzato da un altro processo
23.09: Warning: Failed to open file "c:\windows\system32\config\security". Impossibile accedere al file. Il file è utilizzato da un altro processo
23.09: Warning: Failed to open file "c:\windows\system32\config\default.log". Impossibile accedere al file. Il file è utilizzato da un altro processo
23.09: Warning: Failed to open file "c:\windows\system32\config\software.log". Impossibile accedere al file. Il file è utilizzato da un altro processo
23.09: Warning: Failed to open file "c:\windows\system32\config\system.log". Impossibile accedere al file. Il file è utilizzato da un altro processo
23.08: Warning: Failed to open file "c:\hiberfil.sys". Accesso negato
23.08: Warning: Failed to open file "c:\pagefile.sys". Accesso negato
23.08: Starting File Sweep
23.08: Cookie Sweep Complete, Elapsed Time: 00.00.01
23.08: c:\documents and settings\simone\cookies\simone@azjmp[2].txt (ID = 2270)
23.08: c:\documents and settings\simone\cookies\simone@yadro[1].txt (ID = 3743)
23.08: c:\documents and settings\simone\cookies\[removed][3].txt (ID = 2768)
23.08: c:\documents and settings\simone\cookies\simone@divx.112.2o7[1].txt (ID = 1958)
23.08: c:\documents and settings\simone\cookies\simone@atwola[1].txt (ID = 2255)
23.08: c:\documents and settings\simone\cookies\[removed][2].txt (ID = 3751)
23.08: Found Spy Cookie: yieldmanager cookie
23.08: c:\documents and settings\simone\cookies\simone@yadro[2].txt (ID = 3743)
23.08: Found Spy Cookie: yadro cookie
23.08: c:\documents and settings\simone\cookies\simone@toplist[1].txt (ID = 3557)
23.08: Found Spy Cookie: toplist cookie
23.08: c:\documents and settings\simone\cookies\simone@servlet[2].txt (ID = 3345)
23.08: c:\documents and settings\simone\cookies\[removed][2].txt (ID = 2768)
23.08: Found Spy Cookie: hbmediapro cookie
23.08: c:\documents and settings\simone\cookies\simone@montblanc.122.2o7[1].txt (ID = 1958)
23.08: c:\documents and settings\simone\cookies\[removed][2].txt (ID = 2337)
23.08: Found Spy Cookie: burstnet cookie
23.08: c:\documents and settings\simone\cookies\simone@efashionsolutions.122.2o7[1].txt (ID = 1958)
23.08: c:\documents and settings\simone\cookies\[removed][2].txt (ID = 2705)
23.08: Found Spy Cookie: freestats.net cookie
23.08: c:\documents and settings\simone\cookies\[removed][3].txt (ID = 3669)
23.08: c:\documents and settings\simone\cookies\simone@servlet[3].txt (ID = 3345)
23.08: c:\documents and settings\simone\cookies\[removed][1].txt (ID = 2355)
23.08: Found Spy Cookie: casalemedia cookie
23.08: c:\documents and settings\simone\cookies\[removed][1].txt (ID = 3566)
23.08: c:\documents and settings\simone\cookies\simone@americanexpress.122.2o7[1].txt (ID = 1958)
23.08: c:\documents and settings\simone\cookies\[removed][1].txt (ID = 2407)
23.08: Found Spy Cookie: clicktracks cookie
23.08: c:\documents and settings\simone\cookies\[removed][1].txt (ID = 2071)
23.08: Found Spy Cookie: adjuggler cookie
23.08: c:\documents and settings\simone\cookies\simone@web-stat[2].txt (ID = 3648)
23.08: Found Spy Cookie: web-stat cookie
23.08: c:\documents and settings\simone\cookies\[removed][1].txt (ID = 3566)
23.08: c:\documents and settings\simone\cookies\simone@iao.190[2].txt (ID = 1936)
23.08: c:\documents and settings\simone\cookies\simone@l2m[1].txt (ID = 2913)
23.08: Found Spy Cookie: l2m.net cookie
23.08: c:\documents and settings\simone\cookies\simone@123count[2].txt (ID = 1927)
23.08: Found Spy Cookie: 123count cookie
23.08: c:\documents and settings\simone\cookies\[removed][3].txt (ID = 2321)
23.08: c:\documents and settings\simone\cookies\[removed][1].txt (ID = 3566)
23.08: c:\documents and settings\simone\cookies\simone@microsofteup.112.2o7[1].txt (ID = 1958)
23.08: c:\documents and settings\simone\cookies\simone@azjmp[1].txt (ID = 2270)
23.08: Found Spy Cookie: azjmp cookie
23.08: c:\documents and settings\simone\cookies\simone@112.2o7[1].txt (ID = 1958)
23.08: c:\documents and settings\simone\cookies\simone@atwola[2].txt (ID = 2255)
23.08: Found Spy Cookie: atwola cookie
23.08: c:\documents and settings\simone\cookies\[removed][2].txt (ID = 3669)
23.08: Found Spy Cookie: webtrends cookie
23.08: c:\documents and settings\simone\cookies\simone@xiti[1].txt (ID = 3717)
23.08: Found Spy Cookie: xiti cookie
23.08: c:\documents and settings\simone\cookies\[removed][1].txt (ID = 2321)
23.08: Found Spy Cookie: bpath cookie
23.08: c:\documents and settings\simone\cookies\simone@190[2].txt (ID = 1935)
23.08: c:\documents and settings\simone\cookies\[removed][1].txt (ID = 3332)
23.08: Found Spy Cookie: seeq cookie
23.08: c:\documents and settings\simone\cookies\simone@a[1].txt (ID = 2027)
23.08: Found Spy Cookie: a cookie
23.08: c:\documents and settings\simone\cookies\simone@msnportal.112.2o7[1].txt (ID = 1958)
23.08: c:\documents and settings\simone\cookies\[removed][1].txt (ID = 3566)
23.08: Found Spy Cookie: touchclarity cookie
23.08: c:\documents and settings\simone\cookies\simone@servlet[1].txt (ID = 3345)
23.08: Found Spy Cookie: servlet cookie
23.08: c:\documents and settings\simone\cookies\simone@microsoftwga.112.2o7[1].txt (ID = 1958)
23.08: Found Spy Cookie: 2o7.net cookie
23.08: c:\documents and settings\simone\cookies\simone@190[1].txt (ID = 1935)
23.08: Found Spy Cookie: 190dotcom cookie
23.08: Starting Cookie Sweep
23.08: Registry Sweep Complete, Elapsed Time:00.00.29
23.07: HKLM\software\microsoft\mssmgr\ (ID = 1776755)
23.07: HKLM\software\microsoft\windows nt\currentversion\winlogon\notify\winmfu32\ (ID = 1663005)
23.07: Found Trojan Horse: trojan agent winlogonhook
23.07: Starting Registry Sweep
23.07: Memory Sweep Complete, Elapsed Time: 00.05.05
23.03: Access to Hosts file allowed for C:\PROGRAMMI\GRISOFT\AVG ANTI-SPYWARE 7.5\AVGAS.EXE
23.02: Starting Memory Sweep
23.02: Start Full Sweep
23.02: Sweep initiated using definitions version 805
23.02: Spy Sweeper 5.2.3.2125 started
23.02: | Start of Session, domenica 19 novembre 2006 |
********
23.02: | End of Session, domenica 19 novembre 2006 |
Keylogger: Off
BHO Shield: On
IE Security Shield: On
Alternate Data Stream (ADS) Execution Shield: On
Startup Shield: On
Common Ad Sites: Off
Hosts File Shield: On
Internet Communication Shield: On
ActiveX Shield: On
Windows Messenger Service Shield: On
IE Favorites Shield: On
Spy Installation Shield: On
Memory Shield: On
IE Hijack Shield: On
IE Tracking Cookies Shield: Off
22.58: Shield States
22.57: Spyware Definitions: 790
22.57: Warning: Virus definitions files are invalid, please update your virus definitions. 220
22.57: Spy Sweeper 5.2.3.2125 started
22.57: Spy Sweeper 5.2.3.2125 started
22.57: | Start of Session, domenica 19 novembre 2006 |
********

AVG SPY LOG:

———————————————————
AVG Anti-Spyware - Rapporto scansione
———————————————————

+ Creato alle: 0.41.19 20/11/2006

+ Risultato scansione:

C:\Recycled\Dc9.exe -> Dialer.IDialer.m : Ripulito con backup (in quarantena)
C:\Documents and Settings\simone\Cookies\simone@adbrite[2].txt -> TrackingCookie.Adbrite : Ripulito.
C:\Documents and Settings\simone\Cookies\simone@adbrite[3].txt -> TrackingCookie.Adbrite : Ripulito.
C:\Documents and Settings\simone\Cookies\simone@com[1].txt -> TrackingCookie.Com : Ripulito.
C:\Documents and Settings\simone\Cookies\simone@com[2].txt -> TrackingCookie.Com : Ripulito.
C:\Documents and Settings\simone\Cookies\simone@ivwbox[2].txt -> TrackingCookie.Ivwbox : Ripulito.
C:\Documents and Settings\simone\Cookies\[removed][2].txt -> TrackingCookie.Liveperson : Ripulito.
C:\Documents and Settings\simone\Cookies\simone@www.res99[1].txt -> TrackingCookie.Res99 : Ripulito.
C:\Documents and Settings\simone\Impostazioni locali\Temporary Internet Files\Content.IE5\8N7Z6S1X\srvmkc[1].exe -> Trojan.Dialer.qn : Ripulito con backup (in quarantena)
C:\Documents and Settings\simone\Impostazioni locali\Temporary Internet Files\Content.IE5\GX4H23S5\srvpgc[1].exe -> Trojan.Dialer.qn : Ripulito con backup (in quarantena)
C:\System Volume Information\_restore{03166D38-2C2E-41BA-B11A-1DBEC3AF3358}\RP138\A0017407.exe -> Trojan.Dialer.qn : Ripulito con backup (in quarantena)
C:\System Volume Information\_restore{03166D38-2C2E-41BA-B11A-1DBEC3AF3358}\RP138\A0017408.exe -> Trojan.Dialer.qn : Ripulito con backup (in quarantena)
C:\System Volume Information\_restore{03166D38-2C2E-41BA-B11A-1DBEC3AF3358}\RP140\A0017903.dll -> Trojan.Mezzia : Ripulito con backup (in quarantena)

::Fine rapporto

HI JACKLOG:

Logfile of HijackThis v1.99.1
Scan saved at 0.53.44, on 20/11/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\Alwil Software\Avast4\ashServ.exe
C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Programmi\File comuni\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\oodag.exe
C:\Programmi\Webroot\Spy Sweeper\SpySweeper.exe
C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
C:\Programmi\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\system32\rundll32.exe
C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe
C:\Programmi\Alwil Software\Avast4\ashWebSv.exe
C:\Programmi\Alwil Software\Avast4\setup\avast.setup
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\igfxtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\acer\epm\epm-dm.exe
C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
C:\WINDOWS\Logi_MwX.Exe
C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Programmi\File comuni\PCSuite\Services\ServiceLayer.exe
C:\Programmi\TomTom HOME\TomTomHOME.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Messenger\msmsgs.exe
C:\Programmi\Nokia\Nokia PC Suite 6\PcSync2.exe
C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\PROGRA~1\FILECO~1\Nokia\MPAPI\MPAPI3s.exe
C:\PROGRA~1\Webshots\webshots.scr
C:\Documents and Settings\simone\Menu Avvio\Programmi\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.gambabruno.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://global.acer.com
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://global.acer.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 172.30.1.1:8002
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\Programmi\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O4 - HKLM\..\Run: [LaunchApp] Alaunch
O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] HDAShCut.exe
O4 - HKLM\..\Run: [AzMixerSel] C:\Programmi\Realtek\InstallShield\AzMixerSel.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Programmi\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Programmi\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [RemoteControl] C:\Programmi\CyberLink\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] "rundll32.exe" bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] "C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /SYNC
O4 - HKLM\..\Run: [PHIME2002A] "C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE" /IMEName
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [EPM-DM] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [ePowerManagement] "C:\Acer\ePM\ePM.exe" boot
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\QtZgAcer.EXE
O4 - HKLM\..\Run: [eRecoveryService] C:\Programmi\Acer\eRecovery\Monitor.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [WinVNC] "C:\Programmi\UltraVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [PCSuiteTrayApplication] "C:\PROGRA~1\Nokia\NOKIAP~1\LAUNCH~1.EXE" -startup
O4 - HKLM\..\Run: [TomTomHOME.exe] "C:\Programmi\TomTom HOME\TomTomHOME.exe" -s
O4 - HKLM\..\Run: [Synchronization Manager] "C:\WINDOWS\system32\mobsync.exe" /logon
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Programmi\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [PcSync] "C:\Programmi\Nokia\Nokia PC Suite 6\PcSync2.exe" /NoDialog
O4 - Startup: Webshots.lnk = C:\Programmi\Webshots\Launcher.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Programmi\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&sporta; in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1137579774765
O16 - DPF: {C45B1500-7B63-47C2-AB25-C28CB46AFDEE} (Net Music Media Bar) - http://sib1.od2.com/common/musicmanager/in…nagerPlugin.CAB
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = milanodomain.com
O17 - HKLM\Software\..\Telephony: DomainName = milanodomain.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = milanodomain.com
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - Unknown owner - C:\Programmi\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Programmi\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Programmi\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: O&O; Defrag - O&O; Software GmbH - C:\WINDOWS\system32\oodag.exe
O23 - Service: ServiceLayer - Nokia. - C:\Programmi\File comuni\PCSuite\Services\ServiceLayer.exe
O23 - Service: Sistema Webroot Spy Sweeper (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Programmi\Webroot\Spy Sweeper\SpySweeper.exe
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Programmi\UltraVNC\WinVNC.exe" -service (file missing)

Bye

Susan528

Post #6November 21, 2006, 3:57 AM UTC

Let's run one more scan please.

Now run this online scan using Internet Explorer:
Kaspersky Online Scanner from http://www.kaspersky.com/virusscanner

Next Click on Launch Kaspersky Online Scanner

You will be prompted to install an ActiveX component from Kaspersky, Click Yes.

The program will launch and then begin downloading the latest definition files:
Once the files have been downloaded click on NEXT
Now click on Scan Settings
In the scan settings make that the following are selected:
Scan using the following Anti-Virus database:
Standard
Scan Options:
Scan Archives
Scan Mail Bases
Click OK
Now under select a target to scan:
Select My Computer
This will program will start and scan your system.
The scan will take a while so be patient and let it run.
Once the scan is complete it will display if your system has been infected.
Now click on the Save as Text button:
Save the file to your desktop.

Copy and paste that information from Kapersky in your reply. How is your computer running?

Susan528

Post #7December 8, 2006, 12:40 PM UTC

Glad we could be of assistance. This topic is now closed. If you wish it reopened, please send us an email (Click for address) with a link to your thread.

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.
Make sure you use proper prevention to keep from having problems occur to your computer in the future.

Coyote's Installed programs for prevention:

http://forums.tomcoyote.org/index.php?showtopic=31418

The help you receive here is free. If you wish to show your appreciation, then you may donate to help keep us online.

Visit the CoyoteStore http://TomCoyote.org/coyotestore.php

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI

Help, for a Dialer (i-Dialer or WinXX.tmp.exe)

✨ Ask AI

Ask AI