What the Tech?! Free tech support Archive
This is a read-only archive. No new posts or registrations. Privacy Page
Spyware / Malware / Virus Removal

[Closed] Stardoor!

12 min read

This thread's last reply is from . Advice, software, and links below may be out of date — treat specific steps and download links with caution.

Looking for the outcome? Ask AI

Post #1
:rant2: i honestly have no clue how to use this website, but it seems like i can get help here! please help! i been gettinq alot of pop outs from stardoor.com its reallyy annoyinq. also i scan my computer with norton antivirus and it said that i had a virus, the program doesnt do antything, meaning it doesnt delete it becuase its just a try and buy program. anyways heres the hijackthis log

Logfile of HijackThis v1.99.1
Scan saved at 5:07:56 PM, on 8/22/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\winupdates\winupdates.exe
C:\Program Files\outlook\outlook.exe
C:\WINDOWS\retadpu1000137.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\WinPop\winpop.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [winupdates] C:\Program Files\winupdates\winupdates.exe /auto
O4 - HKLM\..\Run: [outlook] C:\Program Files\outlook\outlook.exe /auto
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu1000137.exe 61A847B5BBF72813329B385771FE01F0B3E35B6638993F4661AA4EBD86D67C56389B284534F310
O4 - HKLM\..\Run: [close surf mail dupe] C:\Documents and Settings\All Users\Application Data\Tick Find Close Surf\Gram Bird.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [second roam] C:\DOCUME~1\Stefani\APPLIC~1\antehope\Bows Loud.exe
O4 - HKCU\..\Run: [WinPop] C:\Program Files\WinPop\winpop.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1137439322281
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
Post #2
Hi stefaniyadigg,

Your computer may have been infected by a backdoor trojan. These programs have the ability to steal passwords and other information from your system. If you use your computer for sensitive purposes such as internet banking then I recommend you take the following steps immediately:
  • Use another, uninfected computer to change all your internet passwords, especially ones with financial implications such as banks, paypal, ebay, etc. You should also change the passwords for any other site you use.
  • Call your bank(s), credit card company or any other institution which may be affected and advise them that your login/password or credit card information may have been stolen and ask what steps to take with regard to your account.
  • Consider what other private information could possibly have been taken from your computer and take appropriate steps
This infection can almost certainly be cleaned, but as the malware could be configured to run any program a remote attacker requires, it will be impossible to be 100% sure that the machine is clean, if this is unacceptable to you then you should consider reformatting the system partition and reinstalling Windows as this is the only 100% sure answer.

If you wish to reformat then please let me know in your next response, I'll now continue with instructions for cleaning.

Please print/save a copy of these instructions because we will be using Safe Mode, during which time you won't have access to the internet.

Download SDFix and save it to your Desktop.

Double click SDFix.exe and it will extract the files to %systemdrive%
(Drive that contains the Windows Directory, typically C:\SDFix)

Then reboot your computer in Safe Mode by doing the following :
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, the Advanced Options Menu should appear;
  • Select the first option, to run Windows in Safe Mode, then press Enter.
  • Choose your usual account.
  • Open the extracted SDFix folder and double click RunThis.bat to start the script.
  • Type Y to begin the cleanup process.
  • It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
  • Press any Key and it will restart the PC.
  • When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
    (Report.txt will also be copied to Clipboard ready for posting back on the forum).
Then download ComboFix to your desktop
  • Double click combofix.exe and follow the prompts.
  • Note: Do not click ComboFix's window while it's running - it may cause it to stall!
  • When finished, it shall produce a log for you, please post it in your next response.
Now open HijackThis, select Open the Misc Tools section
Press the Open Uninstall Manager… button, then press Save list…
Save the Uninstall log to your Desktop and include a copy in your next response.
Now press Back and Scan and then Save log to create and save a new HijackThis log.

Once complete, please post the SDFix report, the ComboFix report, the uninstall list and a new HijackThis log.
The logs may not fit into one post so please check that they are complete and use multiple posts if necessary.
Post #3
SDFix: Version 1.100 Run by [removed] on Sat 08/25/2007 at 06:56 PM Microsoft Windows XP [Version 5.1.2600] Running From: C:\SDFix Safe Mode: Checking Services: Restoring Windows Registry Values Restoring Windows Default Hosts File Rebooting… Normal Mode: Checking Files: Trojan Files Found: C:\Program Files\WinPop\UnInstall.exe - Deleted C:\Program Files\WinPop\winpop.exe - Deleted C:\WINDOWS\b104.exe - Deleted C:\WINDOWS\b122.exe - Deleted C:\WINDOWS\b128.exe - Deleted C:\WINDOWS\retadpu1000137.exe - Deleted C:\WINDOWS\system32\cmd.com - Deleted C:\WINDOWS\system32\netstat.com - Deleted C:\WINDOWS\system32\ping.com - Deleted C:\WINDOWS\system32\regedit.com - Deleted C:\WINDOWS\system32\taskkill.com - Deleted C:\WINDOWS\system32\tasklist.com - Deleted C:\WINDOWS\system32\tracert.com - Deleted Folder C:\Program Files\InetGet2 - Removed Folder C:\Program Files\WinPop - Removed Removing Temp Files… ADS Check: C:\WINDOWS No streams found. C:\WINDOWS\system32 No streams found. C:\WINDOWS\system32\svchost.exe No streams found. C:\WINDOWS\system32\ntoskrnl.exe No streams found. Final Check: Remaining Services: —————— Authorized Application Key Export: [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" "C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire" "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"="C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe:*:Enabled:AOL Loader" [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000" Remaining Files: ————— File Backups: - C:\SDFix\backups\backups.zip Files with Hidden Attributes: C:\Program Files\Common Files\Yazzle1122OinAdmin.exe C:\Program Files\Common Files\Yazzle1122OinUninstaller.exe Finished
Post #4
ComboFix 07-08-25.2 - "Stefani" 2007-08-25 19:12:46.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.153 [GMT -4:00]
* Created a new restore point


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Program Files\Common Files\Yazzle1122OinAdmin.exe
C:\Program Files\Common Files\Yazzle1122OinUninstaller.exe
C:\Program Files\winupdates
C:\Program Files\winupdates\a.tmp
C:\Program Files\winupdates\a.zip
C:\WINDOWS\system32\bszip.dll
C:\WINDOWS\system32\gebyv.dll
C:\WINDOWS\system32\mkkcopch.dll
C:\WINDOWS\system32\omlkrlgp.dll
C:\WINDOWS\system32\vybeg.bak1
C:\WINDOWS\system32\vybeg.bak2
C:\WINDOWS\system32\vybeg.ini


((((((((((((((((((((((((( Files Created from 2007-07-25 to 2007-08-25 )))))))))))))))))))))))))))))))


2007-08-25 19:10 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-25 18:55 d——– C:\WINDOWS\ERUNT
2007-08-25 18:47 1,310,720 –ah—– C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-08-25 18:47 d—s—- C:\DOCUME~1\ADMINI~1\UserData
2007-08-25 18:47 d——– C:\DOCUME~1\ADMINI~1\WINDOWS
2007-08-25 18:47 d——– C:\DOCUME~1\ADMINI~1\APPLIC~1\U3
2007-08-25 18:47 d——– C:\DOCUME~1\ADMINI~1\APPLIC~1\Symantec
2007-08-25 18:47 d——– C:\DOCUME~1\ADMINI~1\APPLIC~1\SampleView
2007-08-25 18:47 d——– C:\DOCUME~1\ADMINI~1\APPLIC~1\AdobeUM
2007-08-22 21:33 550 –a—— C:\WINDOWS\mozver.dat
2007-08-22 20:26 d——– C:\DOCUME~1\Guest\APPLIC~1\Google
2007-08-22 20:16 1,310,720 –ah—– C:\DOCUME~1\Guest\NTUSER.DAT
2007-08-22 20:16 d–hs—- C:\DOCUME~1\Guest\UserData
2007-08-22 20:16 d——– C:\DOCUME~1\Guest\WINDOWS
2007-08-22 20:16 d——– C:\DOCUME~1\Guest\APPLIC~1\U3
2007-08-22 20:16 d——– C:\DOCUME~1\Guest\APPLIC~1\Symantec
2007-08-22 20:16 d——– C:\DOCUME~1\Guest\APPLIC~1\SampleView
2007-08-22 20:16 d——– C:\DOCUME~1\Guest\APPLIC~1\AdobeUM
2007-08-22 13:40 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\InstallShield
2007-08-22 13:38 d——– C:\Program Files\Common Files\Jasc Software Inc
2007-08-22 13:37 d——– C:\DOCUME~1\Stefani\APPLIC~1\Jasc Software Inc
2007-08-22 13:21 d——– C:\Program Files\antehope
2007-08-22 13:21 d——– C:\DOCUME~1\Stefani\APPLIC~1\antehope
2007-08-22 13:21 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Tick Find Close Surf
2007-08-22 13:19 d–hs—- C:\Program Files\outlook
2007-08-22 13:19 d——– C:\DOCUME~1\Stefani\APPLIC~1\Help
2007-08-22 13:18 d——– C:\Program Files\Jasc Software Inc
2007-08-22 13:18 d——– C:\DOCUME~1\Stefani\APPLIC~1\Jasc
2007-08-21 13:00 1,310,720 –ah—– C:\DOCUME~1\Alieshka\NTUSER.DAT
2007-08-21 13:00 d–hs—- C:\DOCUME~1\Alieshka\UserData
2007-08-21 13:00 d——– C:\DOCUME~1\Alieshka\WINDOWS
2007-08-21 13:00 d——– C:\DOCUME~1\Alieshka\APPLIC~1\U3
2007-08-21 13:00 d——– C:\DOCUME~1\Alieshka\APPLIC~1\Symantec
2007-08-21 13:00 d——– C:\DOCUME~1\Alieshka\APPLIC~1\SampleView
2007-08-21 13:00 d——– C:\DOCUME~1\Alieshka\APPLIC~1\Google
2007-08-21 13:00 d——– C:\DOCUME~1\Alieshka\APPLIC~1\AdobeUM
2007-08-21 00:53 d——– C:\DOCUME~1\Vilma\APPLIC~1\Google
2007-08-21 00:49 1,572,864 –ah—– C:\DOCUME~1\Vilma\NTUSER.DAT
2007-08-21 00:49 d–hs—- C:\DOCUME~1\Vilma\UserData
2007-08-21 00:49 d——– C:\DOCUME~1\Vilma\WINDOWS
2007-08-21 00:49 d——– C:\DOCUME~1\Vilma\APPLIC~1\U3
2007-08-21 00:49 d——– C:\DOCUME~1\Vilma\APPLIC~1\Symantec
2007-08-21 00:49 d——– C:\DOCUME~1\Vilma\APPLIC~1\SampleView
2007-08-21 00:49 d——– C:\DOCUME~1\Vilma\APPLIC~1\AdobeUM
2007-08-20 22:00 d——– C:\DOCUME~1\Stefani\APPLIC~1\acccore
2007-08-20 22:00 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL OCP
2007-08-20 22:00 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL
2007-08-20 21:59 d——– C:\Program Files\Viewpoint
2007-08-20 21:59 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Viewpoint
2007-08-20 21:58 335 –a—— C:\WINDOWS\nsreg.dat
2007-08-20 21:58 d——– C:\Program Files\Common Files\AOL
2007-08-20 21:58 d——– C:\Program Files\AIM6
2007-08-20 21:57 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\AOL Downloads
2007-08-20 21:26 221,184 –a—— C:\WINDOWS\system32\wmpns.dll
2007-08-20 21:01 d——– C:\DOCUME~1\Stefani\Shared
2007-08-20 21:01 d——– C:\DOCUME~1\Stefani\Incomplete
2007-08-20 21:00 d——– C:\DOCUME~1\Stefani\APPLIC~1\LimeWire
2007-08-20 20:57 d——– C:\Program Files\LimeWire
2007-08-20 20:56 d——– C:\WINDOWS\network diagnostic
2007-08-20 20:53 d——– C:\DOCUME~1\Stefani\APPLIC~1\Google
2007-08-20 20:51 d——– C:\Program Files\Google
2007-08-20 20:51 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google
2007-08-20 17:32 d–hs—- C:\RECYCLER
2007-08-20 17:28 1,310,720 –ah—– C:\DOCUME~1\Teodoro\NTUSER.DAT
2007-08-20 17:28 d—s—- C:\DOCUME~1\Teodoro\UserData
2007-08-20 17:28 d——– C:\DOCUME~1\Teodoro\WINDOWS
2007-08-20 17:28 d——– C:\DOCUME~1\Teodoro\APPLIC~1\U3
2007-08-20 17:28 d——– C:\DOCUME~1\Teodoro\APPLIC~1\Symantec
2007-08-20 17:28 d——– C:\DOCUME~1\Teodoro\APPLIC~1\SampleView
2007-08-20 17:28 d——– C:\DOCUME~1\Teodoro\APPLIC~1\AdobeUM
2007-08-20 16:57 dr——- C:\Program Files
2007-08-20 16:57 d——– C:\WINDOWS\I386
2007-08-20 16:56 dr——- C:\WINDOWS\Offline Web Pages
2007-08-20 16:56 dr——- C:\DOCUME~1\ALLUSE~1\Documents
2007-08-20 16:54 dr-hsc— C:\WINDOWS\system32\dllcache
2007-08-20 15:06 1,572,864 –ah—– C:\DOCUME~1\Stefani\NTUSER.DAT
2007-08-20 15:06 d–hs—- C:\DOCUME~1\Stefani\UserData
2007-08-20 15:06 d——– C:\DOCUME~1\Stefani\WINDOWS
2007-08-20 15:06 d——– C:\DOCUME~1\Stefani\APPLIC~1\U3
2007-08-20 15:06 d——– C:\DOCUME~1\Stefani\APPLIC~1\Symantec
2007-08-20 15:06 d——– C:\DOCUME~1\Stefani\APPLIC~1\SampleView
2007-08-20 15:06 d——– C:\DOCUME~1\Stefani\APPLIC~1\AdobeUM
2007-08-20 15:05 d—s—- C:\WINDOWS\system32\config\SYSTEM~1\UserData
2007-08-20 15:05 d——– C:\WINDOWS\system32\config\SYSTEM~1\WINDOWS
2007-08-20 15:05 d——– C:\WINDOWS\system32\config\SYSTEM~1\APPLIC~1\U3
2007-08-20 15:05 d——– C:\WINDOWS\system32\config\SYSTEM~1\APPLIC~1\Symantec
2007-08-20 15:05 d——– C:\WINDOWS\system32\config\SYSTEM~1\APPLIC~1\SampleView
2007-08-20 15:05 d——– C:\WINDOWS\system32\config\SYSTEM~1\APPLIC~1\AdobeUM
2007-08-20 15:04 d—s—- C:\DOCUME~1\DEFAUL~1\UserData
2007-08-20 15:04 d——– C:\DOCUME~1\DEFAUL~1\WINDOWS
2007-08-20 15:00 d–hs—- C:\System Volume Information


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-08-22 22:33 ——— d——– C:\Program Files\Common Files\Symantec Shared
2007-08-22 13:38 ——— d——– C:\Program Files\Common Files\InstallShield
2007-08-21 19:52 2378 –a—— C:\WINDOWS\pchealth\helpctr\PackageStore\SkuStore.bin
2007-08-21 19:51 8972 –a—— C:\WINDOWS\pchealth\helpctr\Config\Cntstore.bin
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 43352 –a—— C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\wups.dll
2007-06-26 02:08 1104896 –a—— C:\WINDOWS\system32\msxml3.dll
2007-06-19 09:31 282112 –a—— C:\WINDOWS\system32\gdi32.dll
2007-06-13 06:23 1033216 –a—— C:\WINDOWS\explorer.exe


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-14 05:42]
"VTTimer"="VTTimer.exe" [2005-03-08 05:33 C:\WINDOWS\system32\VTTimer.exe]
"VTTrayp"="VTtrayp.exe" [2005-03-11 19:33 C:\WINDOWS\system32\VTTrayp.exe]
"SoundMan"="SOUNDMAN.EXE" [2005-05-17 20:48 C:\WINDOWS\SOUNDMAN.EXE]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-10 01:50]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-12-14 02:30]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"close surf mail dupe"="C:\Documents and Settings\All Users\Application Data\Tick Find Close Surf\Gram Bird.exe" [2007-08-25 19:19]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-14 02:24]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15:00]
"Aim6"="C:\Program Files\AIM6\aim6.exe" [2007-04-27 17:17]
"second roam"="C:\DOCUME~1\Stefani\APPLIC~1\antehope\Bows Loud.exe" [2007-08-22 13:21]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{8B3F8A93-933C-4DDA-B24C-AEB0697C132A}"= C:\WINDOWS\system32\efccddb.dll [ ]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efccddb]
efccddb.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RaidTool]
C:\Program Files\VIA\RAID\raid_tool.exe

R0 viamraid;viamraid;C:\WINDOWS\system32\DRIVERS\viamraid.sys
S3 FETNDISB;VIA Rhine Family Fast Ethernet Adapter Driver Service;C:\WINDOWS\system32\DRIVERS\fetnd5b.sys
S3 NTSIM;NTSIM;\??\C:\WINDOWS\system32\ntsim.sys


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{3948d4e9-86b7-11da-958c-001485e0958e}]
AutoRun\command- I:\LaunchU3.exe


Contents of the 'Scheduled Tasks' folder
2007-08-25 05:00:01 C:\WINDOWS\Tasks\A25C5459919BCA65.job - c:\docume~1\stefani\applic~1\antehope\itchjumpglue.exe
2007-08-25 00:00:53 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer - Stefani.job - C:\PROGRA~1\NORTON~1\Navw32.exe

**************************************************************************

catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-25 19:18:33
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes …

scanning hidden autostart entries …

scanning hidden files …

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-08-25 19:21:34 - machine was rebooted
C:\ComboFix-quarantined-files.txt … 2007-08-25 19:21

— E O F —
Post #6
NEW hjt log


Logfile of HijackThis v1.99.1
Scan saved at 10:26:49 PM, on 8/27/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\AIM6\aolsoftware.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\vsnpstd.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\winlogon.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [close surf mail dupe] C:\Documents and Settings\All Users\Application Data\Tick Find Close Surf\Gram Bird.exe
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [second roam] C:\DOCUME~1\Stefani\APPLIC~1\antehope\Bows Loud.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1137439322281
O20 - Winlogon Notify: efccddb - efccddb.dll (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
Post #7
Hi stefaniyadigg,

Please also post an uninstall list, here's how:

Open HijackThis, select Open the Misc Tools section
Press the Open Uninstall Manager… button, then press Save list…
Save the Uninstall log to your Desktop and include a copy in your next response.
Post #8
Adobe Flash Player ActiveX Adobe Reader 7.0.5 AIM 6 Animation Shop 3 ccCommon GE 98063 EasyCam Google Toolbar for Internet Explorer Google Toolbar for Internet Explorer Hijackthis 1.99.1 HijackThis 1.99.1 Hotfix for Windows XP (KB914440) Hotfix for Windows XP (KB915865) Internet Worm Protection Jasc Paint Shop Pro 9 Java™ 6 Update 2 LimeWire 4.14.8 LiveReg (Symantec Corporation) LiveUpdate 3.0 (Symantec Corporation) Microsoft Internationalized Domain Names Mitigation APIs Microsoft National Language Support Downlevel APIs Mozilla Firefox (2.0.0.6) Nero Suite Norton AntiVirus 2005 Norton AntiVirus 2005 (Symantec Corporation) Norton AntiVirus Help Norton AntiVirus Parent MSI Norton WMI Update PCI SoftV92 Modem PowerDVD Realtek AC'97 Audio Security Update for Windows Internet Explorer 7 (KB937143) Security Update for Windows Internet Explorer 7 (KB938127) Security Update for Windows Media Player (KB911564) Security Update for Windows Media Player 6.4 (KB925398) Security Update for Windows Media Player 9 (KB936782) Security Update for Windows XP (KB890046) Security Update for Windows XP (KB893066) Security Update for Windows XP (KB893756) Security Update for Windows XP (KB896358) Security Update for Windows XP (KB896422) Security Update for Windows XP (KB896423) Security Update for Windows XP (KB896424) Security Update for Windows XP (KB896428) Security Update for Windows XP (KB899587) Security Update for Windows XP (KB899591) Security Update for Windows XP (KB900725) Security Update for Windows XP (KB901017) Security Update for Windows XP (KB901214) Security Update for Windows XP (KB902400) Security Update for Windows XP (KB904706) Security Update for Windows XP (KB905414) Security Update for Windows XP (KB905749) Security Update for Windows XP (KB905915) Security Update for Windows XP (KB908519) Security Update for Windows XP (KB911562) Security Update for Windows XP (KB911927) Security Update for Windows XP (KB912919) Security Update for Windows XP (KB913580) Security Update for Windows XP (KB914388) Security Update for Windows XP (KB914389) Security Update for Windows XP (KB917953) Security Update for Windows XP (KB918118) Security Update for Windows XP (KB918439) Security Update for Windows XP (KB919007) Security Update for Windows XP (KB920213) Security Update for Windows XP (KB920670) Security Update for Windows XP (KB920683) Security Update for Windows XP (KB920685) Security Update for Windows XP (KB921503) Security Update for Windows XP (KB922819) Security Update for Windows XP (KB923191) Security Update for Windows XP (KB923414) Security Update for Windows XP (KB923689) Security Update for Windows XP (KB923980) Security Update for Windows XP (KB924270) Security Update for Windows XP (KB924667) Security Update for Windows XP (KB925902) Security Update for Windows XP (KB926255) Security Update for Windows XP (KB926436) Security Update for Windows XP (KB927779) Security Update for Windows XP (KB927802) Security Update for Windows XP (KB928255) Security Update for Windows XP (KB928843) Security Update for Windows XP (KB929123) Security Update for Windows XP (KB930178) Security Update for Windows XP (KB931261) Security Update for Windows XP (KB931784) Security Update for Windows XP (KB932168) Security Update for Windows XP (KB935839) Security Update for Windows XP (KB935840) Security Update for Windows XP (KB936021) Security Update for Windows XP (KB938829) SPBBC Symantec Symantec Script Blocking Installer SymNet Update for Windows XP (KB894391) Update for Windows XP (KB898461) Update for Windows XP (KB900485) Update for Windows XP (KB904942) Update for Windows XP (KB908531) Update for Windows XP (KB910437) Update for Windows XP (KB911280) Update for Windows XP (KB916595) Update for Windows XP (KB920872) Update for Windows XP (KB922582) Update for Windows XP (KB927891) Update for Windows XP (KB930916) Update for Windows XP (KB931836) Update for Windows XP (KB936357) Update for Windows XP (KB938828) VIA Platform Device Manager VIA Rhine-Family Fast Ethernet Adapter VIA/S3G Display Driver Viewpoint Media Player Windows Genuine Advantage v1.3.0254.0 Windows Installer 3.1 (KB893803) Windows Internet Explorer 7 Windows XP Hotfix - KB873339 Windows XP Hotfix - KB885250 Windows XP Hotfix - KB885835 Windows XP Hotfix - KB885836 Windows XP Hotfix - KB886185 Windows XP Hotfix - KB887472 Windows XP Hotfix - KB887742 Windows XP Hotfix - KB888113 Windows XP Hotfix - KB888302 Windows XP Hotfix - KB890859 Windows XP Hotfix - KB891781
Post #9
Hi stefaniyadigg,

There's quite a bit in this post so please take time to have a look through and if you have any questions or something isn't clear, then stop and let me know.

You have Viewpoint Media Player installed on your system. This program is not malware but it is foistware in that it is usually installed without the user's knowledge or approval, and for this reason I recommend you remove it. If you actually use this program, I recommend you try using safe and free alternatives such as VLC Player or Media Player Classic.
To remove, open Start->Control Panel->Add/Remove Programs find Viewpoint Media Player and select Remove

You have LimeWire, a P2P file sharing program installed on your computer. This program does not come bundled with malware as some similar programs do, but peer-to-peer file sharing networks are one of the biggest sources of malware we see. Anything downloaded from them cannot be trusted to be clean, because even if the file appears to be what it claims to be, it can have malware embedded in it.
I recommend you remove it, but of course the choice is yours.
You can remove Limewire via Add/Remove Programs.

————————————————————————

Next, download Deljob.exe and save it to your desktop.
Doubleclick Deljob.exe to start the program.
A file called logit.txt should appear on your Desktop and should open in Notepad, post the contents of this file in your next response.

————————————————————————

Backup Your Registry with ERUNT:
  • Download erunt.zip to your Desktop from here:
    http://aumha.org/downloads/erunt.zip
  • Right-click erunt.zip, select Extract All… and follow the prompts to extract ERUNT to a new folder on your Desktop
  • Inside the new folder, double-click ERUNT.exe to start the program
  • OK all the prompts to back up your registry to the default location.
Note: to restore your registry, go to the backup folder and start ERDNT.exe

————————————————————————

Then, open Notepad (press Start->Run, enter notepad and press OK)
Copy everything inside the code box below (Starting with REGEDIT4) and paste it into a new notepad file.
Change the Save As Type to All Files and save it as fix.reg to your Desktop.

Note: Please copy and paste all the text at once, and check that there is NO blank line above REGEDIT4 and one blank line at the bottom.
REGEDIT4

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{8B3F8A93-933C-4DDA-B24C-AEB0697C132A}"=-

[-HKEY_CLASSES_ROOT\CLSID\{8B3F8A93-933C-4DDA-B24C-AEB0697C132A}]
Locate fix.reg on your Desktop, if you did it right it should look like this:[external image: Posted Image]
Double-click it, when it asks if you want to merge with the registry, click Yes.

————————————————————————

Then, open HijackThis, choose Do a system scan only and place a checkmark next to the following lines:

O4 - HKLM\..\Run: [close surf mail dupe] C:\Documents and Settings\All Users\Application Data\Tick Find Close Surf\Gram Bird.exe
O4 - HKCU\..\Run: [second roam] C:\DOCUME~1\Stefani\APPLIC~1\antehope\Bows Loud.exe
O20 - Winlogon Notify: efccddb - efccddb.dll (file missing)


Then close all open windows apart from HijackThis, press Fix checked, OK the prompt and close HijackThis.

————————————————————————

Download OTMoveIt to your desktop. and double-click the program to start it.
Select the contents of the below file list, then press Ctrl+C to copy it to the clipboard
In OTMoveIt, click in the left-hand pane and press Ctrl+V to paste the file-list into the program
Then, press MoveIt!
If the program asks you to reboot now, click No
Copy the Results output and paste it into a new notepad file so you can post it in your next response. Do this by clicking in the right-hand pane, press Ctrl-A then Ctrl-C to select all and copy. Then open Notepad, press Ctrl-V to paste in the text, and save this text file to your desktop.

OTMoveIt file list:
C:\Program Files\outlook
C:\Documents and Settings\All Users\Application Data\Tick Find Close Surf
C:\DOCUME~1\Stefani\APPLIC~1\antehope
C:\Program Files\antehope
C:\WINDOWS\Tasks\A25C5459919BCA65.job
C:\WINDOWS\system32\efccddb.dll
Then reboot your computer to complete the removals.

————————————————————————

Once complete, please post the logit.txt output, the OTMoveIt log and a new HijackThis log.
Post #11
LOGIT



——————————————————–
File(s) moved to C:\deljob

A25C5459919BCA65.job
——————————————————–
Files remaining after cleaning

AppleSoftwareUpdate.job
Norton AntiVirus - Scan my computer - Stefani.job
——————————————————–
App data folders

Volume in drive C has no label.
Volume Serial Number is F831-72B0

Directory of C:\Documents and Settings\Stefani\Application Data

08/28/2007 11:57 PM .
08/28/2007 11:57 PM ..
08/20/2007 10:00 PM acccore
01/17/2006 06:17 AM Adobe
01/17/2006 06:17 AM AdobeUM
09/01/2007 12:51 AM antehope
08/28/2007 11:57 PM APPLEC~1 Apple Computer
08/20/2007 11:47 PM Google
08/22/2007 01:19 PM Help
01/17/2006 03:40 AM IDENTI~1 Identities
08/22/2007 01:18 PM Jasc
08/22/2007 01:37 PM JASCSO~1 Jasc Software Inc
08/31/2007 05:38 PM LimeWire
01/17/2006 06:54 AM MACROM~1 Macromedia
01/17/2006 05:22 AM MICROS~1 Microsoft
08/27/2007 10:47 PM Mozilla
01/17/2006 06:12 AM SAMPLE~1 SampleView
08/20/2007 03:07 PM Symantec
01/17/2006 06:47 AM U3
0 File(s) 0 bytes
19 Dir(s) 69,045,194,752 bytes free
Volume in drive C has no label.
Volume Serial Number is F831-72B0

Directory of C:\Documents and Settings\All Users\Application Data

08/28/2007 11:55 PM .
08/28/2007 11:55 PM ..
01/17/2006 06:43 AM Adobe
01/17/2006 05:02 AM Ahead
08/20/2007 10:00 PM AOL
08/20/2007 09:58 PM AOLDOW~1 AOL Downloads
08/20/2007 10:00 PM AOLOCP~1 AOL OCP
08/28/2007 11:54 PM Apple
08/28/2007 11:56 PM APPLEC~1 Apple Computer
01/17/2006 05:07 AM CYBERL~1 CyberLink
08/20/2007 08:51 PM Google
08/22/2007 01:40 PM INSTAL~1 InstallShield
01/17/2006 06:27 AM MICROS~1 Microsoft
01/18/2006 01:55 AM Symantec
08/22/2007 01:21 PM TICKFI~1 Tick Find Close Surf
08/20/2007 09:59 PM VIEWPO~1 Viewpoint
01/17/2006 05:26 AM WINDOW~1 Windows Genuine Advantage
0 File(s) 0 bytes
17 Dir(s) 69,045,194,752 bytes free
——————————————————–



OTMMOVIT


C:\Program Files\outlook moved successfully.
Folder cleanup failed. C:\Documents and Settings\All Users\Application Data\Tick Find Close Surf scheduled to be deleted on reboot.
C:\DOCUME~1\Stefani\APPLIC~1\antehope moved successfully.
C:\Program Files\antehope moved successfully.
File/Folder C:\WINDOWS\Tasks\A25C5459919BCA65.job not found.
File/Folder C:\WINDOWS\system32\efccddb.dll not found.

Created on 09/03/2007 14:08:44


AND HIJACKTHIS


Logfile of HijackThis v1.99.1
Scan saved at 2:16:05 PM, on 9/3/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\VTTimer.exe
C:\WINDOWS\system32\VTtrayp.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\WINDOWS\vsnpstd.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\AIM6\aim6.exe
C:\Program Files\AIM6\aolsoftware.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.myspace.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [snpstd] C:\WINDOWS\vsnpstd.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/…b?1137439322281
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
Post #12
Hi stefaniyadigg,

Good job, that looks a lot better :)

Please press Start->Run, copy/paste the following command (it's one long command) into the box and press OK:

cmd /c dir /a C:\DOCUME~1\Stefani\APPLIC~1\Help >> "%userprofile%\desktop\look.txt"

A black box and a file on your Desktop called look.txt. Please wait until the black box closes before opening look.txt. Post the contents of look.txt in your next response.



Then, download, install, and update AVG Anti-Spyware 7.5
Download the installer from this page:
http://www.ewido.net/en/download/
  • Save the installer to desktop
  • Double click the installer, select your language, and then select OK
  • Click through to install the program and once you press Finish the main screen will open
  • Click the Update tab at the top, an update should be under way, if not, then under Manual Update click Start update.
  • After the update finishes the status bar at the bottom will display Update successful
  • If for any reason you cannot update from within the program, download and install the full database package from here: http://www.ewido.net/en/download/updates/
  • Close AVG Anti-Spyware. Do not run a scan yet.
Next click Start->Run and type cleanmgr in the box and press OK
Ensure the boxes for Recycle Bin, Temporary Files and Temporary Internet Files are checked, you can choose to check other boxes if you wish but they are not required.
Press OK and Yes to confirm

Now reboot your computer into Safe Mode
To boot into Safe Mode, please restart your computer. Tap F8 before Windows loads.
Select Safe Mode at the top, on the screen that appears.
Sign in with your normal user account

Once in safe mode:
  • Run AVG Anti-Spyware 7.5 and click on the Scanner tab at the top
  • Click the Settings tab and under How to act, change Recommended actions to Quarantine and under Reports select Do not automatically generate reports
  • Click back to the Scan tab and then click on Complete System Scan.
  • This scan can take quite a while to run, so be prepared.
  • AVG Anti-Spyware 7.5 will list any infections found on the left hand side.
  • When the scan is complete, make sure Set all elements to: is set to Quarantine, if not, click the setting and choose Quarantine
  • Click the Apply all actions button. AVG Anti-Spyware 7.5 will display All actions have been applied on the right hand side.
  • Click on Save Report, then Save Report As. This will create a text file. Make sure you know where to find this file again (like on the Desktop).
Now reboot your computer normally

Once complete, please post the look.txt output, the AVG Antispyware report and a new HijackThis log.
Also, let me know how your computer is running.

Ask AI

AI can make mistakes. Check the cited posts. Archived advice can be out-of-date

Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI