LDTate
This topic has been reopened by request of the starter of this topic.
Or it has been moved to the correct forum
Spyware / Malware / Virus Removal
[Resolved] Ldtate
7 min read
epictrance73
i dont even see my control panel under administrator in safe mode… and under the only user we use… the control panel was there.. and it wouldnt let me remove it in safe mode.
Paul
LDTate
Download ComboFix from Here to your Desktop.
- Double click combofix.exe and follow the prompts.
- When finished, it shall produce a log for you, combofix.txt. Post that log and a HiJackthis log in your next reply
epictrance73
Here is the combofix
ComboFix 07-09-14.2 - "Owner" 2007-09-16 21:26:36.5 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.144 [GMT -7:00]
* Created a new restore point
.
((((((((((((((((((((((((( Files Created from 2007-08-17 to 2007-09-17 )))))))))))))))))))))))))))))))
.
2007-09-16 11:27 d——– C:\DOCUME~1\ADMINI~1.PO-\APPLIC~1\Share-to-Web Upload Folder
2007-09-15 22:07 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-09-15 22:00 d——– C:\Program Files\SpywareBlaster
2007-08-21 17:56 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-20 21:56 d——– C:\WINDOWS\ERUNT
2007-08-19 19:14 d——– C:\DOCUME~1\ADMINI~1.PO-\APPLIC~1\TuneUp Software
2007-08-19 18:46 d——– C:\DOCUME~1\ADMINI~1.PO-\APPLIC~1\Webroot
2007-08-19 17:51 d——– C:\DOCUME~1\NETWOR~1\APPLIC~1\Webroot
2007-08-19 17:51 d——– C:\DOCUME~1\ADMINI~1.PO-\APPLIC~1\Juniper Networks
2007-08-19 12:56 23,864 –a—— C:\WINDOWS\system32\drivers\sskbfd.sys
2007-08-19 12:56 21,816 –a—— C:\WINDOWS\system32\drivers\sshrmd.sys
2007-08-19 12:56 20,280 –a—— C:\WINDOWS\system32\drivers\SSFS0BB8.sys
2007-08-19 12:56 163,128 –a—— C:\WINDOWS\system32\drivers\ssidrv.sys
2007-08-19 12:56 d——– C:\DOCUME~1\LOCALS~1\APPLIC~1\Webroot
2007-08-19 12:55 1,521,464 –a—— C:\WINDOWS\WRSetup.dll
2007-08-19 12:55 d——– C:\Program Files\Webroot
2007-08-19 12:55 d——– C:\DOCUME~1\Owner\APPLIC~1\Webroot
2007-08-19 12:55 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Webroot
2007-08-19 12:11 164 –a—— C:\install.dat
2007-08-19 10:51 18,672 –a—— C:\WINDOWS\system32\drivers\antispyfilter.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-08-14 22:54 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\dllcache\cdm.dll
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\dllcache\wuapi.dll
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\dllcache\wuauclt.exe
2007-07-30 19:19 43352 –a—— C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\dllcache\wucltui.dll
2007-07-30 19:19 271224 –a—— C:\WINDOWS\system32\mucltui.dll
2007-07-30 19:19 207736 –a—— C:\WINDOWS\system32\muweb.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\dllcache\wuweb.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\dllcache\wuaueng.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\wups.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\dllcache\wups.dll
2007-06-27 21:14 139264 –a—— C:\WINDOWS\system32\hpzjrd01.dll
2007-06-26 22:10 317440 –a—— C:\WINDOWS\system32\dllcache\unregmp2.exe
2007-06-26 08:13 851968 –a—— C:\WINDOWS\system32\dllcache\vgx.dll
2007-06-26 07:35 665600 –a—— C:\WINDOWS\system32\dllcache\wininet.dll
2007-06-25 23:08 1104896 –a—— C:\WINDOWS\system32\msxml3.dll
2007-06-25 23:08 1104896 –a—— C:\WINDOWS\system32\dllcache\msxml3.dll
2007-06-19 06:31 282112 –a—— C:\WINDOWS\system32\gdi32.dll
2007-06-19 06:31 282112 –a—— C:\WINDOWS\system32\dllcache\gdi32.dll
2004-08-04 19:00:00 94,784 –sh–w C:\WINDOWS\twain.dll
2004-08-04 19:00:00 50,688 –sh–w C:\WINDOWS\twain_32.dll
2004-08-04 19:00:00 11,776 –sh–w C:\WINDOWS\system32\regsvr32.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIModeChange"="Ati2mdxx.exe" [2002-08-29 13:21 C:\WINDOWS\system32\Ati2mdxx.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2002-08-22 15:10]
"GWMDMMSG"="GWMDMMSG.exe" [2002-05-06 16:12 C:\WINDOWS\GWMDMMSG.exe]
"MCUpdateExe"="c:\PROGRA~1\mcafee.com\agent\mcupdate.exe" [2006-01-11 12:05]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\mcagent.exe" [2005-09-22 18:29]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2001-11-14 13:02]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2001-11-14 13:03]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11]
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2007-07-19 22:54]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 08:24]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 12:00]
"speedfan"="C:\Program Files\SpeedFan\speedfan.exe" [2006-10-12 08:33]
"Microsoft Works Update Detection"="C:\Program Files\Microsoft Works\WkDetect.exe" []
C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 19:28:24]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 19:50:52]
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-08-14 22:54:35]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Share-to-Web Namespace Daemon"=C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
"Multi-function Keyboard"=GWHotKey.exe
"PHIME2002ASync"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
"PHIME2002A"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
R0 SSFS0BB8;Spy Sweeper File System Filer Driver: 0BB8;C:\WINDOWS\system32\Drivers\SSFS0BB8.SYS
R1 AntiSpyFilter;AntiSpyFilter;C:\WINDOWS\system32\DRIVERS\antispyfilter.sys
R2 UxTuneUp;TuneUp Design Expansion;C:\WINDOWS\System32\svchost.exe -k netsvcs
R3 allegro;ESS Allegro Audio Driver (WDM);C:\WINDOWS\system32\drivers\es198x.sys
R3 dsNcAdpt;Juniper Network Connect Adapter;C:\WINDOWS\system32\DRIVERS\dsNcAdpt.sys
R3 EM9AB;WLAN a+b combo mini-PCI Service;C:\WINDOWS\system32\DRIVERS\em9ab.sys
R3 GTWModem;GTW V.92 Voicemodem;C:\WINDOWS\system32\DRIVERS\GWMDM.sys
S3 iscFlash;iscFlash;\??\C:\WINDOWS\SYSTEM32\DRIVERS\iscflash.sys
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder
"2007-09-01 01:05:38 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
"2007-02-04 03:35:02 C:\WINDOWS\Tasks\HPFRU Task #Hewlett-Packard#hp officejet 7100 series#1162519723.job"
- C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpqfrucl.exe
"2007-09-11 00:00:12 C:\WINDOWS\Tasks\wrSpySweeper_L295F7B06DCE44922955AE7FCA4E6F284.job"
"2007-09-08 03:06:48 C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (PO-886EE7CB84DC-Owner).job"
- c:\program files\mcafee.com\vso\mcmnhdlr.exe
"2007-09-12 04:18:08 C:\WINDOWS\Tasks\WebReg officejet 7300 series.job"
- C:\Program Files\HP\Digital Imaging\bin\hpqwrg.exe
.
**************************************************************************
catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-16 21:30:53
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-09-16 21:33:20
C:\ComboFix2.txt … 2007-09-13 20:52
C:\ComboFix-quarantined-files.txt … 2007-09-16 21:33
C:\ComboFix3.txt … 2007-09-12 22:41
.
— E O F —
Here is the hijack
Logfile of HijackThis v1.99.1
Scan saved at 21:35, on 9/16/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Juniper Networks\Common Files\dsNcService.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\GWMDMMSG.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SpeedFan\speedfan.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Owner\Local Settings\Temp\HijackThis.exe
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [SynTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
O4 - HKLM\..\Run: [SynTPLpr] "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [speedfan] "C:\Program Files\SpeedFan\speedfan.exe"
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: No More Cookies - {334C4A3A-7B0F-4C55-B73F-63B37865E8FA} - C:\Program Files\No More Cookies\No More Cookies.exe
O9 - Extra 'Tools' menuitem: No More Cookies - {334C4A3A-7B0F-4C55-B73F-63B37865E8FA} - C:\Program Files\No More Cookies\No More Cookies.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=67633
O16 - DPF: {2ED9BC2B-4DF1-472E-9B5E-55477D2C97F5} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqaio/downloads/sysinfo.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1170223697026
O16 - DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} (StartFirstControl.CheckFirst) - hcp://system/StartFirstControl.CAB
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Juniper Network Connect Service (dsNcService) - Juniper Networks - C:\Program Files\Juniper Networks\Common Files\dsNcService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: PictureTaker - LANovation - C:\WINDOWS\system32\PCTKRNT.SYS
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
Thanks,
Paul
ComboFix 07-09-14.2 - "Owner" 2007-09-16 21:26:36.5 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.144 [GMT -7:00]
* Created a new restore point
.
((((((((((((((((((((((((( Files Created from 2007-08-17 to 2007-09-17 )))))))))))))))))))))))))))))))
.
2007-09-16 11:27 d——– C:\DOCUME~1\ADMINI~1.PO-\APPLIC~1\Share-to-Web Upload Folder
2007-09-15 22:07 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-09-15 22:00 d——– C:\Program Files\SpywareBlaster
2007-08-21 17:56 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-20 21:56 d——– C:\WINDOWS\ERUNT
2007-08-19 19:14 d——– C:\DOCUME~1\ADMINI~1.PO-\APPLIC~1\TuneUp Software
2007-08-19 18:46 d——– C:\DOCUME~1\ADMINI~1.PO-\APPLIC~1\Webroot
2007-08-19 17:51 d——– C:\DOCUME~1\NETWOR~1\APPLIC~1\Webroot
2007-08-19 17:51 d——– C:\DOCUME~1\ADMINI~1.PO-\APPLIC~1\Juniper Networks
2007-08-19 12:56 23,864 –a—— C:\WINDOWS\system32\drivers\sskbfd.sys
2007-08-19 12:56 21,816 –a—— C:\WINDOWS\system32\drivers\sshrmd.sys
2007-08-19 12:56 20,280 –a—— C:\WINDOWS\system32\drivers\SSFS0BB8.sys
2007-08-19 12:56 163,128 –a—— C:\WINDOWS\system32\drivers\ssidrv.sys
2007-08-19 12:56 d——– C:\DOCUME~1\LOCALS~1\APPLIC~1\Webroot
2007-08-19 12:55 1,521,464 –a—— C:\WINDOWS\WRSetup.dll
2007-08-19 12:55 d——– C:\Program Files\Webroot
2007-08-19 12:55 d——– C:\DOCUME~1\Owner\APPLIC~1\Webroot
2007-08-19 12:55 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Webroot
2007-08-19 12:11 164 –a—— C:\install.dat
2007-08-19 10:51 18,672 –a—— C:\WINDOWS\system32\drivers\antispyfilter.sys
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-08-14 22:54 ——— d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Google Updater
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\dllcache\cdm.dll
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\dllcache\wuapi.dll
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\dllcache\wuauclt.exe
2007-07-30 19:19 43352 –a—— C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\dllcache\wucltui.dll
2007-07-30 19:19 271224 –a—— C:\WINDOWS\system32\mucltui.dll
2007-07-30 19:19 207736 –a—— C:\WINDOWS\system32\muweb.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\dllcache\wuweb.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\dllcache\wuaueng.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\wups.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\dllcache\wups.dll
2007-06-27 21:14 139264 –a—— C:\WINDOWS\system32\hpzjrd01.dll
2007-06-26 22:10 317440 –a—— C:\WINDOWS\system32\dllcache\unregmp2.exe
2007-06-26 08:13 851968 –a—— C:\WINDOWS\system32\dllcache\vgx.dll
2007-06-26 07:35 665600 –a—— C:\WINDOWS\system32\dllcache\wininet.dll
2007-06-25 23:08 1104896 –a—— C:\WINDOWS\system32\msxml3.dll
2007-06-25 23:08 1104896 –a—— C:\WINDOWS\system32\dllcache\msxml3.dll
2007-06-19 06:31 282112 –a—— C:\WINDOWS\system32\gdi32.dll
2007-06-19 06:31 282112 –a—— C:\WINDOWS\system32\dllcache\gdi32.dll
2004-08-04 19:00:00 94,784 –sh–w C:\WINDOWS\twain.dll
2004-08-04 19:00:00 50,688 –sh–w C:\WINDOWS\twain_32.dll
2004-08-04 19:00:00 11,776 –sh–w C:\WINDOWS\system32\regsvr32.exe
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIModeChange"="Ati2mdxx.exe" [2002-08-29 13:21 C:\WINDOWS\system32\Ati2mdxx.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2002-08-22 15:10]
"GWMDMMSG"="GWMDMMSG.exe" [2002-05-06 16:12 C:\WINDOWS\GWMDMMSG.exe]
"MCUpdateExe"="c:\PROGRA~1\mcafee.com\agent\mcupdate.exe" [2006-01-11 12:05]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\mcagent.exe" [2005-09-22 18:29]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2001-11-14 13:02]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2001-11-14 13:03]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11]
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2007-07-19 22:54]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 08:24]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 12:00]
"speedfan"="C:\Program Files\SpeedFan\speedfan.exe" [2006-10-12 08:33]
"Microsoft Works Update Detection"="C:\Program Files\Microsoft Works\WkDetect.exe" []
C:\DOCUME~1\ALLUSE~1\STARTM~1\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 19:28:24]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 19:50:52]
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-08-14 22:54:35]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Share-to-Web Namespace Daemon"=C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
"Multi-function Keyboard"=GWHotKey.exe
"PHIME2002ASync"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
"PHIME2002A"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
R0 SSFS0BB8;Spy Sweeper File System Filer Driver: 0BB8;C:\WINDOWS\system32\Drivers\SSFS0BB8.SYS
R1 AntiSpyFilter;AntiSpyFilter;C:\WINDOWS\system32\DRIVERS\antispyfilter.sys
R2 UxTuneUp;TuneUp Design Expansion;C:\WINDOWS\System32\svchost.exe -k netsvcs
R3 allegro;ESS Allegro Audio Driver (WDM);C:\WINDOWS\system32\drivers\es198x.sys
R3 dsNcAdpt;Juniper Network Connect Adapter;C:\WINDOWS\system32\DRIVERS\dsNcAdpt.sys
R3 EM9AB;WLAN a+b combo mini-PCI Service;C:\WINDOWS\system32\DRIVERS\em9ab.sys
R3 GTWModem;GTW V.92 Voicemodem;C:\WINDOWS\system32\DRIVERS\GWMDM.sys
S3 iscFlash;iscFlash;\??\C:\WINDOWS\SYSTEM32\DRIVERS\iscflash.sys
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
.
Contents of the 'Scheduled Tasks' folder
"2007-09-01 01:05:38 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
"2007-02-04 03:35:02 C:\WINDOWS\Tasks\HPFRU Task #Hewlett-Packard#hp officejet 7100 series#1162519723.job"
- C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpqfrucl.exe
"2007-09-11 00:00:12 C:\WINDOWS\Tasks\wrSpySweeper_L295F7B06DCE44922955AE7FCA4E6F284.job"
"2007-09-08 03:06:48 C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (PO-886EE7CB84DC-Owner).job"
- c:\program files\mcafee.com\vso\mcmnhdlr.exe
"2007-09-12 04:18:08 C:\WINDOWS\Tasks\WebReg officejet 7300 series.job"
- C:\Program Files\HP\Digital Imaging\bin\hpqwrg.exe
.
**************************************************************************
catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-16 21:30:53
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-09-16 21:33:20
C:\ComboFix2.txt … 2007-09-13 20:52
C:\ComboFix-quarantined-files.txt … 2007-09-16 21:33
C:\ComboFix3.txt … 2007-09-12 22:41
.
— E O F —
Here is the hijack
Logfile of HijackThis v1.99.1
Scan saved at 21:35, on 9/16/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Juniper Networks\Common Files\dsNcService.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
c:\program files\mcafee.com\agent\mcdetect.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\WINDOWS\GWMDMMSG.exe
C:\PROGRA~1\mcafee.com\agent\mcagent.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Messenger\msmsgs.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SpeedFan\speedfan.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Google\Google Updater\GoogleUpdater.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\HP\Digital Imaging\bin\hpqgalry.exe
C:\Program Files\Webroot\Spy Sweeper\SSU.EXE
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\Owner\Local Settings\Temp\HijackThis.exe
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} - c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [GWMDMMSG] GWMDMMSG.exe
O4 - HKLM\..\Run: [MCUpdateExe] c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe
O4 - HKLM\..\Run: [SynTPEnh] "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe"
O4 - HKLM\..\Run: [SynTPLpr] "C:\Program Files\Synaptics\SynTP\SynTPLpr.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [speedfan] "C:\Program Files\SpeedFan\speedfan.exe"
O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Image Zone Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Google Updater.lnk = C:\Program Files\Google\Google Updater\GoogleUpdater.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: No More Cookies - {334C4A3A-7B0F-4C55-B73F-63B37865E8FA} - C:\Program Files\No More Cookies\No More Cookies.exe
O9 - Extra 'Tools' menuitem: No More Cookies - {334C4A3A-7B0F-4C55-B73F-63B37865E8FA} - C:\Program Files\No More Cookies\No More Cookies.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=67633
O16 - DPF: {2ED9BC2B-4DF1-472E-9B5E-55477D2C97F5} (Microsoft Data Collection Control) - https://support.microsoft.com/OAS/ActiveX/odc.cab
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqaio/downloads/sysinfo.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcafee.com/molbin/shared/m…01/mcinsctl.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat…b?1170223697026
O16 - DPF: {99CDFD87-F97A-42E1-9C13-D18220D90AD1} (StartFirstControl.CheckFirst) - hcp://system/StartFirstControl.CAB
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcafee.com/molbin/shared/m…,26/mcgdmgr.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shoc…ash/swflash.cab
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Juniper Network Connect Service (dsNcService) - Juniper Networks - C:\Program Files\Juniper Networks\Common Files\dsNcService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe
O23 - Service: McAfee.com McShield (McShield) - McAfee Inc. - c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: PictureTaker - LANovation - C:\WINDOWS\system32\PCTKRNT.SYS
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
Thanks,
Paul
LDTate
Open notepad and copy/paste the text in the quotebox below into it:
Save this as Save this as "CFScript"
[external image: Posted Image]
Refering to the picture above, drag CFScript.txt into ComboFix.exe
Then post the results log
File::
C:\WINDOWS\system32\drivers\antispyfilter.sys
Driver::
C:\WINDOWS\system32\DRIVERS\antispyfilter.sys
Save this as Save this as "CFScript"
[external image: Posted Image]
Refering to the picture above, drag CFScript.txt into ComboFix.exe
Then post the results log
epictrance73
here is the cfscript transfer log
ComboFix 07-08-17.2 - "Owner" 2007-09-17 17:31:24.6 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.193 [GMT -7:00]
Command switches used :: C:\Documents and Settings\Owner\Desktop\cfscript.txt
* Created a new restore point
FILE::
C:\WINDOWS\system32\drivers\antispyfilter.sys
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\WINDOWS\system32\drivers\antispyfilter.sys
((((((((((((((((((((((((( Files Created from 2007-08-18 to 2007-09-18 )))))))))))))))))))))))))))))))
2007-09-16 11:27 d——– C:\DOCUME~1\ADMINI~1.PO-\APPLIC~1\Share-to-Web Upload Folder
2007-09-15 22:07 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-09-15 22:00 d——– C:\Program Files\SpywareBlaster
2007-08-21 17:56 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-20 21:56 d——– C:\WINDOWS\ERUNT
2007-08-19 19:14 d——– C:\DOCUME~1\ADMINI~1.PO-\APPLIC~1\TuneUp Software
2007-08-19 18:46 d——– C:\DOCUME~1\ADMINI~1.PO-\APPLIC~1\Webroot
2007-08-19 17:51 786,432 –ah—– C:\DOCUME~1\ADMINI~1.PO-\NTUSER.DAT
2007-08-19 17:51 d——– C:\DOCUME~1\NETWOR~1\APPLIC~1\Webroot
2007-08-19 17:51 d——– C:\DOCUME~1\ADMINI~1.PO-\APPLIC~1\Juniper Networks
2007-08-19 12:56 23,864 –a—— C:\WINDOWS\system32\drivers\sskbfd.sys
2007-08-19 12:56 21,816 –a—— C:\WINDOWS\system32\drivers\sshrmd.sys
2007-08-19 12:56 20,280 –a—— C:\WINDOWS\system32\drivers\SSFS0BB8.sys
2007-08-19 12:56 163,128 –a—— C:\WINDOWS\system32\drivers\ssidrv.sys
2007-08-19 12:56 d——– C:\DOCUME~1\LOCALS~1\APPLIC~1\Webroot
2007-08-19 12:55 1,521,464 –a—— C:\WINDOWS\WRSetup.dll
2007-08-19 12:55 d——– C:\Program Files\Webroot
2007-08-19 12:55 d——– C:\DOCUME~1\Owner\APPLIC~1\Webroot
2007-08-19 12:55 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Webroot
2007-08-19 12:11 164 –a—— C:\install.dat
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\dllcache\cdm.dll
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\dllcache\wuapi.dll
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\dllcache\wuauclt.exe
2007-07-30 19:19 43352 –a—— C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\dllcache\wucltui.dll
2007-07-30 19:19 271224 –a—— C:\WINDOWS\system32\mucltui.dll
2007-07-30 19:19 207736 –a—— C:\WINDOWS\system32\muweb.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\dllcache\wuweb.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\dllcache\wuaueng.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\wups.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\dllcache\wups.dll
2007-06-27 21:14 139264 –a—— C:\WINDOWS\system32\hpzjrd01.dll
2007-06-26 22:10 317440 –a—— C:\WINDOWS\system32\dllcache\unregmp2.exe
2007-06-26 08:13 851968 –a—— C:\WINDOWS\system32\dllcache\vgx.dll
2007-06-26 07:35 665600 –a—— C:\WINDOWS\system32\dllcache\wininet.dll
2007-06-25 23:08 1104896 –a—— C:\WINDOWS\system32\msxml3.dll
2007-06-25 23:08 1104896 –a—— C:\WINDOWS\system32\dllcache\msxml3.dll
2007-06-19 06:31 282112 –a—— C:\WINDOWS\system32\gdi32.dll
2007-06-19 06:31 282112 –a—— C:\WINDOWS\system32\dllcache\gdi32.dll
2004-08-04 19:00:00 94,784 –sh–w C:\WINDOWS\twain.dll
2004-08-04 19:00:00 50,688 –sh–w C:\WINDOWS\twain_32.dll
2004-08-04 19:00:00 11,776 –sh–w C:\WINDOWS\system32\regsvr32.exe
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIModeChange"="Ati2mdxx.exe" [2002-08-29 13:21 C:\WINDOWS\system32\Ati2mdxx.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2002-08-22 15:10]
"GWMDMMSG"="GWMDMMSG.exe" [2002-05-06 16:12 C:\WINDOWS\GWMDMMSG.exe]
"MCUpdateExe"="c:\PROGRA~1\mcafee.com\agent\mcupdate.exe" [2006-01-11 12:05]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\mcagent.exe" [2005-09-22 18:29]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2001-11-14 13:02]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2001-11-14 13:03]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11]
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2007-07-19 22:54]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 08:24]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 12:00]
"speedfan"="C:\Program Files\SpeedFan\speedfan.exe" [2006-10-12 08:33]
"Microsoft Works Update Detection"="C:\Program Files\Microsoft Works\WkDetect.exe" []
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 19:28:24]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 19:50:52]
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-08-14 22:54:35]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Share-to-Web Namespace Daemon"=C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
"Multi-function Keyboard"=GWHotKey.exe
"PHIME2002ASync"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
"PHIME2002A"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
R0 SSFS0BB8;Spy Sweeper File System Filer Driver: 0BB8;C:\WINDOWS\system32\Drivers\SSFS0BB8.SYS
R1 AntiSpyFilter;AntiSpyFilter;C:\WINDOWS\system32\DRIVERS\antispyfilter.sys
R2 UxTuneUp;TuneUp Design Expansion;C:\WINDOWS\System32\svchost.exe -k netsvcs
R3 allegro;ESS Allegro Audio Driver (WDM);C:\WINDOWS\system32\drivers\es198x.sys
R3 dsNcAdpt;Juniper Network Connect Adapter;C:\WINDOWS\system32\DRIVERS\dsNcAdpt.sys
R3 EM9AB;WLAN a+b combo mini-PCI Service;C:\WINDOWS\system32\DRIVERS\em9ab.sys
R3 GTWModem;GTW V.92 Voicemodem;C:\WINDOWS\system32\DRIVERS\GWMDM.sys
S3 iscFlash;iscFlash;\??\C:\WINDOWS\SYSTEM32\DRIVERS\iscflash.sys
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
Contents of the 'Scheduled Tasks' folder
2007-09-01 01:05:38 C:\WINDOWS\Tasks\1-Click Maintenance.job - C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
2007-02-04 03:35:02 C:\WINDOWS\Tasks\HPFRU Task #Hewlett-Packard#hp officejet 7100 series#1162519723.job - C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpqfrucl.exe
2007-09-18 00:00:10 C:\WINDOWS\Tasks\wrSpySweeper_L295F7B06DCE44922955AE7FCA4E6F284.job - C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
2007-09-08 03:06:48 C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (PO-886EE7CB84DC-Owner).job - c:\program files\mcafee.com\vso\mcmnhdlr.exe
2007-09-12 04:18:08 C:\WINDOWS\Tasks\WebReg officejet 7300 series.job - C:\Program Files\HP\Digital Imaging\bin\hpqwrg.exe
**************************************************************************
catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-17 17:35:07
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
Completion time: 2007-09-17 17:37:06
C:\ComboFix3.txt … 2007-09-13 20:52
C:\ComboFix2.txt … 2007-09-16 21:33
C:\ComboFix-quarantined-files.txt … 2007-09-17 17:37
— E O F —
Thanks,
Paul
ComboFix 07-08-17.2 - "Owner" 2007-09-17 17:31:24.6 - FAT32x86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.193 [GMT -7:00]
Command switches used :: C:\Documents and Settings\Owner\Desktop\cfscript.txt
* Created a new restore point
FILE::
C:\WINDOWS\system32\drivers\antispyfilter.sys
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\WINDOWS\system32\drivers\antispyfilter.sys
((((((((((((((((((((((((( Files Created from 2007-08-18 to 2007-09-18 )))))))))))))))))))))))))))))))
2007-09-16 11:27 d——– C:\DOCUME~1\ADMINI~1.PO-\APPLIC~1\Share-to-Web Upload Folder
2007-09-15 22:07 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-09-15 22:00 d——– C:\Program Files\SpywareBlaster
2007-08-21 17:56 51,200 –a—— C:\WINDOWS\nircmd.exe
2007-08-20 21:56 d——– C:\WINDOWS\ERUNT
2007-08-19 19:14 d——– C:\DOCUME~1\ADMINI~1.PO-\APPLIC~1\TuneUp Software
2007-08-19 18:46 d——– C:\DOCUME~1\ADMINI~1.PO-\APPLIC~1\Webroot
2007-08-19 17:51 786,432 –ah—– C:\DOCUME~1\ADMINI~1.PO-\NTUSER.DAT
2007-08-19 17:51 d——– C:\DOCUME~1\NETWOR~1\APPLIC~1\Webroot
2007-08-19 17:51 d——– C:\DOCUME~1\ADMINI~1.PO-\APPLIC~1\Juniper Networks
2007-08-19 12:56 23,864 –a—— C:\WINDOWS\system32\drivers\sskbfd.sys
2007-08-19 12:56 21,816 –a—— C:\WINDOWS\system32\drivers\sshrmd.sys
2007-08-19 12:56 20,280 –a—— C:\WINDOWS\system32\drivers\SSFS0BB8.sys
2007-08-19 12:56 163,128 –a—— C:\WINDOWS\system32\drivers\ssidrv.sys
2007-08-19 12:56 d——– C:\DOCUME~1\LOCALS~1\APPLIC~1\Webroot
2007-08-19 12:55 1,521,464 –a—— C:\WINDOWS\WRSetup.dll
2007-08-19 12:55 d——– C:\Program Files\Webroot
2007-08-19 12:55 d——– C:\DOCUME~1\Owner\APPLIC~1\Webroot
2007-08-19 12:55 d——– C:\DOCUME~1\ALLUSE~1\APPLIC~1\Webroot
2007-08-19 12:11 164 –a—— C:\install.dat
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\dllcache\cdm.dll
2007-07-30 19:19 92504 –a—— C:\WINDOWS\system32\cdm.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\wuapi.dll
2007-07-30 19:19 549720 –a—— C:\WINDOWS\system32\dllcache\wuapi.dll
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\wuauclt.exe
2007-07-30 19:19 53080 –a—— C:\WINDOWS\system32\dllcache\wuauclt.exe
2007-07-30 19:19 43352 –a—— C:\WINDOWS\system32\wups2.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\wucltui.dll
2007-07-30 19:19 325976 –a—— C:\WINDOWS\system32\dllcache\wucltui.dll
2007-07-30 19:19 271224 –a—— C:\WINDOWS\system32\mucltui.dll
2007-07-30 19:19 207736 –a—— C:\WINDOWS\system32\muweb.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\wuweb.dll
2007-07-30 19:19 203096 –a—— C:\WINDOWS\system32\dllcache\wuweb.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\wuaueng.dll
2007-07-30 19:19 1712984 –a—— C:\WINDOWS\system32\dllcache\wuaueng.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\wups.dll
2007-07-30 19:18 33624 –a—— C:\WINDOWS\system32\dllcache\wups.dll
2007-06-27 21:14 139264 –a—— C:\WINDOWS\system32\hpzjrd01.dll
2007-06-26 22:10 317440 –a—— C:\WINDOWS\system32\dllcache\unregmp2.exe
2007-06-26 08:13 851968 –a—— C:\WINDOWS\system32\dllcache\vgx.dll
2007-06-26 07:35 665600 –a—— C:\WINDOWS\system32\dllcache\wininet.dll
2007-06-25 23:08 1104896 –a—— C:\WINDOWS\system32\msxml3.dll
2007-06-25 23:08 1104896 –a—— C:\WINDOWS\system32\dllcache\msxml3.dll
2007-06-19 06:31 282112 –a—— C:\WINDOWS\system32\gdi32.dll
2007-06-19 06:31 282112 –a—— C:\WINDOWS\system32\dllcache\gdi32.dll
2004-08-04 19:00:00 94,784 –sh–w C:\WINDOWS\twain.dll
2004-08-04 19:00:00 50,688 –sh–w C:\WINDOWS\twain_32.dll
2004-08-04 19:00:00 11,776 –sh–w C:\WINDOWS\system32\regsvr32.exe
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIModeChange"="Ati2mdxx.exe" [2002-08-29 13:21 C:\WINDOWS\system32\Ati2mdxx.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2002-08-22 15:10]
"GWMDMMSG"="GWMDMMSG.exe" [2002-05-06 16:12 C:\WINDOWS\GWMDMMSG.exe]
"MCUpdateExe"="c:\PROGRA~1\mcafee.com\agent\mcupdate.exe" [2006-01-11 12:05]
"MCAgentExe"="c:\PROGRA~1\mcafee.com\agent\mcagent.exe" [2005-09-22 18:29]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2001-11-14 13:02]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2001-11-14 13:03]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 04:00]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2005-02-16 23:11]
"SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [2007-07-19 22:54]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 08:24]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 12:00]
"speedfan"="C:\Program Files\SpeedFan\speedfan.exe" [2006-10-12 08:33]
"Microsoft Works Update Detection"="C:\Program Files\Microsoft Works\WkDetect.exe" []
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2004-11-04 19:28:24]
HP Image Zone Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2004-11-04 19:50:52]
Google Updater.lnk - C:\Program Files\Google\Google Updater\GoogleUpdater.exe [2007-08-14 22:54:35]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"Share-to-Web Namespace Daemon"=C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe
"Multi-function Keyboard"=GWHotKey.exe
"PHIME2002ASync"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
"PHIME2002A"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
R0 SSFS0BB8;Spy Sweeper File System Filer Driver: 0BB8;C:\WINDOWS\system32\Drivers\SSFS0BB8.SYS
R1 AntiSpyFilter;AntiSpyFilter;C:\WINDOWS\system32\DRIVERS\antispyfilter.sys
R2 UxTuneUp;TuneUp Design Expansion;C:\WINDOWS\System32\svchost.exe -k netsvcs
R3 allegro;ESS Allegro Audio Driver (WDM);C:\WINDOWS\system32\drivers\es198x.sys
R3 dsNcAdpt;Juniper Network Connect Adapter;C:\WINDOWS\system32\DRIVERS\dsNcAdpt.sys
R3 EM9AB;WLAN a+b combo mini-PCI Service;C:\WINDOWS\system32\DRIVERS\em9ab.sys
R3 GTWModem;GTW V.92 Voicemodem;C:\WINDOWS\system32\DRIVERS\GWMDM.sys
S3 iscFlash;iscFlash;\??\C:\WINDOWS\SYSTEM32\DRIVERS\iscflash.sys
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp
Contents of the 'Scheduled Tasks' folder
2007-09-01 01:05:38 C:\WINDOWS\Tasks\1-Click Maintenance.job - C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
2007-02-04 03:35:02 C:\WINDOWS\Tasks\HPFRU Task #Hewlett-Packard#hp officejet 7100 series#1162519723.job - C:\Program Files\Hewlett-Packard\AiO\Shared\bin\hpqfrucl.exe
2007-09-18 00:00:10 C:\WINDOWS\Tasks\wrSpySweeper_L295F7B06DCE44922955AE7FCA4E6F284.job - C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe
2007-09-08 03:06:48 C:\WINDOWS\Tasks\McAfee.com Scan for Viruses - My Computer (PO-886EE7CB84DC-Owner).job - c:\program files\mcafee.com\vso\mcmnhdlr.exe
2007-09-12 04:18:08 C:\WINDOWS\Tasks\WebReg officejet 7300 series.job - C:\Program Files\HP\Digital Imaging\bin\hpqwrg.exe
**************************************************************************
catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-09-17 17:35:07
Windows 5.1.2600 Service Pack 2 FAT NTAPI
scanning hidden processes …
scanning hidden autostart entries …
scanning hidden files …
scan completed successfully
hidden files: 0
**************************************************************************
Completion time: 2007-09-17 17:37:06
C:\ComboFix3.txt … 2007-09-13 20:52
C:\ComboFix2.txt … 2007-09-16 21:33
C:\ComboFix-quarantined-files.txt … 2007-09-17 17:37
— E O F —
Thanks,
Paul
LDTate
Is spywarebot gone?
epictrance73
it doesnt startup anymore.. however, I cant delete the program in the add/remove programs.
LDTate
Click "Start"> "Run"> type in Regedit tap Enter Key
Make sure "My Computer" is highlighted
Click "Edit"> "Find"
Type in spywarebot tap Enter Key.
Right Click on the file if found and select "Delete"
Tap the "F3" Key to find the next entry of the file. Continue using the "F3" Key until it's finished searching.
Close Regedit.
Empty Recycle Bin
Reboot and "copy/paste" a new HijackThis log file into this thread.
Also please describe how your computer behaves at the moment.
Make sure "My Computer" is highlighted
Click "Edit"> "Find"
Type in spywarebot tap Enter Key.
Right Click on the file if found and select "Delete"
Tap the "F3" Key to find the next entry of the file. Continue using the "F3" Key until it's finished searching.
Close Regedit.
Empty Recycle Bin
Reboot and "copy/paste" a new HijackThis log file into this thread.
Also please describe how your computer behaves at the moment.
epictrance73
ITS GONE!!! Thanks A BUNCH!!!!!!!!!!!!!!a
Anyway, one more thing.. hopefully you can help me. I'm not sure what the cause of this is.. but what I think my computer is doing is overheating maybe? I have speedfan 4.31 which tells you the temp of your computer. Whenever my computer does a long scan and it gets up to about 43 C degrees I think my computer overheats and shuts off. What do you think I need to do? In my speedfan startup, it says … SuperIO Chip=NS PC87591E (PLEASE REPORT) Do you have any idea what this means?
Thanks,
Paul
LDTate
I wouldn't have a clue, but the Tech Team will. Post the above using the below link.ITS GONE!!! Thanks A BUNCH!!!!!!!!!!!!!!a
Anyway, one more thing.. hopefully you can help me. I'm not sure what the cause of this is.. but what I think my computer is doing is overheating maybe? I have speedfan 4.31 which tells you the temp of your computer. Whenever my computer does a long scan and it gets up to about 43 C degrees I think my computer overheats and shuts off. What do you think I need to do? In my speedfan startup, it says … SuperIO Chip=NS PC87591E (PLEASE REPORT) Do you have any idea what this means?
Thanks,
Paul
http://forums.whatthetech.com/General_Hardware_f126.html
LDTate
Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance.
If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.
Everyone else please begin a New Topic.
Ask AI
AI can make mistakes. Check the cited posts. Archived advice can be out-of-date
Don't include personal information. Questions and selected public posts go to OpenAI. About Ask AI