Jump to content

Build Theme!
  •  
  • Unreplied Topics
  • Downloads
  • Infected?

WE'RE SURE THAT YOU'LL LOVE US!

Hey there! :wub: Looks like you're enjoying the discussion, but you're not signed up for an account. When you create an account, we remember exactly what you've read, so you always come right back where you left off. You also get notifications, here and via email, whenever new posts are made. You can like posts to share the love. :D Join 93112 other members! Anybody can ask, anybody can answer. Consistently helpful members may be invited to become staff. Here's how it works. Virus cleanup? Start here -> Malware Removal Forum.

Try What the Tech -- It's free!


Photo

WIN32/FOTOMOTO :(

Started by rezashamdani , Dec 12 2007 08:24 PM

  • Please log in to reply
7 replies to this topic

#1 rezashamdani

rezashamdani

    New Member

  • New Member
  • Pip
  • 4 posts

Posted 12 December 2007 - 08:24 PM

Please help me on removing this virus. thanks in advance

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:23:06, on 13/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Acer\eManager\anbmServ.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe
C:\Program Files\Clarus\IntelliStor LT\IoctlSvc.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Elantech\ktp.exe
C:\PROGRA~1\LAUNCH~1\LManager.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\Program Files\HHVcdV5Sys\VC5Play.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
C:\acer\epm\epm-dm.exe
C:\WINDOWS\System32\locator.exe
C:\WINDOWS\system32\ctfmon.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files\Free Download Manager\fdm.exe
C:\Program Files\HHVcdV5Sys\VC5SecS.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Clarus\IntelliStor LT\ISLTimerD.exe
C:\Program Files\Clarus\IntelliStor LT\ISLDI.exe
C:\Program Files\Virtual CD v5\System\VC5Tray.exe
C:\Program Files\Telkom I-VAS\Premium.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\PROGRA~1\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\gwmamiav.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....age=about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = dsi25:8080
O3 - Toolbar: &Save Flash - {4064EA35-578D-4073-A834-C96D82CBCF40} - C:\Program Files\Save Flash\SaveFlash.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [KTPWare] C:\Program Files\Elantech\ktp.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [VC5Player] C:\Program Files\HHVcdV5Sys\VC5Play.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [EOUApp] C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
O4 - HKLM\..\Run: [epm-dm] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [45ae9b56] rundll32.exe "C:\WINDOWS\system32\vscronye.dll",b
O4 - HKLM\..\Run: [Fonawy] C:\Program Files\Fonawy Standard\Fonawy
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: IntelliStor LT Scheduler.lnk = ?
O4 - Startup: IntelliStor LT Daemon.lnk = C:\Program Files\Clarus\IntelliStor LT\ISLDI.exe
O4 - Startup: Telkom IVAS.lnk = C:\Program Files\Telkom I-VAS\Premium.exe
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download video with Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Upload - {FD4E2FF8-973C-4A19-89BD-8E86B3CFCFE1} - C:\Program Files\Free Download Manager\fumiebtn.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1190337711523
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.mi...b?1190359434972
O17 - HKLM\System\CCS\Services\Tcpip\..\{7DBF694A-CE1D-4B49-9650-5FD6E8783D32}: NameServer = 10.10.1.2
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: DomainService - - C:\WINDOWS\system32\gwmamiav.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: OwnershipProtocol - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Program Files\Clarus\IntelliStor LT\IoctlSvc.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Virtual CD v5 Security service (VC5SecS) - H+H Software GmbH - C:\Program Files\HHVcdV5Sys\VC5SecS.exe

--
End of file - 9230 bytes

    Advertisements

Register to Remove

#2 Markka

Markka

    Advanced Member

  • Banned
  • PipPipPipPip
  • 784 posts

Posted 13 December 2007 - 07:28 AM

Hi and welcome to the forums. :) I'm Markka and I will be helping you with your malware issues. I'll check your HijackThis log. Right now I'm MRU Undergrad, everything that I post to you must be checked by teachers of Malware Removal University. Please be patient. :)

#3 rezashamdani

rezashamdani

    New Member

  • New Member
  • Pip
  • 4 posts

Posted 13 December 2007 - 10:02 PM

ok thanks. i'll wait in patience

#4 Markka

Markka

    Advanced Member

  • Banned
  • PipPipPipPip
  • 784 posts

Posted 14 December 2007 - 07:24 AM

Hello :)

1. Download this file - combofix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your next reply

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall!
_________________

Rename HijackThis.exe to Scanner.exe by doing the following;


    [*]Navigate to here; "The Path of the HijackThis!"
    [*]Right-click on the HijackThis.exe
    [*]Choose from the pull-down menu; "Rename"
    [*]And now Rename HijackThis.exe to Scanner.exe
    [*]When you've renamed HijackThis, then open it..
    [*]Take a fresh HijackThis log (Do a system scan and save a log file)
    [*]Post the fresh HijackThis log and Contents of C:\ComboFix.txt to here.
    [/list]

#5 rezashamdani

rezashamdani

    New Member

  • New Member
  • Pip
  • 4 posts

Posted 17 December 2007 - 01:07 AM

ComboFix 07-12-16.4 - Administrator 2007-12-17 13:37:26.1 - FAT32x86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.284 [GMT 7:00]
Running from: C:\Downloads\Software\ComboFix.exe
* Created a new restore point
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\agnfnrwk.exe
C:\WINDOWS\system32\bbqmewbb.dll
C:\WINDOWS\system32\bbwemqbb.ini
C:\WINDOWS\system32\bhaevese.dll
C:\WINDOWS\system32\binrhjei.dll
C:\WINDOWS\system32\bsmyieio.exe
C:\WINDOWS\system32\bwswoudi.dll
C:\WINDOWS\system32\Cache
C:\WINDOWS\system32\efcbxyx.dll
C:\WINDOWS\system32\ekxesyrf.dll
C:\WINDOWS\system32\eovieduh.ini
C:\WINDOWS\system32\gwmamiav.exe
C:\WINDOWS\system32\hhhkj.bak1
C:\WINDOWS\system32\hhhkj.bak2
C:\WINDOWS\system32\hhhkj.ini
C:\WINDOWS\system32\hhhkj.ini2
C:\WINDOWS\system32\hqxjkmrv.dll
C:\WINDOWS\system32\hudeivoe.dll
C:\WINDOWS\system32\imlccugl.dll
C:\WINDOWS\system32\jkhhh.dll
C:\WINDOWS\system32\jsbseaxv.dll
C:\WINDOWS\system32\jtvcajqx.ini
C:\WINDOWS\system32\klddyase.exe
C:\WINDOWS\system32\kyvmuknd.exe
C:\WINDOWS\system32\lgucclmi.ini
C:\WINDOWS\system32\nbwfymgo.dll
C:\WINDOWS\system32\nsabsaad.exe
C:\WINDOWS\system32\oglwrcfa.exe
C:\WINDOWS\system32\qplmjfoj.exe
C:\WINDOWS\system32\stojghni.exe
C:\WINDOWS\system32\sxcplrdm.dll
C:\WINDOWS\system32\vxhfiuqy.dll
C:\WINDOWS\system32\xqjacvtj.dll
C:\WINDOWS\system32\xyiixnjo.dll
C:\WINDOWS\system32\yvdbpqpa.dll

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.
-------\LEGACY_DOMAINSERVICE
-------\DomainService
-------\nm


((((((((((((((((((((((((( Files Created from 2007-11-17 to 2007-12-17 )))))))))))))))))))))))))))))))
.

2007-12-17 13:59 . 2007-12-17 13:59 <DIR> d--hs---- C:\FOUND.003
2007-12-14 13:04 . 2007-12-14 13:04 <DIR> d-------- C:\Program Files\prjMegaTrain
2007-12-14 12:52 . 2007-12-14 12:53 <DIR> d-------- C:\Program Files\EA GAMES
2007-12-13 10:42 . 2007-12-13 10:42 3,932,214 --a------ C:\WINDOWS\BricoPack Wallpaper.bmp
2007-12-13 10:38 . 2007-12-13 10:38 <DIR> d-------- C:\WINDOWS\Packs
2007-12-13 10:28 . 2007-12-13 10:28 <DIR> d-------- C:\Program Files\StarPrint Limited
2007-12-13 10:28 . 2004-03-13 12:27 362,200 -ra------ C:\WINDOWS\system32\VSPRINT7.OCX
2007-12-13 10:28 . 2004-03-13 12:27 173,784 -ra------ C:\WINDOWS\system32\VSPDF.OCX
2007-12-13 10:28 . 2004-07-11 21:28 69,632 --a------ C:\WINDOWS\system32\spColorPicker.ocx
2007-12-13 10:28 . 2005-08-14 14:05 45,056 --a------ C:\WINDOWS\system32\AutoErrorTrace.dll
2007-12-13 10:28 . 2004-05-18 08:23 36,864 --a------ C:\WINDOWS\system32\HyperLabel.ocx
2007-12-13 10:28 . 2004-05-22 12:47 32,768 --a------ C:\WINDOWS\system32\spFrame.ocx
2007-12-13 10:20 . 2007-12-13 10:20 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\voiprakyat
2007-12-13 09:43 . 2007-12-13 09:43 <DIR> d-------- C:\Program Files\RocketDock
2007-12-13 09:08 . 2007-12-13 09:08 <DIR> d-------- C:\Program Files\Trend Micro
2007-12-12 06:46 . 2007-12-12 06:46 <DIR> d--hs---- C:\FOUND.002
2007-12-12 06:04 . 2007-12-12 06:04 <DIR> d-------- C:\Program Files\Common Files\Borland Shared
2007-12-12 06:04 . 1999-01-20 05:01 210,032 --a------ C:\WINDOWS\system32\DBCLIENT.DLL
2007-12-12 06:04 . 1999-11-12 05:11 183,808 --a------ C:\WINDOWS\system32\BDEADMIN.CPL
2007-12-12 06:04 . 2007-12-12 06:06 13,030 --a------ C:\PDOXUSRS.NET
2007-12-12 05:34 . 2007-12-12 05:34 <DIR> d-------- C:\Program Files\Fonawy Standard
2007-12-12 05:16 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2007-12-12 05:16 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
2007-12-11 18:02 . 2007-12-14 10:51 1,100,478 ---hs---- C:\WINDOWS\system32\eynorcsv.ini
2007-12-11 14:53 . 2007-12-11 14:54 834,520 ---hs---- C:\WINDOWS\system32\cymbjham.ini
2007-12-11 07:51 . 2007-12-11 18:37 2,563,254 --a------ C:\WINDOWS\ACD Wallpaper.bmp
2007-12-11 07:44 . 2007-12-11 07:44 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\ACD Systems
2007-12-11 07:27 . 2007-12-11 07:27 <DIR> d-------- C:\Program Files\Clarus
2007-12-10 09:11 . 2007-12-11 14:53 834,460 ---hs---- C:\WINDOWS\system32\aslithra.ini
2007-12-09 21:38 . 2007-12-09 21:38 832,995 ---hs---- C:\WINDOWS\system32\hibtxlfu.ini
2007-12-08 19:59 . 2007-12-09 21:32 832,935 ---hs---- C:\WINDOWS\system32\lksesups.ini
2007-12-07 10:50 . 2007-12-08 19:54 832,875 ---hs---- C:\WINDOWS\system32\djolxtuk.ini
2007-12-05 12:32 . 2007-12-05 12:32 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Media Player Classic
2007-12-05 11:14 . 2007-12-05 11:14 <DIR> dr-h----- C:\Documents and Settings\Administrator\Application Data\yahoo!
2007-12-05 10:22 . 2007-12-05 10:22 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Sucofindo
2007-12-04 14:43 . 2007-12-04 14:43 <DIR> dr-h----- C:\MSOCache
2007-12-03 10:14 . 2007-12-03 10:14 <DIR> d-------- C:\Program Files\Super Fast Shutdown
2007-12-03 10:13 . 2007-12-03 10:13 <DIR> d-------- C:\Program Files\Common Files\ACD Systems
2007-12-03 10:13 . 2007-12-03 10:13 <DIR> d-------- C:\Program Files\ACD Systems
2007-12-03 10:13 . 2007-12-03 10:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ACD Systems
2007-11-30 09:43 . 2007-11-30 09:43 8,192 --ahs---- C:\WINDOWS\Thumbs.db
2007-11-28 14:43 . 2007-11-28 14:43 <DIR> d-------- C:\Program Files\PC Icon Editor
2007-11-28 14:43 . 2007-11-28 14:43 <DIR> d-------- C:\Program Files\Icon Converter Plus
2007-11-28 14:43 . 2007-11-28 14:44 279,518 --a------ C:\WINDOWS\Icon Converter Plus Uninstaller.exe
2007-11-28 14:43 . 2007-11-28 14:43 273,860 --a------ C:\WINDOWS\PC Icon Editor Uninstaller.exe
2007-11-28 14:38 . 2007-11-28 14:38 274,493 --a------ C:\WINDOWS\PC Icon Extractor Uninstaller.exe
2007-11-28 14:37 . 2007-11-28 14:38 <DIR> d-------- C:\Program Files\PC Icon Extractor
2007-11-26 13:39 . 2007-11-26 13:39 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
2007-11-26 11:34 . 2007-11-26 11:34 <DIR> d-------- C:\Program Files\Telkom I-VAS
2007-11-25 19:07 . 2007-11-25 19:07 <DIR> d-------- C:\WINDOWS\7F878808B4624A82B956452595F8B29A.TMP
2007-11-25 18:59 . 2007-11-25 18:59 <DIR> d--hs---- C:\FOUND.001
2007-11-25 10:29 . 2007-11-25 10:29 <DIR> d-------- C:\Program Files\MSBuild
2007-11-25 10:09 . 2007-11-25 13:30 151 --a------ C:\WINDOWS\PhotoSnapViewer.INI
2007-11-21 11:22 . 2007-11-21 11:22 <DIR> d-------- C:\Program Files\RapidSharezX
2007-11-21 11:21 . 2007-12-14 13:04 286,720 --------- C:\WINDOWS\Setup1.exe
2007-11-21 11:21 . 2007-11-21 11:21 73,216 --------- C:\WINDOWS\ST6UNST.EXE
2007-11-21 10:08 . 2007-11-21 10:08 <DIR> d-------- C:\Documents and Settings\rezash\Application Data\Free Upload Manager
2007-11-21 10:04 . 2007-11-21 10:04 <DIR> d-------- C:\Documents and Settings\rezash\Application Data\Free Download Manager
2007-11-21 09:24 . 2006-04-20 18:51 359,808 --a------ C:\WINDOWS\system32\drivers\tcpip.sys.flg
2007-11-21 09:23 . 2007-11-21 09:23 <DIR> d-------- C:\Program Files\FlashGet
2007-11-21 09:12 . 2007-11-21 09:12 <DIR> d-------- C:\Documents and Settings\rezash\Application Data\DMCache
2007-11-19 14:09 . 2007-11-19 14:09 <DIR> d-------- C:\Program Files\Valve

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-13 03:40 218,624 ----a-w C:\WINDOWS\system32\uxtheme.dll
2007-11-16 03:50 --------- d-sh--w C:\Documents and Settings\All Users\Application Data\MPK
2007-11-16 02:57 --------- d-----w C:\Documents and Settings\All Users\Application Data\Macrovision
2007-11-16 02:56 --------- d-----w C:\Program Files\Common Files\Adobe Systems Shared
2007-11-16 02:28 --------- d-----w C:\Program Files\RKFree
2007-11-16 02:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\rkfree
2007-11-14 02:24 --------- d-----w C:\Program Files\IFH
2007-11-13 10:25 20,480 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
2007-11-10 23:23 --------- d-----w C:\Program Files\Xilisoft
2007-11-05 08:09 --------- d-----w C:\Documents and Settings\rezash\Application Data\DAEMON Tools Pro
2007-11-05 08:08 --------- d-----w C:\Program Files\DAEMON Tools Pro
2007-11-05 08:02 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-11-05 07:25 98,304 ----a-w C:\WINDOWS\system32CmdLineExt.dll
2007-11-04 12:36 17,801 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys
2007-11-02 09:52 --------- d-----w C:\Documents and Settings\rezash\Application Data\Intel
2007-11-02 09:52 --------- d-----w C:\Documents and Settings\Administrator\Application Data\Intel
2007-11-02 09:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\Intel
2007-10-30 23:42 3,590,656 ------w C:\WINDOWS\system32\dllcache\mshtml.dll
2007-10-30 09:14 --------- d-----w C:\Program Files\IGC
2007-10-30 09:13 --------- d-----w C:\Program Files\ESRI
2007-10-30 09:13 --------- d-----w C:\Program Files\Common Files\ESRI
2007-10-29 22:43 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-29 22:43 1,287,680 ------w C:\WINDOWS\system32\dllcache\quartz.dll
2007-10-29 05:48 --------- d-----w C:\Documents and Settings\rezash\Application Data\Media Player Classic
2007-10-29 01:24 --------- d-----w C:\Program Files\MapInfo
2007-10-29 01:24 --------- d-----w C:\Program Files\Common Files\MapInfo
2007-10-27 10:39 230,912 ----a-w C:\WINDOWS\system32\wmasf.dll
2007-10-27 10:39 230,912 ------w C:\WINDOWS\system32\dllcache\wmasf.dll
2007-10-27 10:37 2,109,440 ------w C:\WINDOWS\system32\dllcache\wmvcore.dll
2007-10-26 03:34 8,460,288 ----a-w C:\WINDOWS\system32\dllcache\shell32.dll
2007-10-25 15:47 --------- d-----w C:\Program Files\Black Bean
2007-10-25 04:41 --------- d-----w C:\Program Files\Save Flash
2007-10-25 03:24 --------- d-----w C:\Documents and Settings\rezash\Application Data\AdobeUM
2007-10-24 08:33 --------- d-----w C:\Program Files\DivX
2007-10-23 04:22 --------- d-----w C:\Program Files\TatukGIS
2007-10-10 23:56 824,832 ------w C:\WINDOWS\system32\dllcache\wininet.dll
2007-10-10 23:56 671,232 ------w C:\WINDOWS\system32\dllcache\mstime.dll
2007-10-10 23:56 232,960 ------w C:\WINDOWS\system32\dllcache\webcheck.dll
2007-10-10 23:56 105,984 ------w C:\WINDOWS\system32\dllcache\url.dll
2007-10-10 23:56 102,400 ------w C:\WINDOWS\system32\dllcache\occache.dll
2007-10-10 23:56 1,159,680 ------w C:\WINDOWS\system32\dllcache\urlmon.dll
2007-10-10 23:55 63,488 ------w C:\WINDOWS\system32\dllcache\icardie.dll
2007-10-10 23:55 6,065,664 ------w C:\WINDOWS\system32\dllcache\ieframe.dll
2007-10-10 23:55 52,224 ------w C:\WINDOWS\system32\dllcache\msfeedsbs.dll
2007-10-10 23:55 478,208 ------w C:\WINDOWS\system32\dllcache\mshtmled.dll
2007-10-10 23:55 459,264 ------w C:\WINDOWS\system32\dllcache\msfeeds.dll
2007-10-10 23:55 44,544 ------w C:\WINDOWS\system32\dllcache\iernonce.dll
2007-10-10 23:55 384,512 ------w C:\WINDOWS\system32\dllcache\iedkcs32.dll
2007-10-10 23:55 383,488 ------w C:\WINDOWS\system32\dllcache\ieapfltr.dll
2007-10-10 23:55 27,648 ------w C:\WINDOWS\system32\dllcache\jsproxy.dll
2007-10-10 23:55 267,776 ------w C:\WINDOWS\system32\dllcache\iertutil.dll
2007-10-10 23:55 230,400 ------w C:\WINDOWS\system32\dllcache\ieaksie.dll
2007-10-10 23:55 214,528 ------w C:\WINDOWS\system32\dllcache\dxtrans.dll
2007-10-10 23:55 193,024 ------w C:\WINDOWS\system32\dllcache\msrating.dll
2007-10-10 23:55 153,088 ------w C:\WINDOWS\system32\dllcache\ieakeng.dll
2007-10-10 23:55 132,608 ------w C:\WINDOWS\system32\dllcache\extmgr.dll
2007-10-10 23:55 124,928 ------w C:\WINDOWS\system32\dllcache\advpack.dll
2007-10-10 10:59 70,656 ------w C:\WINDOWS\system32\dllcache\ie4uinit.exe
2007-10-10 10:59 625,152 ------w C:\WINDOWS\system32\dllcache\iexplore.exe
2007-10-10 10:59 13,824 ------w C:\WINDOWS\system32\dllcache\ieudinit.exe
2007-10-10 05:46 161,792 ----a-w C:\WINDOWS\system32\dllcache\ieakui.dll
2007-09-28 11:07 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2007-09-28 11:05 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2007-09-28 11:05 739,840 ----a-w C:\WINDOWS\system32\divx.dll
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56]
"Free Download Manager"="C:\Program Files\Free Download Manager\fdm.exe" [2007-06-26 21:48]
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-08-30 17:43]
"RocketDock"="C:\Program Files\RocketDock\RocketDock.exe" [2007-09-02 13:58]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [2005-03-22 12:57]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [2005-03-22 12:53]
"SoundMan"="SOUNDMAN.EXE" [2005-03-24 20:20 C:\WINDOWS\SOUNDMAN.EXE]
"KTPWare"="C:\Program Files\Elantech\ktp.exe" [2005-07-20 15:13]
"LManager"="C:\PROGRA~1\LAUNCH~1\LManager.exe" [2005-04-28 09:43]
"ePowerManagement"="C:\Acer\ePM\ePM.exe" [2005-03-15 10:03]
"ShStatEXE"="C:\Program Files\Network Associates\VirusScan\SHSTAT.exe" [2004-09-22 20:00]
"McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" [2004-08-06 03:50]
"Network Associates Error Reporting Service"="C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" [2003-10-07 09:48]
"VC5Player"="C:\Program Files\HHVcdV5Sys\VC5Play.exe" [2003-07-24 12:53]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 18:20]
"WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2007-05-15 05:22]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-15 11:27]
"EOUApp"="C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe" [2004-10-15 11:31]
"epm-dm"="c:\acer\epm\epm-dm.exe" [2005-08-11 19:21]
"Fonawy"="C:\Program Files\Fonawy Standard\Fonawy" []

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:56]

C:\Documents and Settings\Administrator\Start Menu\Programs\Startup\
IntelliStor LT Scheduler.lnk - C:\Program Files\Clarus\IntelliStor LT\ISLTimerD.exe [2007-12-11 07:27:37]
IntelliStor LT Daemon.lnk - C:\Program Files\Clarus\IntelliStor LT\ISLDI.exe [2007-12-11 07:27:36]
Telkom IVAS.lnk - C:\Program Files\Telkom I-VAS\Premium.exe [2006-03-22 11:07:42]
Y'z Toolbar.lnk - C:\WINDOWS\Packs\Crystal XP\YzToolbar\YzToolbar.exe [2007-12-13 10:42:27]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Service Manager.lnk - C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe [2007-01-31 11:30:37]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableCAD"= 0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoSMHelp"= 01000000

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-10-15 11:27 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YASU]
C:\Program Files\DAEMON Tools Pro\YASU.exe -s -c

R1 NaiAvTdi1;NaiAvTdi1;C:\WINDOWS\system32\drivers\mvstdi5x.sys
R1 vbev5mp;vbev5mp;C:\WINDOWS\system32\Drivers\vbev5mp.sys
R2 EpmPsd;Acer EPM Power Scheme Driver;\??\C:\WINDOWS\System32\drivers\epm-psd.sys
R2 EpmShd;Acer EPM System Hardware Driver;\??\C:\WINDOWS\System32\drivers\epm-shd.sys
R2 osaio;osaio;\??\C:\WINDOWS\System32\drivers\osaio.sys
R2 osanbm;osanbm;\??\C:\WINDOWS\System32\drivers\osanbm.sys
R2 SMTPSVC;Simple Mail Transfer Protocol (SMTP);C:\WINDOWS\system32\inetsrv\inetinfo.exe
R2 SQLWriter;SQL Server VSS Writer;"c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe"
R3 DKbFltr;Dritek Keyboard Filter Driver;C:\WINDOWS\system32\DRIVERS\DKbFltr.sys
R3 EMSCR;EMSCR;C:\WINDOWS\system32\DRIVERS\EMS7SK.sys
R3 ESDCR;ESDCR;C:\WINDOWS\system32\DRIVERS\ESD7SK.sys
R3 ESMCR;ESMCR;C:\WINDOWS\system32\DRIVERS\ESM7SK.sys
R3 Ktp;Elantech Touchpad;C:\WINDOWS\system32\DRIVERS\Ktp.sys
R4 DritekPortIO;Dritek General Port I/O;\??\C:\PROGRA~1\LAUNCH~1\DPortIO.sys
S3 mircap;mircap;C:\WINDOWS\system32\DRIVERS\mircap.sys
S3 mtpaudio;Panasonic Projector Audio Device Driver;C:\WINDOWS\system32\DRIVERS\mtpaudio.sys
S3 seccap;seccap;C:\WINDOWS\system32\DRIVERS\seccap.sys
S4 msvsmon80;Visual Studio 2005 Remote Debugger;"C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe" /service msvsmon80

.
Contents of the 'Scheduled Tasks' folder
"2007-12-17 07:03:34 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
- C:\Program Files\Windows Defender\MpCmdRun.exe
.
**************************************************************************

catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-17 14:01:27
Windows 5.1.2600 Service Pack 2 FAT NTAPI

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2007-12-17 14:05:14 - machine was rebooted
.
2007-12-14 03:58:44 --- E O F ---

#6 Markka

Markka

    Advanced Member

  • Banned
  • PipPipPipPip
  • 784 posts

Posted 17 December 2007 - 08:24 AM

Hello :)

Open notepad and copy/paste the text in the quotebox below into it:

File::
C:\WINDOWS\system32\aslithra.ini
C:\WINDOWS\system32\hibtxlfu.ini
C:\WINDOWS\system32\lksesups.ini
C:\WINDOWS\system32\djolxtuk.ini


Save this as CFScript.txt

Then drag the CFScript.txt into ComboFix.exe as you see in the screenshot below.

Posted Image

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThislog.

#7 rezashamdani

rezashamdani

    New Member

  • New Member
  • Pip
  • 4 posts

Posted 20 December 2007 - 06:20 PM

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:20:26, on 21/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16574)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Acer\eManager\anbmServ.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Elantech\ktp.exe
C:\PROGRA~1\LAUNCH~1\LManager.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\Program Files\HHVcdV5Sys\VC5Play.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
C:\acer\epm\epm-dm.exe
C:\WINDOWS\system32\inetsrv\inetinfo.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Free Download Manager\fdm.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe
C:\Program Files\Clarus\IntelliStor LT\IoctlSvc.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
C:\Program Files\Clarus\IntelliStor LT\ISLTimerD.exe
C:\Program Files\Clarus\IntelliStor LT\ISLDI.exe
C:\Program Files\Virtual CD v5\System\VC5Tray.exe
C:\Program Files\Telkom I-VAS\Premium.exe
C:\WINDOWS\Packs\Crystal XP\YzToolbar\YzToolbar.exe
C:\WINDOWS\System32\locator.exe
c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
C:\Program Files\HHVcdV5Sys\VC5SecS.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - C:\Program Files\Free Download Manager\iefdm2.dll
O3 - Toolbar: &Save Flash - {4064EA35-578D-4073-A834-C96D82CBCF40} - C:\Program Files\Save Flash\SaveFlash.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [KTPWare] C:\Program Files\Elantech\ktp.exe
O4 - HKLM\..\Run: [LManager] C:\PROGRA~1\LAUNCH~1\LManager.exe
O4 - HKLM\..\Run: [ePowerManagement] C:\Acer\ePM\ePM.exe boot
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKLM\..\Run: [VC5Player] C:\Program Files\HHVcdV5Sys\VC5Play.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [EOUApp] C:\Program Files\Intel\Wireless\Bin\EOUWiz.exe
O4 - HKLM\..\Run: [epm-dm] c:\acer\epm\epm-dm.exe
O4 - HKLM\..\Run: [Fonawy] C:\Program Files\Fonawy Standard\Fonawy
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Free Download Manager] C:\Program Files\Free Download Manager\fdm.exe -autorun
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: IntelliStor LT Scheduler.lnk = ?
O4 - Startup: IntelliStor LT Daemon.lnk = C:\Program Files\Clarus\IntelliStor LT\ISLDI.exe
O4 - Startup: Telkom IVAS.lnk = C:\Program Files\Telkom I-VAS\Premium.exe
O4 - Startup: Y'z Toolbar.lnk = ?
O4 - Global Startup: Service Manager.lnk = C:\Program Files\Microsoft SQL Server\80\Tools\Binn\sqlmangr.exe
O8 - Extra context menu item: Download all with Free Download Manager - file://C:\Program Files\Free Download Manager\dlall.htm
O8 - Extra context menu item: Download selected with Free Download Manager - file://C:\Program Files\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Download video with Free Download Manager - file://C:\Program Files\Free Download Manager\dlfvideo.htm
O8 - Extra context menu item: Download with Free Download Manager - file://C:\Program Files\Free Download Manager\dllink.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra button: Upload - {FD4E2FF8-973C-4A19-89BD-8E86B3CFCFE1} - C:\Program Files\Free Download Manager\fumiebtn.dll
O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1190337711523
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.mi...b?1190359434972
O16 - DPF: {D87BE747-157C-49BD-A392-A68B75A54947} (IaxClientOcx Control) - file:///C:/Program%20Files/VoIP%20Rakyat%20Communicator/voiprakyat/src/voip_call/iaxWebPhone.CAB
O17 - HKLM\System\CCS\Services\Tcpip\..\{0115F579-4C59-429E-A920-1070278BBA70}: NameServer = 203.130.196.5 203.130.208.18
O17 - HKLM\System\CCS\Services\Tcpip\..\{7DBF694A-CE1D-4B49-9650-5FD6E8783D32}: NameServer = 10.10.1.2
O17 - HKLM\System\CS1\Services\Tcpip\..\{0115F579-4C59-429E-A920-1070278BBA70}: NameServer = 203.130.196.5 203.130.208.18
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Notebook Manager Service (anbmService) - OSA Technologies Inc. - C:\Acer\eManager\anbmServ.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: OwnershipProtocol - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\OProtSvc.exe
O23 - Service: PLFlash DeviceIoControl Service - Prolific Technology Inc. - C:\Program Files\Clarus\IntelliStor LT\IoctlSvc.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: Virtual CD v5 Security service (VC5SecS) - H+H Software GmbH - C:\Program Files\HHVcdV5Sys\VC5SecS.exe

--
End of file - 9897 bytes

#8 Markka

Markka

    Advanced Member

  • Banned
  • PipPipPipPip
  • 784 posts

Posted 21 December 2007 - 04:02 AM

Hello :)

Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.
http://www.ewido.net/en/download/
  • Install AVG Anti-Spyware by double clicking the installer.
  • Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
  • On the main screen under Your Computer's security.
    • Click on Change state next to Resident shield. It should now change to inactive.
    • Click on Change state next to Automatic updates. It should now change to inactive.
    • Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
    • Wait until you see the Update succesfull message.
  • Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
  • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
If you are having problems with the updater, you can use this link to manually update ewido.
AVG Anti-Spyware manual updates.
Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.
__________________

Please then reboot your computer in Safe Mode by doing the following:
  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, the Advanced Options Menu should appear;
  • Select the first option, to run Windows in Safe Mode, then press Enter.
  • Choose your usual account.
__________________

Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.
  • Click on Scanner on the toolbar.
  • Click on the Settings tab.
    • Under How to act?
      • Click on Recommended Action and choose Quarantine from the popup menu.
    • Under How to scan?
      • All checkboxes should be ticked.
    • Under Possibly unwanted software:
      • All checkboxes should be ticked.
    • Under Reports:
      • Select Do not Automatically generate reports and uncheck Only if threats were found.
    • Under What to scan?
      • Select Scan every file.
  • Click on the Scan tab.
  • Click on Complete System Scan to start the scan process.
  • Let the program scan the machine.
  • When the scan has finished, follow the instructions below.
    IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.
    • Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
    • At the bottom of the window click on the Apply all Actions button. (3)
      Posted Image
  • When done, click the Save Scan Report button. (4)
    • Click the Save Report as button.
    • Save the report to your Desktop.
  • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
Reboot in Normal Mode.
_________________________

Post:
- A fresh HijackThis log
- AVG Anti-Spyware's report
- Logfile of ComboFix

Related Topics

Back to Virus, Spyware & Malware Removal · Next Unread Topic →

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. What the Tech
  2. → Spyware / Malware / Virus Removal
  3. → Virus, Spyware & Malware Removal
  4. Privacy Policy
  5. Terms of Use ·