bencole
Topic Starter
So, my little cousin has been having problems with her machine, and things started getting out of hand. As I'm currently studying Software Design, I've become the designated family technician. I've been working on her computer at my dad's office, so I havn't been connecting it to the internet (everything has been done through a thoroughly scanned USB key, with autoplay & autorun blocked - this post is being made on my personal machine). I've posted a list of everything I've done so far, and I was just looking to see if I'd managed to catch everything or not…
I tried to provide as much information as possible, but if anything else is needed, just let me know!
SYSTEM SPECIFICATIONS
=========================================================
Windows XP Pro SP2
Dell Latitude 620
Internal/Infected Hard drives
- C:\ (SYSTEM - Windows, Docs & Settings, Program Files, etc)
- D:\ (STORAGE - My Cousin's Documents)
PROBLEMS
=========================================================
- know it has viruses as it infected my other cousin's USB key
- unable to view hidden files & folders
- unable to view protected system files
- had LimeWire on it for downloading music - I know that this is where some of the trojans came from ('cus they were located in files downloaded from it)
CLEANING PROCESS (in chronological order)
=========================================================
Limewire
- Uninstalled
Symantec Corporate
- Already on machine (but not set up for her account)
- First scan found 68 viruses, 3 trojans & 2 rootkits (all deleted)
- Second scan found 6 viruses & 1 trojan (all deleted)
- Classes of problems found (in these 2 scans as well as previously):
RegEdit
- Deleted old entry & added replacement D-WORD (to attempt to view hidden files & folders):
CCleaner
- Installed
- Removed carp**
- Cleaned up registry
AVG Free 8.0
- Installed
- See following log
RegEdit
- Added key & string (to block autoplay/autorun):
Spycatcher Express
- Installed
- Unable to run (needed internet connection)
ATF Cleaner
- Installed
- Ran cleaner & removed all possibilities
Malwarebytes' Anti-Malware
- Installed
- See following log
Spyware Blaster
- Installed
- Blocking IE threats
ZoneAlarm
- Installed
HijackThis
- Installed
- See following log
AVG OVERVIEW
=========================================================
Scan "Scan specific files or folders" was finished.
—————————————————
Infections found: 12
Infected objects removed or healed: 12
Not removed or healed: 0
Spyware found: 0
Spyware removed: 0
Not removed: 0
Warnings count: 0
Information count: 0
Scan started: July 29, 2008, 12:11:50 PM
Scan finished: July 29, 2008, 1:26:17 PM (1 hour(s) 14 minute(s) 26 second(s)),
Total object scanned: 548200
User who launched the scan: Administrator
Infections
———-
FILE INFECTION RESULT
C:\Documents and Settings\jcole\Local Virus found Win32/Heur Moved to Virus Vault
Settings\Temporary Internet Files\
Content.IE5\HI57F6LC\zz[1].exe
C:\g2pfnid.com Virus found Win32/Heur Moved to Virus Vault
C:\jix9a.bat Virus found Win32/Heur Moved to Virus Vault
C:\k6wkwon2.exe Virus found Win32/Heur Moved to Virus Vault
C:\WINDOWS\system32\ckvo.exe Virus found Win32/Heur Moved to Virus Vault
C:\WINDOWS\system32\ckvo0.dll Virus found Win32/Heur Moved to Virus Vault
C:\WINDOWS\system32\kavo.exe Virus found Win32/Heur Moved to Virus Vault
D:\Desktop\install.exe Trojan horse Downloader.Agent.IRX Moved to Virus Vault
D:\g2pfnid.com Virus found Win32/Heur Moved to Virus Vault
D:\jix9a.bat Virus found Win32/Heur Moved to Virus Vault
D:\k6wkwon2.exe Virus found Win32/Heur Moved to Virus Vault
G:\jix9a.bat Virus found Win32/Heur Moved to Virus Vault
-EOF—————————————————–
MALWAREBYTE'S LOG
=========================================================
Malwarebytes' Anti-Malware 1.23
Database version: 985
Windows 5.1.2600 Service Pack 2
3:43:13 PM 29/07/2008
mbam-log-7-29-2008 (15-43-13).txt
Scan type: Full Scan (C:\|D:\|F:\|G:\|)
Objects scanned: 172960
Time elapsed: 1 hour(s), 9 minute(s), 59 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 32
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
Folders Infected:
(No malicious items detected)
Files Infected:
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP389\A0044779.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP389\A0045804.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP389\A0045837.com (Trojan.Vaklik) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP389\A0045890.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP390\A0045896.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP391\A0045901.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP392\A0045970.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP393\A0045981.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP394\A0045985.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP395\A0046099.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP396\A0046221.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP397\A0046336.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP398\A0046453.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP398\A0046573.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP399\A0046584.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP389\A0044780.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP389\A0045807.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP389\A0045867.com (Trojan.Vaklik) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP389\A0045878.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP389\A0045892.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP390\A0045898.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP391\A0045903.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP392\A0045972.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP393\A0045983.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP394\A0045987.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP395\A0046101.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP396\A0046223.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP397\A0046338.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP398\A0046455.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP398\A0046575.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP399\A0046586.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP400\A0049565.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
-EOF—————————————————–
HIJACKTHIS LOG
=========================================================
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:35:42 PM, on 29/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\SMART Technologies Inc\SMART Board Software\SMARTBoardService.exe
C:\Program Files\SMART Technologies Inc\SMART Board Software\WebServer.exe
C:\Program Files\SynchronEyes Student 7.0\synchroneyessrv.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Apoint\Apntex.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\SpyCatcher\Protector.exe
C:\Program Files\SpyCatcher\Scheduler daemon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bearnet.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.javacoolsoftware.com/sb-link/autoupdate.html
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareBlock Class - {0A87E45F-537A-40B4-B812-E2544C21A09F} - C:\Program Files\SpyCatcher\SCActiveBlock.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SMART Notebook Download Plugin - {67BCF957-85FC-4036-8DC4-D4D80E00A77B} - C:\Program Files\SMART Technologies Inc\Notebook Software\NotebookPlugin.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O2 - BHO: SynchronEye Web Browser Block - {B0A26676-4185-479F-B7B1-B3968B956468} - C:\Program Files\SynchronEyes Student 7.0\SEyesIEBlock.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SMART Mirror Driver Monitor Service] "C:\Program Files\Common Files\SMART Technologies Inc\Mirror Driver\monitorservice.exe"
O4 - HKLM\..\Run: [SynchronEyes 7.0 Help Service] C:\Program Files\SynchronEyes Student 7.0\SynchronEyesClient.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SpyCatcher Reminder] C:\Program Files\SpyCatcher\SpyCatcher.exe reminder
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Scheduler.lnk = C:\Program Files\SpyCatcher\Scheduler daemon.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: SMART Board Tools.lnk = C:\Program Files\SMART Technologies Inc\SMART Board Software\SMARTBoardTools.exe
O4 - Global Startup: SpyCatcher Protector.lnk = C:\Program Files\SpyCatcher\Protector.exe
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/Facebo…toUploader5.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = tcs.on.ca
O17 - HKLM\Software\..\Telephony: DomainName = tcs.on.ca
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = tcs.on.ca
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: secuload.dll,avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CounterSpyAgent - Sunbelt Software - C:\Program Files\Sunbelt Software\CounterSpy\Agent\SBCSESvc.exe
O23 - Service: DataSvr2 - Unknown owner - C:\Program Files\Wave Systems Corp\Common\DataServer.exe (file missing)
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SMART Board Service - SMART Technologies Inc. - C:\Program Files\SMART Technologies Inc\SMART Board Software\SMARTBoardService.exe
O23 - Service: SMART Mirror Driver Monitor Service - SMART Technologies - C:\Program Files\Common Files\SMART Technologies Inc\Mirror Driver\monitorservice.exe
O23 - Service: SMART Web Server - Unknown owner - C:\Program Files\SMART Technologies Inc\SMART Board Software\WebServer.exe
O23 - Service: SynchronEyes Software 7.0 Helper Service - SMART Technologies Inc. - C:\Program Files\SynchronEyes Student 7.0\synchroneyessrv.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
–
End of file - 11133 bytes
CURRENT CONDITION
=========================================================
- can now see hidden files & folders
- can now see protected operating system folders
- flash drive not getting infected
So, I was just wondering if someone could look over the HijackThis log file and make sure that it actually is clean, and that this isn't just a temporary state of cleanliness. I will obviously remove some of the installed software, it was just to make sure that everything that could be caught, was. Any help would be much appreciated!
Thanks in advance,
bencole
I tried to provide as much information as possible, but if anything else is needed, just let me know!
SYSTEM SPECIFICATIONS
=========================================================
Windows XP Pro SP2
Dell Latitude 620
Internal/Infected Hard drives
- C:\ (SYSTEM - Windows, Docs & Settings, Program Files, etc)
- D:\ (STORAGE - My Cousin's Documents)
PROBLEMS
=========================================================
- know it has viruses as it infected my other cousin's USB key
- unable to view hidden files & folders
- unable to view protected system files
- had LimeWire on it for downloading music - I know that this is where some of the trojans came from ('cus they were located in files downloaded from it)
CLEANING PROCESS (in chronological order)
=========================================================
Limewire
- Uninstalled
Symantec Corporate
- Already on machine (but not set up for her account)
- First scan found 68 viruses, 3 trojans & 2 rootkits (all deleted)
- Second scan found 6 viruses & 1 trojan (all deleted)
- Classes of problems found (in these 2 scans as well as previously):
Bloodhound.Packed.Jmp
Hacktool.Rootkit
Infostealer.Gampass
Packed.Generic.61
Trojan Horse
Trojan.Packed.NsAnti
Trojan.Wimad
W32.Gammima.AG
RegEdit
- Deleted old entry & added replacement D-WORD (to attempt to view hidden files & folders):
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\explorer\Advanced\Folder\Hidden\SHOWALL]
"CheckedValue"=dword:00000001
CCleaner
- Installed
- Removed carp**
- Cleaned up registry
AVG Free 8.0
- Installed
- See following log
RegEdit
- Added key & string (to block autoplay/autorun):
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\IniFileMapping\Autorun.inf]
"@"="@SYS:DoesNotExist"
Spycatcher Express
- Installed
- Unable to run (needed internet connection)
ATF Cleaner
- Installed
- Ran cleaner & removed all possibilities
Malwarebytes' Anti-Malware
- Installed
- See following log
Spyware Blaster
- Installed
- Blocking IE threats
ZoneAlarm
- Installed
HijackThis
- Installed
- See following log
AVG OVERVIEW
=========================================================
Scan "Scan specific files or folders" was finished.
—————————————————
Infections found: 12
Infected objects removed or healed: 12
Not removed or healed: 0
Spyware found: 0
Spyware removed: 0
Not removed: 0
Warnings count: 0
Information count: 0
Scan started: July 29, 2008, 12:11:50 PM
Scan finished: July 29, 2008, 1:26:17 PM (1 hour(s) 14 minute(s) 26 second(s)),
Total object scanned: 548200
User who launched the scan: Administrator
Infections
———-
FILE INFECTION RESULT
C:\Documents and Settings\jcole\Local Virus found Win32/Heur Moved to Virus Vault
Settings\Temporary Internet Files\
Content.IE5\HI57F6LC\zz[1].exe
C:\g2pfnid.com Virus found Win32/Heur Moved to Virus Vault
C:\jix9a.bat Virus found Win32/Heur Moved to Virus Vault
C:\k6wkwon2.exe Virus found Win32/Heur Moved to Virus Vault
C:\WINDOWS\system32\ckvo.exe Virus found Win32/Heur Moved to Virus Vault
C:\WINDOWS\system32\ckvo0.dll Virus found Win32/Heur Moved to Virus Vault
C:\WINDOWS\system32\kavo.exe Virus found Win32/Heur Moved to Virus Vault
D:\Desktop\install.exe Trojan horse Downloader.Agent.IRX Moved to Virus Vault
D:\g2pfnid.com Virus found Win32/Heur Moved to Virus Vault
D:\jix9a.bat Virus found Win32/Heur Moved to Virus Vault
D:\k6wkwon2.exe Virus found Win32/Heur Moved to Virus Vault
G:\jix9a.bat Virus found Win32/Heur Moved to Virus Vault
-EOF—————————————————–
MALWAREBYTE'S LOG
=========================================================
Malwarebytes' Anti-Malware 1.23
Database version: 985
Windows 5.1.2600 Service Pack 2
3:43:13 PM 29/07/2008
mbam-log-7-29-2008 (15-43-13).txt
Scan type: Full Scan (C:\|D:\|F:\|G:\|)
Objects scanned: 172960
Time elapsed: 1 hour(s), 9 minute(s), 59 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 32
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
(No malicious items detected)
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.
Folders Infected:
(No malicious items detected)
Files Infected:
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP389\A0044779.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP389\A0045804.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP389\A0045837.com (Trojan.Vaklik) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP389\A0045890.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP390\A0045896.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP391\A0045901.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP392\A0045970.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP393\A0045981.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP394\A0045985.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP395\A0046099.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP396\A0046221.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP397\A0046336.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP398\A0046453.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP398\A0046573.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
C:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP399\A0046584.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP389\A0044780.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP389\A0045807.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP389\A0045867.com (Trojan.Vaklik) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP389\A0045878.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP389\A0045892.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP390\A0045898.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP391\A0045903.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP392\A0045972.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP393\A0045983.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP394\A0045987.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP395\A0046101.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP396\A0046223.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP397\A0046338.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP398\A0046455.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP398\A0046575.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP399\A0046586.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
D:\System Volume Information\_restore{46DE8921-1D39-44D2-A9E9-64119261F211}\RP400\A0049565.bat (Spyware.OnlineGames) -> Quarantined and deleted successfully.
-EOF—————————————————–
HIJACKTHIS LOG
=========================================================
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:35:42 PM, on 29/07/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\SMART Technologies Inc\SMART Board Software\SMARTBoardService.exe
C:\Program Files\SMART Technologies Inc\SMART Board Software\WebServer.exe
C:\Program Files\SynchronEyes Student 7.0\synchroneyessrv.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Apoint\Apoint.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Apoint\Apntex.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\SpyCatcher\Protector.exe
C:\Program Files\SpyCatcher\Scheduler daemon.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bearnet.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.javacoolsoftware.com/sb-link/autoupdate.html
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareBlock Class - {0A87E45F-537A-40B4-B812-E2544C21A09F} - C:\Program Files\SpyCatcher\SCActiveBlock.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SMART Notebook Download Plugin - {67BCF957-85FC-4036-8DC4-D4D80E00A77B} - C:\Program Files\SMART Technologies Inc\Notebook Software\NotebookPlugin.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
O2 - BHO: SynchronEye Web Browser Block - {B0A26676-4185-479F-B7B1-B3968B956468} - C:\Program Files\SynchronEyes Student 7.0\SEyesIEBlock.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet
O4 - HKLM\..\Run: [NVHotkey] rundll32.exe nvHotkey.dll,Start
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SMART Mirror Driver Monitor Service] "C:\Program Files\Common Files\SMART Technologies Inc\Mirror Driver\monitorservice.exe"
O4 - HKLM\..\Run: [SynchronEyes 7.0 Help Service] C:\Program Files\SynchronEyes Student 7.0\SynchronEyesClient.exe
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SpyCatcher Reminder] C:\Program Files\SpyCatcher\SpyCatcher.exe reminder
O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Startup: Scheduler.lnk = C:\Program Files\SpyCatcher\Scheduler daemon.exe
O4 - Global Startup: Bluetooth Manager.lnk = ?
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: SMART Board Tools.lnk = C:\Program Files\SMART Technologies Inc\SMART Board Software\SMARTBoardTools.exe
O4 - Global Startup: SpyCatcher Protector.lnk = C:\Program Files\SpyCatcher\Protector.exe
O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/Facebo…toUploader5.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = tcs.on.ca
O17 - HKLM\Software\..\Telephony: DomainName = tcs.on.ca
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = tcs.on.ca
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: secuload.dll,avgrsstx.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: CounterSpyAgent - Sunbelt Software - C:\Program Files\Sunbelt Software\CounterSpy\Agent\SBCSESvc.exe
O23 - Service: DataSvr2 - Unknown owner - C:\Program Files\Wave Systems Corp\Common\DataServer.exe (file missing)
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: SMART Board Service - SMART Technologies Inc. - C:\Program Files\SMART Technologies Inc\SMART Board Software\SMARTBoardService.exe
O23 - Service: SMART Mirror Driver Monitor Service - SMART Technologies - C:\Program Files\Common Files\SMART Technologies Inc\Mirror Driver\monitorservice.exe
O23 - Service: SMART Web Server - Unknown owner - C:\Program Files\SMART Technologies Inc\SMART Board Software\WebServer.exe
O23 - Service: SynchronEyes Software 7.0 Helper Service - SMART Technologies Inc. - C:\Program Files\SynchronEyes Student 7.0\synchroneyessrv.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
–
End of file - 11133 bytes
CURRENT CONDITION
=========================================================
- can now see hidden files & folders
- can now see protected operating system folders
- flash drive not getting infected
So, I was just wondering if someone could look over the HijackThis log file and make sure that it actually is clean, and that this isn't just a temporary state of cleanliness. I will obviously remove some of the installed software, it was just to make sure that everything that could be caught, was. Any help would be much appreciated!
Thanks in advance,
bencole
