[Resolved] Hijack log, looking for analysis

Well looks clean

Click HERE to run Panda's ActiveScan

* You need to use IE to run this scan
* Once you are on the Panda site click the Scan your PC button
* A new window will open…click the Check Now button
* Enter your Country
* Enter your State/Province
* Enter your e-mail address and click send
* Select either Home User or Company
* Click the big Scan Now button
* If it wants to install an ActiveX component allow it
* It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
* When download is complete, click on My Computer to start the scan
* When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Post the contents of the ActiveScan report

That took about 3 hours to scan but here is the log….. ;******************************************************************************* ********************************************************************************* ******************* ANALYSIS: 2008-11-09 20:36:34 PROTECTIONS: 1 MALWARE: 41 SUSPECTS: 5 ;******************************************************************************* ********************************************************************************* ******************* PROTECTIONS Description Version Active Updated ;=============================================================================== ================================================================================= =================== AVG 7.5.549 7.5.549 Yes Yes ;=============================================================================== ================================================================================= =================== MALWARE Id Description Type Active Severity Disinfectable Disinfected Location ;=============================================================================== ================================================================================= =================== 00035722 adware/comet Adware No 0 Yes No HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{1678F7E1-C422-11D0-AD7D-00400515CAAA} 00039703 Application/Pskill.A HackTools No 0 Yes No C:\WINDOWS\system\RESTORE.INS[C:/OEMCUST/TOOLS/WIN32/PSKILL.EXE] 00039703 Application/Pskill.A HackTools No 0 Yes No C:\WINDOWS\RESTORE.INS[C:/OEMCUST/TOOLS/WIN32/PSKILL.EXE] 00046774 Joke/Chospe Jokes No 0 Yes No D:\Documents and Settings\Administrator.RENT-M407LWRWHD\My Documents\house Info\Free Cup Holder.exe 00046774 Joke/Chospe Jokes No 0 Yes No C:\Documents and Settings\TOM\My Documents\house Info\Free Cup Holder.exe 00046774 Joke/Chospe Jokes No 0 Yes No D:\Documents and Settings\Stan\My Documents\house Info\Free Cup Holder.exe 00046774 Joke/Chospe Jokes No 0 Yes No D:\System Volume Information\_restore{9AB2AC02-A367-4E03-9604-92C631BB214E}\RP29\A0003772.exe 00046774 Joke/Chospe Jokes No 0 Yes No D:\System Volume Information\_restore{9AB2AC02-A367-4E03-9604-92C631BB214E}\RP29\A0003775.exe 00103551 adware/windowenhancer Adware No 0 Yes No c:\windows\system32\sbutils 00110259 dialer.py Dialers No 0 Yes No HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{8522F9B3-38C5-4AA4-AE40-7401F1BBC851} 00132710 dialer.xd Dialers No 0 Yes No HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{FF3F0F03-0F01-131A-A3F9-08F02B23E0CC} 00139060 Cookie/Casalemedia TrackingCookie No 0 Yes No D:\Documents and Settings\Administrator.RENT-M407LWRWHD\Cookies\administrator@casalemedia[2].txt 00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No D:\Documents and Settings\Administrator.RENT-M407LWRWHD\Cookies\administrator@doubleclick[1].txt 00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No D:\Documents and Settings\Stan\Cookies\stan@doubleclick[1].txt 00139061 Cookie/Doubleclick TrackingCookie No 0 Yes No D:\Documents and Settings\Guest\Cookies\guest@doubleclick[2].txt 00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No D:\Documents and Settings\Guest\Cookies\guest@atdmt[2].txt 00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No D:\Documents and Settings\Stan\Cookies\stan@atdmt[2].txt 00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No D:\Documents and Settings\Administrator.RENT-M407LWRWHD\Cookies\administrator@atdmt[2].txt 00145393 Cookie/Tradedoubler TrackingCookie No 0 Yes No D:\Documents and Settings\Guest\Cookies\guest@tradedoubler[1].txt 00145393 Cookie/Tradedoubler TrackingCookie No 0 Yes No D:\Documents and Settings\Administrator.RENT-M407LWRWHD\Cookies\administrator@tradedoubler[1].txt 00145457 Cookie/FastClick TrackingCookie No 0 Yes No D:\Documents and Settings\Administrator.RENT-M407LWRWHD\Cookies\administrator@fastclick[1].txt 00145457 Cookie/FastClick TrackingCookie No 0 Yes No D:\Documents and Settings\Guest\Cookies\guest@fastclick[1].txt 00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No D:\Documents and Settings\Guest\Cookies\guest@tribalfusion[1].txt 00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No D:\Documents and Settings\Administrator.RENT-M407LWRWHD\Cookies\administrator@tribalfusion[2].txt 00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No D:\Documents and Settings\Guest\Cookies\guest@mediaplex[2].txt 00145738 Cookie/Mediaplex TrackingCookie No 0 Yes No D:\Documents and Settings\Administrator.RENT-M407LWRWHD\Cookies\administrator@mediaplex[1].txt 00145881 Cookie/NewMedia TrackingCookie No 0 Yes No C:\Documents and Settings\TOM\Cookies\[removed][2].txt 00147824 Cookie/Clickbank TrackingCookie No 0 Yes No D:\Documents and Settings\Administrator.RENT-M407LWRWHD\Cookies\administrator@clickbank[2].txt 00167642 Cookie/Com.com TrackingCookie No 0 Yes No D:\Documents and Settings\Administrator.RENT-M407LWRWHD\Cookies\administrator@com[1].txt 00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\TOM\Cookies\tom@com[2].txt 00167704 Cookie/Xiti TrackingCookie No 0 Yes No D:\Documents and Settings\Administrator.RENT-M407LWRWHD\Cookies\administrator@xiti[1].txt 00167753 Cookie/Statcounter TrackingCookie No 0 Yes No D:\Documents and Settings\Guest\Cookies\guest@statcounter[1].txt 00168056 Cookie/YieldManager TrackingCookie No 0 Yes No D:\Documents and Settings\Guest\Cookies\[removed][2].txt 00168061 Cookie/Apmebf TrackingCookie No 0 Yes No D:\Documents and Settings\Administrator.RENT-M407LWRWHD\Cookies\administrator@apmebf[1].txt 00168061 Cookie/Apmebf TrackingCookie No 0 Yes No D:\Documents and Settings\Guest\Cookies\guest@apmebf[1].txt 00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No D:\Documents and Settings\Administrator.RENT-M407LWRWHD\Cookies\administrator@serving-sys[1].txt 00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No D:\Documents and Settings\Guest\Cookies\guest@serving-sys[1].txt 00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No D:\Documents and Settings\Guest\Cookies\[removed]-sys[1].txt 00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No D:\Documents and Settings\Administrator.RENT-M407LWRWHD\Cookies\[removed]-sys[2].txt 00168109 Cookie/Adtech TrackingCookie No 0 Yes No D:\Documents and Settings\Administrator.RENT-M407LWRWHD\Cookies\administrator@adtech[1].txt 00168109 Cookie/Adtech TrackingCookie No 0 Yes No D:\Documents and Settings\Guest\Cookies\guest@adtech[1].txt 00169190 Cookie/Advertising TrackingCookie No 0 Yes No D:\Documents and Settings\Guest\Cookies\guest@advertising[1].txt 00169190 Cookie/Advertising TrackingCookie No 0 Yes No D:\Documents and Settings\Administrator.RENT-M407LWRWHD\Cookies\administrator@advertising[1].txt 00169190 Cookie/Advertising TrackingCookie No 0 Yes No D:\Documents and Settings\Stan\Cookies\stan@advertising[1].txt 00169287 Cookie/Adrevolver TrackingCookie No 0 Yes No D:\Documents and Settings\Guest\Cookies\guest@adrevolver[1].txt 00169287 Cookie/Adrevolver TrackingCookie No 0 Yes No D:\Documents and Settings\Administrator.RENT-M407LWRWHD\Cookies\administrator@adrevolver[1].txt 00170554 Cookie/Overture TrackingCookie No 0 Yes No D:\Documents and Settings\Guest\Cookies\guest@overture[1].txt 00170556 Cookie/RealMedia TrackingCookie No 0 Yes No D:\Documents and Settings\Administrator.RENT-M407LWRWHD\Cookies\administrator@realmedia[1].txt 00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No D:\Documents and Settings\Administrator.RENT-M407LWRWHD\Cookies\administrator@questionmarket[1].txt 00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No D:\Documents and Settings\Guest\Cookies\guest@questionmarket[2].txt 00172221 Cookie/Zedo TrackingCookie No 0 Yes No D:\Documents and Settings\Administrator.RENT-M407LWRWHD\Cookies\administrator@zedo[1].txt 00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No D:\Documents and Settings\Guest\Cookies\guest@adrevolver[2].txt 00184846 Cookie/Adrevolver TrackingCookie No 0 Yes No D:\Documents and Settings\Administrator.RENT-M407LWRWHD\Cookies\administrator@adrevolver[2].txt 00187950 Cookie/bravenetA TrackingCookie No 0 Yes No D:\Documents and Settings\Administrator.RENT-M407LWRWHD\Cookies\administrator@bravenet[1].txt 00187950 Cookie/bravenetA TrackingCookie No 0 Yes No D:\Documents and Settings\Guest\Cookies\guest@bravenet[1].txt 00207936 Cookie/Adviva TrackingCookie No 0 Yes No D:\Documents and Settings\Administrator.RENT-M407LWRWHD\Cookies\administrator@adviva[2].txt 00207936 Cookie/Adviva TrackingCookie No 0 Yes No D:\Documents and Settings\Guest\Cookies\guest@adviva[2].txt 00293517 Cookie/AdDynamix TrackingCookie No 0 Yes No D:\Documents and Settings\Administrator.RENT-M407LWRWHD\Cookies\[removed][1].txt 00339246 Adware/VirusBurst Adware No 0 Yes No C:\RECYCLER\S-1-5-21-1659004503-1454471165-839522115-500\Dc250.tmp 00506672 Trj/Spammer.ZX Virus/Trojan No 0 Yes No D:\System Volume Information\_restore{61F7EA25-4D2F-45A9-A7E7-6B2873809074}\RP2\A0003015.exe 01606636 Cookie/Adserver TrackingCookie No 0 Yes No D:\Documents and Settings\Administrator.RENT-M407LWRWHD\Cookies\[removed][1].txt 02161252 Generic Trojan Virus/Trojan No 0 Yes No D:\System Volume Information\_restore{61F7EA25-4D2F-45A9-A7E7-6B2873809074}\RP1\A0000002.exe 02555303 Trj/Cimuz.CI Virus/Trojan No 0 Yes No D:\System Volume Information\_restore{61F7EA25-4D2F-45A9-A7E7-6B2873809074}\RP2\A0003001.dll 02555303 Trj/Cimuz.CI Virus/Trojan No 0 Yes No D:\System Volume Information\_restore{61F7EA25-4D2F-45A9-A7E7-6B2873809074}\RP2\A0002001.dll 02555303 Trj/Cimuz.CI Virus/Trojan No 0 Yes No D:\System Volume Information\_restore{61F7EA25-4D2F-45A9-A7E7-6B2873809074}\RP2\A0001001.dll 02916589 Application/PassRock HackTools No 0 Yes No D:\Documents and Settings\Administrator.RENT-M407LWRWHD\Desktop\kf151.zip[keyfinder.exe] 02916589 Application/PassRock HackTools No 0 Yes No D:\Documents and Settings\Administrator.RENT-M407LWRWHD\Desktop\kf151\keyfinder.exe 02919763 Trj/Downloader.MDW Virus/Trojan No 0 Yes No C:\APPS\HOMEPAGE\HOMEPGUI.EXE 03074964 Trj/CI.A Virus/Trojan No 0 No No D:\Documents and Settings\Administrator.RENT-M407LWRWHD\Desktop\kf151\keyfinder.exe[D:\Documents and Settings\Administrator.RENT-M407LWRWHD\Desktop\kf151\keyfinder.exe][officekey.exe] 03074964 Trj/CI.A Virus/Trojan No 0 No No D:\Documents and Settings\Administrator.RENT-M407LWRWHD\Desktop\kf151.zip[keyfinder.exe][keyfinder.exe][officekey.exe] ;=============================================================================== ================================================================================= =================== SUSPECTS Sent Location ;=============================================================================== ================================================================================= =================== No C:\WINDOWS\system32\suppdll.dll No C:\WINDOWS\System88\Folder Lock 5.2.6 With [Serial]\Folder Lock 5.2.6 With [Serial]\Folder Lock 5.2.6.exe No D:\Program Files\Folder Lock\Locked\³▒À░ʳ\Folder Lock 5.2.6 With [Serial]\Folder Lock 5.2.6 With [Serial]\Folder Lock 5.2.6.exe No D:\System Volume Information\_restore{61F7EA25-4D2F-45A9-A7E7-6B2873809074}\RP2\A0002002.dll No D:\WINDOWS\system32\suppdll.dll ;=============================================================================== ================================================================================= =================== VULNERABILITIES Id Severity Description ;=============================================================================== ================================================================================= =================== 182048 HIGH MS07-069 176382 HIGH MS07-057 170906 HIGH MS07-045 170904 HIGH MS07-043 164913 HIGH MS07-033 160623 HIGH MS07-027 150253 HIGH MS07-016 141030 HIGH MS06-072 ;=============================================================================== ================================================================================= ===================

Run - ATF Cleaner instructions here.

—————-


Then download Malwarebytes' Anti-Malware to your desktop.

* Double-click mbam-setup.exe and follow the prompts to install the program.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform FULL SCAN, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad. Please save it to a convenient location and post it here. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt

Malwarebytes' Anti-Malware 1.30 Database version: 1378 Windows 5.1.2600 Service Pack 2 10/11/2008 09:19:40 mbam-log-2008-11-10 (09-19-40).txt Scan type: Full Scan (C:\|D:\|) Objects scanned: 235009 Time elapsed: 3 hour(s), 15 minute(s), 36 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 2 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 4 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{1678f7e1-c422-11d0-ad7d-00400515caaa} (Spyware.Comet.Cursor) -> Quarantined and deleted successfully. HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{8fcdf9d9-a28b-480f-8c3d-581f119a8ab8} (Adware.180Solutions) -> Quarantined and deleted successfully. Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: D:\WINDOWS\system32\fdeployt.dll (Trojan.Zapchast) -> Quarantined and deleted successfully. D:\WINDOWS\system32\FwsVpno.dll (Trojan.Zapchast) -> Quarantined and deleted successfully. D:\WINDOWS\system32\confmspb.dll (Trojan.Zapchast) -> Quarantined and deleted successfully. D:\WINDOWS\system32\dgsetupd.dll (Trojan.Zapchast) -> Quarantined and deleted successfully.

Download ComboFix from Here or Here to your Desktop.

In the event you already have Combofix, this is a new version that I need you to download.
It must be saved directly to your desktop.


1. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

• Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan.
• Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
• Remember to re enable the protection again afterwards before connecting to the net

2. Close any open browsers and make sure you are disconnected from the net. Unplug the cable if need be before running combofix.

• IF you have not already done so Combofix will disconnect your machine from the Internet when it starts.
• If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

3. Now double click on combofix.exe & follow the prompts.
When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review


Note: Do not mouseclick combofix's window while it's running. That may cause it to stall or freeze.

everything looks fine. How is the PC running?

The PC is running good with no issues. Thanks for your time and help. Scudo

Since this issue appears to be resolved … this Topic has been closed. Glad we could be of assistance. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.