[Closed] Well..now i have bifrotst...

Um..tomk helped me remove a bunch of stuff. but now it seems i have bifrost and kaZaa? they show up on a yahoo scan, and um..i still didn't get my AV updated. uff.

summerkat,

Please download DDS and save it to your desktop.

• Disable any script blocking protection
• Double click dds.scr to run the tool.
• When done, DDS.txt will open.
• Click Yes at the next prompt for Optional Scan.
• Save both reports to your desktop.

—————————————————

• Post the contents of the DDS.txt report in your next reply
• Attach the Attach.txt report to your post by scroling down to the Attachments area and then clicking Browse. Browse to where you saved the file, and click Open and the click UPLOAD.

DDS (Version 1.0.1) - NTFSx86 Run by [removed] at 19:10:44.76 on Fri 12/12/2008 Internet Explorer: 6.0.2900.2180 BrowserJavaVersion: 1.6.0_11 Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.440 [GMT -5:00] ============== Running Processes =============== C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost -k DcomLaunch svchost.exe C:\WINDOWS\System32\svchost.exe -k netsvcs C:\WINDOWS\system32\svchost.exe -k WudfServiceGroup C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\Explorer.EXE svchost.exe svchost.exe E:\aawservice.exe C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe C:\Program Files\Common Files\Real\Update_OB\realsched.exe C:\WINDOWS\system32\spoolsv.exe E:\Winamp\winampa.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe C:\Program Files\AntiVir PersonalEdition Classic\avgnt.exe C:\Program Files\Java\jre6\bin\jusched.exe C:\Program Files\BillP Studios\WinPatrol\winpatrol.exe E:\Spybot - Search & Destroy\TeaTimer.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\Program Files\Logitech\SetPoint\KEM.exe C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE E:\WinZip\WZQKPICK.EXE C:\Program Files\AntiVir PersonalEdition Classic\sched.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe C:\Program Files\Java\jre6\bin\jqs.exe C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe C:\WINDOWS\System32\svchost.exe -k imgsvc C:\WINDOWS\System32\svchost.exe -k netsvcs C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\WgaTray.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe E:\SecondLife\SecondLife.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Documents and Settings\Jennifer\Desktop\dds.scr ============== Pseudo HJT Report =============== uURLSearchHooks: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - c:\program files\yahoo!\companion\installs\cpn3\yt.dll BHO: {02478D38-C3F9-4EFB-9B51-7695ECA05670} - c:\program files\yahoo!\companion\installs\cpn3\yt.dll BHO: {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - c:\program files\adobe\acrobat 7.0\activex\AcroIEHelper.dll BHO: {53707962-6F74-2D53-2644-206D7942484F} - e:\spybot~1\SDHelper.dll BHO: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll BHO: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - c:\program files\java\jre6\bin\ssv.dll BHO: {9030D464-4C02-4ABF-8ECC-5164760863C6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll BHO: {DBC80044-A445-435b-BC74-9C25C1C588A9} - c:\program files\java\jre6\bin\jp2ssv.dll BHO: {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - c:\program files\yahoo!\companion\installs\cpn3\yt.dll TB: {EF99BD32-C1FB-11D2-892F-0090271D4F88} - c:\program files\yahoo!\companion\installs\cpn3\yt.dll uRun: [Yahoo! Pager] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet uRun: [SpybotSD TeaTimer] e:\spybot - search & destroy\TeaTimer.exe mRun: [ATIPTA] c:\program files\ati technologies\ati control panel\atiptaxx.exe mRun: [NeroFilterCheck] c:\windows\system32\NeroCheck.exe mRun: [TkBellExe] "c:\program files\common files\real\update_ob\realsched.exe" -osboot mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime mRun: [WinampAgent] e:\winamp\winampa.exe mRun: [SoundMan] SOUNDMAN.EXE mRun: [avgnt] "c:\program files\antivir personaledition classic\avgnt.exe" /min mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe" mRun: [WinPatrol] c:\program files\billp studios\winpatrol\winpatrol.exe -expressboot StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adobeg~1.lnk - c:\program files\common files\adobe\calibration\Adobe Gamma Loader.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\adober~1.lnk - c:\program files\adobe\acrobat 7.0\reader\reader_sl.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\logite~1.lnk - c:\program files\logitech\setpoint\KEM.exe StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\micros~1.lnk - c:\program files\microsoft office\office10\OSA.EXE StartupFolder: c:\docume~1\alluse~1\startm~1\programs\startup\winzip~1.lnk - e:\winzip\WZQKPICK.EXE uPolicies-explorer: NoViewOnDrive = 0 (0x0) IE: &Yahoo! Search - file:///c:\program files\yahoo!\Common/ycsrch.htm IE: E&xport to Microsoft Excel - c:\progra~1\micros~2\office10\EXCEL.EXE/3000 IE: Yahoo! &Dictionary - file:///c:\program files\yahoo!\Common/ycdict.htm IE: Yahoo! &Maps - file:///c:\program files\yahoo!\Common/ycmap.htm IE: Yahoo! &SMS - file:///c:\program files\yahoo!\Common/ycsms.htm IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe IE: {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - c:\program files\yahoo!\common\yiesrvc.dll IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - e:\spybot~1\SDHelper.dll IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe Handler: cdo - {CD00020A-8B95-11D1-82DB-00C04FB1625D} - c:\program files\common files\microsoft shared\web folders\PKMCDO.DLL Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL Notify: AtiExtEvent - Ati2evxx.dll SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll ================= FIREFOX =================== FF - ProfilePath - c:\docume~1\jennifer\applic~1\mozilla\firefox\profiles\s6y15soe.default\ FF - prefs.js: browser.search.defaulturl - hxxp://search.yahoo.com/search?ei=UTF-8&fr=ytff-amo&p= FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/ FF - prefs.js: keyword.URL - hxxp://kwtb.search.imgag.com/?c=GNKIW29193&sbs=1&sc=2&f=web&vernum=1.0&uid=&did=f8d4a70c-98e2-4081-901d-01bf93043ede&q= ============= SERVICES / DRIVERS =============== R1 avgio;avgio;\??\c:\program files\antivir personaledition classic\avgio.sys [2008-12-5 11840] R2 aawservice;Lavasoft Ad-Aware Service;E:\aawservice.exe [2008-9-10 611664] R2 AntiVirScheduler;AntiVir PersonalEdition Classic Scheduler;"c:\program files\antivir personaledition classic\sched.exe" [2008-12-5 57896] R2 AntiVirService;AntiVir PersonalEdition Classic Guard;"c:\program files\antivir personaledition classic\avguard.exe" [2008-12-5 204840] R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;c:\program files\firebird\firebird_1_5\bin\fbguard.exe -s [] R3 avgntflt;avgntflt;\??\c:\program files\antivir personaledition classic\avgntflt.sys [2008-12-5 48704] R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;c:\program files\firebird\firebird_1_5\bin\fbserver.exe -s [] R3 GETNDIS;VIA Networking Velocity Family Giga-bit Ethernet Adapter Driver;c:\windows\system32\drivers\getnd5b.sys [2005-2-24 44544] S2 PostgreSQL;PostgreSQL Database Server;"c:\program files\postgresql\8.0-beta2-dev3\bin\pg_ctl.exe" runservice -n "postgresql" -d "c:\program files\postgresql\8.0-beta2-dev3\data\" [] =============== Created Last 30 ================ 2008-12-09 15:51 –d—– c:\docume~1\jennifer\applic~1\WinPatrol 2008-12-09 15:51 –d—– c:\program files\BillP Studios 2008-12-09 15:45 –d—– c:\program files\SpywareBlaster 2008-12-09 15:43 –d—– C:\ComboFix 2008-12-09 15:43 388,608 a——- c:\windows\system32\CF24313.exe 2008-12-09 03:18 73,728 a——- c:\windows\system32\javacpl.cpl 2008-12-09 02:48 –d—– c:\documents and settings\jennifer\.SunDownloadManager 2008-12-09 02:46 410,984 a——- c:\windows\system32\deploytk.dll 2008-12-09 00:51 –d—– c:\docume~1\jennifer\applic~1\Malwarebytes 2008-12-09 00:51 15,504 a——- c:\windows\system32\drivers\mbam.sys 2008-12-09 00:51 38,496 a——- c:\windows\system32\drivers\mbamswissarmy.sys 2008-12-09 00:51 –d—– c:\program files\Malwarebytes' Anti-Malware 2008-12-09 00:51 –d—– c:\docume~1\alluse~1\applic~1\Malwarebytes 2008-12-08 22:20 a-dshr– C:\cmdcons 2008-12-08 20:45 –d—– c:\docume~1\alluse~1\applic~1\SUPERAntiSpyware.com 2008-12-08 20:02 –d—– c:\program files\trend micro 2008-12-05 15:18 –d—– c:\docume~1\alluse~1\applic~1\AntiVir PersonalEdition Classic 2008-11-16 07:29 –d—– c:\program files\Kiwee Toolbar 2008-11-16 07:27 2,117,632 a——- c:\windows\system32\python25.dll 2008-11-16 07:27 339,968 a——- c:\windows\system32\pythoncom25.dll 2008-11-16 07:27 114,688 a——- c:\windows\system32\pywintypes25.dll 2008-11-16 07:27 1,332,197 a——- c:\windows\system32\pythondll.zip 2008-11-14 05:32 –d—– c:\docume~1\alluse~1\applic~1\Blizzard ==================== Find3M ==================== 2008-12-04 10:36 3,396 a–sh— c:\windows\system32\dllcache\winsvcmgmnt.dll 2006-08-14 22:28 24,096 ac—— c:\docume~1\jennifer\applic~1\GDIPFONTCACHEV1.DAT 2008-01-15 09:13 861 a–sh— c:\windows\system32\dllcache\aamonit.dll 2008-01-15 09:13 847,872 a–shr– c:\windows\system32\dllcache\libeay32.dll 2008-01-15 09:13 159,744 a–shr– c:\windows\system32\dllcache\ssleay32.dll 2008-01-15 09:13 64,000 a–shr– c:\windows\system32\dllcache\syschk32.dll 2008-01-15 09:13 488 a–shr– c:\windows\system32\dllcache\winsvcf.dll 2008-01-15 09:13 895 a–shr– c:\windows\system32\dllcache\winsvcn.dll 2007-07-31 17:42 55,296 ac-shr– c:\windows\system32\spool\drivers\raddrv.dll ============= FINISH: 19:11:37.54 ===============

summerkat,

they show up on a yahoo scan

What is this?

I see no signs of either program.

kaZaa is a P2P file sharing program that I don't believe you have installed.

bifrost is a trojan that I don't believe you have. Sometimes it shows as a file called bfserver.exe. You have a file called fbserver.exe that is the executable for your Firebird program. Not the same thing.

I need some more information please.

i did the tool bar Anti-spy thing. After I reboot my computer, it shows up at Bifrost, and KaZaa. Its happened twice, i used the Yahoo Anti-spy to remove it. Then its gone again. But this has happened twice now, it used to come up darksma (as you know), and that doesn't. I dont know what is going on. I ran the scan again, closed the browser, rebooted and its not showing up now. gah!

summerkat,

i still didn't get my AV updated

Your logs show AntiVir PersonalEdition Classic being installed on December 5, 7 days ago. What happens when you try to update it?

it says that i dont have a valid license aborting

summerkat,

Please download a new copy of a free antivirus.

1) Antivir PersonalEditionClassic
-Free anti-virus software for Windows.
-Detects and removes more than 50,000 viruses. Free support.
2) avast! 4 Home Edition
-Anti-virus program for Windows.
-The home edition is freeware for noncommercial user
3) AVG Anti-Virus Free Edition
- Free edition of the AVG anti-virus program for Windows.
- Available for single computer use for home and non commercial use.

Then uninstall your current version using add/remove programs in your control panel.

Then install whichever new one you downloaded.

Let me know how it goes.

Ok i installed avira, and uninstilled the last version. I also redownloaded the yahoo anti spy thing. Anything else I need?

maybe this yahoo anti spy thing is carp** now its saying that i have IST bar and Mirar … no bifrost or KaZaa…

summerkat, Run Malwarebytes and see what it shows (don't forget to update first)

malwarebytes is running I need to sleep a little bit, will be back in a little while and will post the report i will also check if there's something else you want me to do Sumz

summerkat, After Mbam, scan with your Anti-virus. Let me know if either find anything.

Malwarebytes' Anti-Malware 1.31 Database version: 1495 Windows 5.1.2600 Service Pack 2 12/13/2008 8:05:56 AM mbam-log-2008-12-13 (08-05-56).txt Scan type: Quick Scan Objects scanned: 55464 Time elapsed: 18 minute(s), 9 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 0 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: (No malicious items detected)

summerkat, Have you done an Anti-virus scan yet?