seth5051 Posted February 11, 2009 ID:55565 Share Posted February 11, 2009 Anyone know about 'Antispyware Protector'?? Seems like a variant of Antispyware 2009, but doesnt clean up with the latest MBAM.running processes are 'antispymon.exe' and antispyprot.exe'Google search and searching this forum doesnt result in much, unless im missing something.If anyone can help, please post links or how to remove this.below are MBAM and HiJackThis logstks in advance Link to post Share on other sites More sharing options...
seth5051 Posted February 11, 2009 Author ID:55566 Share Posted February 11, 2009 Logfile of Trend Micro HijackThis v2.0.2Scan saved at 08:32:19, on 2/11/2009Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\PROGRA~1\AVG\AVG8\avgwdsvc.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\hkcmd.exeC:\WINDOWS\system32\igfxpers.exeC:\Program Files\Analog Devices\Core\smax4pnp.exeC:\Program Files\CyberLink\PowerDVD\DVDLauncher.exeC:\Program Files\HP\hpcoretech\hpcmpmgr.exeC:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exeC:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\AntiSpyware Protector\AntiSpyMon.exeC:\PROGRA~1\AVG\AVG8\avgtray.exeC:\Program Files\Messenger\msmsgs.exeC:\PROGRA~1\AVG\AVG8\avgrsx.exeC:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exeC:\Program Files\Intuit\QuickBooks Pro\Components\QBAgent\qbdagent2002.exeC:\PROGRA~1\AVG\AVG8\avgemc.exeC:\Program Files\AntiSpyware Protector\AntiSpyProt.exeC:\Program Files\HP\hpcoretech\comp\hptskmgr.exeC:\Program Files\iPod\bin\iPodService.exeC:\WINDOWS\system32\wuauclt.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exeC:\WINDOWS\system32\rundll32.exeO1 - Hosts: www.vav2008.com 217.20.175.74O1 - Hosts: vav2008.com 217.20.175.74O1 - Hosts: scanner.vavscan.com 217.20.175.74O1 - Hosts: www.scanner.vavscan.com 217.20.175.74O1 - Hosts: www.vavscan.com 217.20.175.74O1 - Hosts: scan.vavscan.com 217.20.175.74O1 - Hosts: www.scan.vavscan.com 217.20.175.74O1 - Hosts: 217.20.175.74 www.vav2008.comO1 - Hosts: 217.20.175.74 vav2008.comO1 - Hosts: 217.20.175.74 scanner.vavscan.comO1 - Hosts: 217.20.175.74 www.scanner.vavscan.comO1 - Hosts: 217.20.175.74 www.vavscan.comO1 - Hosts: 217.20.175.74 scan.vavscan.comO1 - Hosts: 217.20.175.74 www.scan.vavscan.comO1 - Hosts: www.vav2008.com 217.20.175.74O1 - Hosts: vav2008.com 217.20.175.74O1 - Hosts: scanner.vavscan.com 217.20.175.74O1 - Hosts: www.scanner.vavscan.com 217.20.175.74O1 - Hosts: www.vavscan.com 217.20.175.74O1 - Hosts: scan.vavscan.com 217.20.175.74O1 - Hosts: www.scan.vavscan.com 217.20.175.74O1 - Hosts: 217.20.175.74 www.vav2008.comO1 - Hosts: 217.20.175.74 vav2008.comO1 - Hosts: 217.20.175.74 scanner.vavscan.comO1 - Hosts: 217.20.175.74 www.scanner.vavscan.comO1 - Hosts: 217.20.175.74 www.vavscan.comO1 - Hosts: 217.20.175.74 scan.vavscan.comO1 - Hosts: 217.20.175.74 www.scan.vavscan.comO1 - Hosts: www.vav2008.com 217.20.175.74O1 - Hosts: vav2008.com 217.20.175.74O1 - Hosts: scanner.vavscan.com 217.20.175.74O1 - Hosts: www.scanner.vavscan.com 217.20.175.74O1 - Hosts: www.vavscan.com 217.20.175.74O1 - Hosts: scan.vavscan.com 217.20.175.74O1 - Hosts: www.scan.vavscan.com 217.20.175.74O1 - Hosts: 217.20.175.74 www.vav2008.comO1 - Hosts: 217.20.175.74 vav2008.comO1 - Hosts: 217.20.175.74 scanner.vavscan.comO1 - Hosts: 217.20.175.74 www.scanner.vavscan.comO1 - Hosts: 217.20.175.74 www.vavscan.comO1 - Hosts: 217.20.175.74 scan.vavscan.comO1 - Hosts: 217.20.175.74 www.scan.vavscan.comO1 - Hosts: www.vav2008.com 217.20.175.74O1 - Hosts: vav2008.com 217.20.175.74O1 - Hosts: scanner.vavscan.com 217.20.175.74O1 - Hosts: www.scanner.vavscan.com 217.20.175.74O1 - Hosts: www.vavscan.com 217.20.175.74O1 - Hosts: scan.vavscan.com 217.20.175.74O1 - Hosts: www.scan.vavscan.com 217.20.175.74O1 - Hosts: 217.20.175.74 www.vav2008.comO1 - Hosts: 217.20.175.74 vav2008.comO1 - Hosts: 217.20.175.74 scanner.vavscan.comO1 - Hosts: 217.20.175.74 www.scanner.vavscan.comO1 - Hosts: 217.20.175.74 www.vavscan.comO1 - Hosts: 217.20.175.74 scan.vavscan.comO1 - Hosts: 217.20.175.74 www.scan.vavscan.comO1 - Hosts: www.vav2008.com 217.20.175.74O1 - Hosts: vav2008.com 217.20.175.74O1 - Hosts: scanner.vavscan.com 217.20.175.74O1 - Hosts: www.scanner.vavscan.com 217.20.175.74O1 - Hosts: www.vavscan.com 217.20.175.74O1 - Hosts: scan.vavscan.com 217.20.175.74O1 - Hosts: www.scan.vavscan.com 217.20.175.74O1 - Hosts: 217.20.175.74 www.vav2008.comO1 - Hosts: 217.20.175.74 vav2008.comO1 - Hosts: 217.20.175.74 scanner.vavscan.comO1 - Hosts: 217.20.175.74 www.scanner.vavscan.comO1 - Hosts: 217.20.175.74 www.vavscan.comO1 - Hosts: 217.20.175.74 scan.vavscan.comO1 - Hosts: 217.20.175.74 www.scan.vavscan.comO1 - Hosts: www.vav2008.com 217.20.175.74O1 - Hosts: vav2008.com 217.20.175.74O1 - Hosts: scanner.vavscan.com 217.20.175.74O1 - Hosts: www.scanner.vavscan.com 217.20.175.74O1 - Hosts: www.vavscan.com 217.20.175.74O1 - Hosts: scan.vavscan.com 217.20.175.74O1 - Hosts: www.scan.vavscan.com 217.20.175.74O1 - Hosts: 217.20.175.74 www.vav2008.comO1 - Hosts: 217.20.175.74 vav2008.comO1 - Hosts: 217.20.175.74 scanner.vavscan.comO1 - Hosts: 217.20.175.74 www.scanner.vavscan.comO1 - Hosts: 217.20.175.74 www.vavscan.comO1 - Hosts: 217.20.175.74 scan.vavscan.comO1 - Hosts: 217.20.175.74 www.scan.vavscan.comO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exeO4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exeO4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exeO4 - HKLM\..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exeO4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hideO4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exeO4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startupO4 - HKLM\..\Run: [iSUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -schedulerO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"O4 - HKLM\..\Run: [ASPMonitor] C:\Program Files\AntiSpyware Protector\AntiSpyMon.exeO4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')O4 - Startup: AntiSpy Protector.lnk = C:\Program Files\AntiSpyware Protector\AntiSpyProt.exeO4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exeO4 - Global Startup: Event Reminder.lnk = ?O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO4 - Global Startup: QuickBooks 2002 Delivery Agent.lnk = C:\Program Files\Intuit\QuickBooks Pro\Components\QBAgent\qbdagent2002.exeO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file://C:\Program Files\Bejeweled 2\Images\stg_drm.ocxO16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cabO16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cabO16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} - http://mediaplayer.walmart.com/installer/install.cabO16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - https://www.comfortsite.com/EBiz/Applicatio...SApps/msrdp.cabO16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cabO16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file://C:\Program Files\Bejeweled 2\Images\armhelper.ocxO16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/p...obat/nos/gp.cabO18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dllO20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL,avgrsstx.dllO23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeO23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exeO23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exeO23 - Service: getPlus® Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exeO23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe--End of file - 10367 bytes Link to post Share on other sites More sharing options...
seth5051 Posted February 11, 2009 Author ID:55567 Share Posted February 11, 2009 quick scan with MBAMMalwarebytes' Anti-Malware 1.33Database version: 1732Windows 5.1.2600 Service Pack 32/6/2009 1:29:11 PMmbam-log-2009-02-06 (13-29-11).txtScan type: Quick ScanObjects scanned: 68906Time elapsed: 19 minute(s), 19 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected) Link to post Share on other sites More sharing options...
seth5051 Posted February 11, 2009 Author ID:55568 Share Posted February 11, 2009 full scan with MBAMMalwarebytes' Anti-Malware 1.33Database version: 1732Windows 5.1.2600 Service Pack 22/6/2009 6:11:06 AMmbam-log-2009-02-06 (06-11-06).txtScan type: Full Scan (C:\|)Objects scanned: 124016Time elapsed: 39 minute(s), 19 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected) Link to post Share on other sites More sharing options...
seth5051 Posted February 12, 2009 Author ID:55734 Share Posted February 12, 2009 Anyone have any idea?? Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted February 12, 2009 Root Admin ID:55819 Share Posted February 12, 2009 Please visit this webpage for instructions for downloading ComboFix to your DESKTOP : how-to-use-combofixPlease ensure you read this guide carefully and install the Recovery Console first.NOTE!!: You must save and run ComboFix.exe on your DESKTOP and not from any other folder.Also, DO NOT click the mouse or launch any other applications while this is running or it may stall the programAdditional links to download the tool:ComboFix.exeComboFix.exeComboFix.exeNote: The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.Once installed, you should see a blue screen prompt that says:The Recovery Console was successfully installed.Please continue as follows:Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.Click Yes to allow ComboFix to continue scanning for malware.When the tool is finished, it will produce a report for you.Please post the C:\ComboFix.txt along with a new HijackThis log so we may continue cleaning the system. Link to post Share on other sites More sharing options...
seth5051 Posted February 12, 2009 Author ID:56001 Share Posted February 12, 2009 Before running combofix I decided to check for MalwareBytes updates. There were updates available. So ran another scan and it appears to have cleaned up this spyware.Latest MalwareBytes LogMalwarebytes' Anti-Malware 1.34Database version: 1755Windows 5.1.2600 Service Pack 32/12/2009 3:33:51 PMmbam-log-2009-02-12 (15-33-51).txtScan type: Quick ScanObjects scanned: 80773Time elapsed: 17 minute(s), 2 second(s)Memory Processes Infected: 1Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 1Registry Data Items Infected: 0Folders Infected: 5Files Infected: 29Memory Processes Infected:C:\Program Files\AntiSpyware Protector\AntiSpyMon.exe (Rogue.AntiSpywareProtector) -> Unloaded process successfully.Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\aspmonitor (Rogue.AntiSpyProtector) -> Quarantined and deleted successfully.Registry Data Items Infected:(No malicious items detected)Folders Infected:C:\Program Files\AntiSpyware Protector (Rogue.AntiSpyProtector) -> Quarantined and deleted successfully.C:\Program Files\AntiSpyware Protector\PDB (Rogue.AntiSpyProtector) -> Quarantined and deleted successfully.C:\Program Files\AntiSpyware Protector\Quarantine (Rogue.AntiSpyProtector) -> Quarantined and deleted successfully.C:\Program Files\AntiSpyware Protector\WAV (Rogue.AntiSpyProtector) -> Quarantined and deleted successfully.C:\Documents and Settings\Owner\Start Menu\Programs\AntiSpyware Protector (Rogue.AntiSpywareProtector) -> Quarantined and deleted successfully.Files Infected:C:\Program Files\AntiSpyware Protector\AntiSpyMon.exe (Rogue.AntiSpyProtector) -> Quarantined and deleted successfully.C:\Program Files\AntiSpyware Protector\AntiSpyProt.chm (Rogue.AntiSpyProtector) -> Quarantined and deleted successfully.C:\Program Files\AntiSpyware Protector\AntiSpyProt.exe (Rogue.AntiSpyProtector) -> Quarantined and deleted successfully.C:\Program Files\AntiSpyware Protector\AntiSpyProt.ini (Rogue.AntiSpyProtector) -> Quarantined and deleted successfully.C:\Program Files\AntiSpyware Protector\AntiSpyProt.lind (Rogue.AntiSpyProtector) -> Quarantined and deleted successfully.C:\Program Files\AntiSpyware Protector\AntiSpyProt.log (Rogue.AntiSpyProtector) -> Quarantined and deleted successfully.C:\Program Files\AntiSpyware Protector\AntiSpyProt_vp.sdb (Rogue.AntiSpyProtector) -> Quarantined and deleted successfully.C:\Program Files\AntiSpyware Protector\AntiSpyware Protector Home Page.url (Rogue.AntiSpyProtector) -> Quarantined and deleted successfully.C:\Program Files\AntiSpyware Protector\ASPIE.dll (Rogue.AntiSpyProtector) -> Quarantined and deleted successfully.C:\Program Files\AntiSpyware Protector\aspy_cfg.ini (Rogue.AntiSpyProtector) -> Quarantined and deleted successfully.C:\Program Files\AntiSpyware Protector\ASWhiteList.cfg (Rogue.AntiSpyProtector) -> Quarantined and deleted successfully.C:\Program Files\AntiSpyware Protector\background.jpeg (Rogue.AntiSpyProtector) -> Quarantined and deleted successfully.C:\Program Files\AntiSpyware Protector\ckrdr.exe (Rogue.AntiSpyProtector) -> Quarantined and deleted successfully.C:\Program Files\AntiSpyware Protector\install_stat1.tmp (Rogue.AntiSpyProtector) -> Quarantined and deleted successfully.C:\Program Files\AntiSpyware Protector\quarantine.dat (Rogue.AntiSpyProtector) -> Quarantined and deleted successfully.C:\Program Files\AntiSpyware Protector\ReadMe.txt (Rogue.AntiSpyProtector) -> Quarantined and deleted successfully.C:\Program Files\AntiSpyware Protector\report.xml (Rogue.AntiSpyProtector) -> Quarantined and deleted successfully.C:\Program Files\AntiSpyware Protector\Uninstall.exe (Rogue.AntiSpyProtector) -> Quarantined and deleted successfully.C:\Program Files\AntiSpyware Protector\PDB\4Dec2008.pdb (Rogue.AntiSpyProtector) -> Quarantined and deleted successfully.C:\Program Files\AntiSpyware Protector\PDB\StartupList.pdb (Rogue.AntiSpyProtector) -> Quarantined and deleted successfully.C:\Program Files\AntiSpyware Protector\WAV\Alert.wav (Rogue.AntiSpyProtector) -> Quarantined and deleted successfully.C:\Program Files\AntiSpyware Protector\WAV\Deleted.wav (Rogue.AntiSpyProtector) -> Quarantined and deleted successfully.C:\Program Files\AntiSpyware Protector\WAV\Warning.wav (Rogue.AntiSpyProtector) -> Quarantined and deleted successfully.C:\Documents and Settings\Owner\Start Menu\Programs\AntiSpyware Protector\AntiSpy Monitor.lnk (Rogue.AntiSpywareProtector) -> Quarantined and deleted successfully.C:\Documents and Settings\Owner\Start Menu\Programs\AntiSpyware Protector\AntiSpy Protector Home.lnk (Rogue.AntiSpywareProtector) -> Quarantined and deleted successfully.C:\Documents and Settings\Owner\Start Menu\Programs\AntiSpyware Protector\AntiSpy Protector.lnk (Rogue.AntiSpywareProtector) -> Quarantined and deleted successfully.C:\Documents and Settings\Owner\Start Menu\Programs\AntiSpyware Protector\Documentation.lnk (Rogue.AntiSpywareProtector) -> Quarantined and deleted successfully.C:\Documents and Settings\Owner\Start Menu\Programs\AntiSpyware Protector\ReadMe.lnk (Rogue.AntiSpywareProtector) -> Quarantined and deleted successfully.C:\Documents and Settings\Owner\Start Menu\Programs\Startup\AntiSpy Protector.lnk (Rogue.AntiSpywareProtector) -> Quarantined and deleted successfully. Link to post Share on other sites More sharing options...
seth5051 Posted February 12, 2009 Author ID:56002 Share Posted February 12, 2009 and latest hijackthis logLogfile of Trend Micro HijackThis v2.0.2Scan saved at 16:07:49, on 2/12/2009Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeC:\PROGRA~1\AVG\AVG8\avgwdsvc.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\svchost.exeC:\PROGRA~1\AVG\AVG8\avgrsx.exeC:\PROGRA~1\AVG\AVG8\avgemc.exeC:\PROGRA~1\AVG\AVG8\avgnsx.exeC:\Program Files\AVG\AVG8\avgcsrvx.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\hkcmd.exeC:\WINDOWS\system32\igfxpers.exeC:\Program Files\Analog Devices\Core\smax4pnp.exeC:\Program Files\CyberLink\PowerDVD\DVDLauncher.exeC:\Program Files\HP\hpcoretech\hpcmpmgr.exeC:\Program Files\AVG\AVG8\avgcsrvx.exeC:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exeC:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exeC:\Program Files\iTunes\iTunesHelper.exeC:\PROGRA~1\AVG\AVG8\avgtray.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exeC:\Program Files\Intuit\QuickBooks Pro\Components\QBAgent\qbdagent2002.exeC:\Program Files\iPod\bin\iPodService.exeC:\WINDOWS\system32\wuauclt.exeC:\Program Files\Trend Micro\HijackThis\HijackThis.exeC:\Program Files\AVG\AVG8\avgupd.exeO1 - Hosts: www.vav2008.com 217.20.175.74O1 - Hosts: vav2008.com 217.20.175.74O1 - Hosts: scanner.vavscan.com 217.20.175.74O1 - Hosts: www.scanner.vavscan.com 217.20.175.74O1 - Hosts: www.vavscan.com 217.20.175.74O1 - Hosts: scan.vavscan.com 217.20.175.74O1 - Hosts: www.scan.vavscan.com 217.20.175.74O1 - Hosts: 217.20.175.74 www.vav2008.comO1 - Hosts: 217.20.175.74 vav2008.comO1 - Hosts: 217.20.175.74 scanner.vavscan.comO1 - Hosts: 217.20.175.74 www.scanner.vavscan.comO1 - Hosts: 217.20.175.74 www.vavscan.comO1 - Hosts: 217.20.175.74 scan.vavscan.comO1 - Hosts: 217.20.175.74 www.scan.vavscan.comO1 - Hosts: www.vav2008.com 217.20.175.74O1 - Hosts: vav2008.com 217.20.175.74O1 - Hosts: scanner.vavscan.com 217.20.175.74O1 - Hosts: www.scanner.vavscan.com 217.20.175.74O1 - Hosts: www.vavscan.com 217.20.175.74O1 - Hosts: scan.vavscan.com 217.20.175.74O1 - Hosts: www.scan.vavscan.com 217.20.175.74O1 - Hosts: 217.20.175.74 www.vav2008.comO1 - Hosts: 217.20.175.74 vav2008.comO1 - Hosts: 217.20.175.74 scanner.vavscan.comO1 - Hosts: 217.20.175.74 www.scanner.vavscan.comO1 - Hosts: 217.20.175.74 www.vavscan.comO1 - Hosts: 217.20.175.74 scan.vavscan.comO1 - Hosts: 217.20.175.74 www.scan.vavscan.comO1 - Hosts: www.vav2008.com 217.20.175.74O1 - Hosts: vav2008.com 217.20.175.74O1 - Hosts: scanner.vavscan.com 217.20.175.74O1 - Hosts: www.scanner.vavscan.com 217.20.175.74O1 - Hosts: www.vavscan.com 217.20.175.74O1 - Hosts: scan.vavscan.com 217.20.175.74O1 - Hosts: www.scan.vavscan.com 217.20.175.74O1 - Hosts: 217.20.175.74 www.vav2008.comO1 - Hosts: 217.20.175.74 vav2008.comO1 - Hosts: 217.20.175.74 scanner.vavscan.comO1 - Hosts: 217.20.175.74 www.scanner.vavscan.comO1 - Hosts: 217.20.175.74 www.vavscan.comO1 - Hosts: 217.20.175.74 scan.vavscan.comO1 - Hosts: 217.20.175.74 www.scan.vavscan.comO1 - Hosts: www.vav2008.com 217.20.175.74O1 - Hosts: vav2008.com 217.20.175.74O1 - Hosts: scanner.vavscan.com 217.20.175.74O1 - Hosts: www.scanner.vavscan.com 217.20.175.74O1 - Hosts: www.vavscan.com 217.20.175.74O1 - Hosts: scan.vavscan.com 217.20.175.74O1 - Hosts: www.scan.vavscan.com 217.20.175.74O1 - Hosts: 217.20.175.74 www.vav2008.comO1 - Hosts: 217.20.175.74 vav2008.comO1 - Hosts: 217.20.175.74 scanner.vavscan.comO1 - Hosts: 217.20.175.74 www.scanner.vavscan.comO1 - Hosts: 217.20.175.74 www.vavscan.comO1 - Hosts: 217.20.175.74 scan.vavscan.comO1 - Hosts: 217.20.175.74 www.scan.vavscan.comO1 - Hosts: www.vav2008.com 217.20.175.74O1 - Hosts: vav2008.com 217.20.175.74O1 - Hosts: scanner.vavscan.com 217.20.175.74O1 - Hosts: www.scanner.vavscan.com 217.20.175.74O1 - Hosts: www.vavscan.com 217.20.175.74O1 - Hosts: scan.vavscan.com 217.20.175.74O1 - Hosts: www.scan.vavscan.com 217.20.175.74O1 - Hosts: 217.20.175.74 www.vav2008.comO1 - Hosts: 217.20.175.74 vav2008.comO1 - Hosts: 217.20.175.74 scanner.vavscan.comO1 - Hosts: 217.20.175.74 www.scanner.vavscan.comO1 - Hosts: 217.20.175.74 www.vavscan.comO1 - Hosts: 217.20.175.74 scan.vavscan.comO1 - Hosts: 217.20.175.74 www.scan.vavscan.comO1 - Hosts: www.vav2008.com 217.20.175.74O1 - Hosts: vav2008.com 217.20.175.74O1 - Hosts: scanner.vavscan.com 217.20.175.74O1 - Hosts: www.scanner.vavscan.com 217.20.175.74O1 - Hosts: www.vavscan.com 217.20.175.74O1 - Hosts: scan.vavscan.com 217.20.175.74O1 - Hosts: www.scan.vavscan.com 217.20.175.74O1 - Hosts: 217.20.175.74 www.vav2008.comO1 - Hosts: 217.20.175.74 vav2008.comO1 - Hosts: 217.20.175.74 scanner.vavscan.comO1 - Hosts: 217.20.175.74 www.scanner.vavscan.comO1 - Hosts: 217.20.175.74 www.vavscan.comO1 - Hosts: 217.20.175.74 scan.vavscan.comO1 - Hosts: 217.20.175.74 www.scan.vavscan.comO2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dllO2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dllO2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exeO4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exeO4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exeO4 - HKLM\..\Run: [soundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exeO4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hideO4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exeO4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd2.exe"O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startupO4 - HKLM\..\Run: [iSUSPM] "C:\Program Files\Common Files\InstallShield\UpdateService\ISUSPM.exe" -schedulerO4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exeO4 - Global Startup: Event Reminder.lnk = ?O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXEO4 - Global Startup: QuickBooks 2002 Delivery Agent.lnk = C:\Program Files\Intuit\QuickBooks Pro\Components\QBAgent\qbdagent2002.exeO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file://C:\Program Files\Bejeweled 2\Images\stg_drm.ocxO16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cabO16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cabO16 - DPF: {74C861A1-D548-4916-BC8A-FDE92EDFF62C} - http://mediaplayer.walmart.com/installer/install.cabO16 - DPF: {9059F30F-4EB1-4BD2-9FDC-36F43A218F4A} (Microsoft RDP Client Control (redist)) - https://www.comfortsite.com/EBiz/Applicatio...SApps/msrdp.cabO16 - DPF: {9600F64D-755F-11D4-A47F-0001023E6D5A} (Shutterfly Picture Upload Plugin) - http://web1.shutterfly.com/downloads/Uploader.cabO16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file://C:\Program Files\Bejeweled 2\Images\armhelper.ocxO16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe.com/p...obat/nos/gp.cabO18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dllO20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLLO20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dllO23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exeO23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exeO23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exeO23 - Service: getPlus® Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exeO23 - Service: Google Desktop Manager 5.7.806.10245 (GoogleDesktopManager-061008-081103) - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exeO23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe--End of file - 10202 bytes Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted February 13, 2009 Root Admin ID:56129 Share Posted February 13, 2009 Please delete or rename your HOSTS file. C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hostsYou can rename it hosts.old if you like, or delete it and create a new one with only this in it.127.0.0.1 localhostThen restart your computer and download and run this AV scanner and let me know what it finds.Download to the desktop: Dr.Web CureItDoubleclick the drweb-cureit.exe file and Allow to run the express scanThis will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.Once the short scan has finished, Click Options > Change settingsChoose the "Scan"-tab, remove the mark at "Heuristic analysis".Back at the main window, mark the drives that you want to scan.Select all drives. A red dot shows which drives have been chosen.Click the green arrow at the right, and the scan will start.Click 'Yes to all' if it asks if you want to cure/move the file.When the scan has finished, look if you can click next icon next to the files found:If so, click it and then click the next icon right below and select Move incurable as you'll see in next image:This will move it to the %userprofile%\DoctorWeb\quarantaine-folder if it can't be cured. (this in case if we need samples)After selecting, in the Dr.Web CureIt menu on top, click file and choose save report listSave the report to your desktop. The report will be called DrWeb.csvClose Dr.Web Cureit.Reboot your computer!! Because it could be possible that files in use will be moved/deleted during reboot.After reboot, post the contents of the log from Dr.Web you saved previously in your next reply with a new hijackthis log. Link to post Share on other sites More sharing options...
Recommended Posts