Jump to content

Mbam and Hijackthis logs

Ozmo

By Ozmo
in Resolved Malware Removal Logs

 Share

Recommended Posts

Ozmo

Ozmo

Posted
Posted

I got a virus this past Friday so I updated and ran Mbam. It found a host of problems and said that all were fixed. However after this I could not log into Yahoo Messenger or use IE Explorer. I'm on Firefox now and while it works it does seem slower. I also am no longer able to update Mbam because it just says something about failure to connect. I'm thinking this virus or the maybe the Mbam process somehow changed my ability to connect to the internet. I'm not sure where to go from here.

Please help me if you can. Here are the logs.

Malwarebytes' Anti-Malware 1.35

Database version: 1931

Windows 5.1.2600 Service Pack 2

4/3/2009 11:20:25 PM

mbam-log-2009-04-03 (23-20-25).txt

Scan type: Quick Scan

Objects scanned: 100106

Time elapsed: 14 minute(s), 20 second(s)

Memory Processes Infected: 1

Memory Modules Infected: 1

Registry Keys Infected: 9

Registry Values Infected: 5

Registry Data Items Infected: 0

Folders Infected: 7

Files Infected: 9

Memory Processes Infected:

c:\WINDOWS\pp06.exe (Trojan.KoobFace) -> Unloaded process successfully.

Memory Modules Infected:

C:\WINDOWS\SYSTEM32\dll32.dll (Backdoor.Bot.Q) -> Delete on reboot.

Registry Keys Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{70b34e72-1561-414e-9598-9885d25e0397} (Trojan.Vundo.H) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\djepivku (Trojan.Vundo.H) -> Delete on reboot.

HKEY_CLASSES_ROOT\CLSID\{70b34e72-1561-414e-9598-9885d25e0397} (Trojan.Vundo.H) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\kgiilohl (Trojan.Vundo.H) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\kgiilohl (Trojan.Vundo.H) -> Delete on reboot.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{70b34e72-1561-414e-9598-9885d25e0397} (Trojan.Vundo.H) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\CrucialSoft Ltd (Rogue.MSantispyware2009) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ms antispyware 2009 5.7 (Rogue.MSAntiSpyware) -> Quarantined and deleted successfully.

Registry Values Infected:

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ms antispyware 2009 (Rogue.Multiple) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\pp (Backdoor.Bot) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dll (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fraguba (Trojan.Agent) -> Delete on reboot.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sysldtray (Backdoor.Bot) -> Quarantined and deleted successfully.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

C:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009 (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\BASE (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\DELETED (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\LOG (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\SAVED (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Program Files\Microsoft Common (Trojan.Agent) -> Quarantined and deleted successfully.

Files Infected:

c:\WINDOWS\SYSTEM32\cnwrdvc.dll (Trojan.Vundo.H) -> Delete on reboot.

C:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\msas2009.exe (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Documents and Settings\All Users\Application Data\CrucialSoft Ltd\MS AntiSpyware 2009\LOG\20090403214920031.log (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\Program Files\Microsoft Common\svchost.exe (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\t55ft2810f44.dat (Trojan.KoobFace) -> Quarantined and deleted successfully.

c:\WINDOWS\pp06.exe (Backdoor.Bot) -> Quarantined and deleted successfully.

C:\WINDOWS\owihuhiqo.dll (Trojan.Agent) -> Delete on reboot.

c:\WINDOWS\ld03.exe (Backdoor.Bot) -> Quarantined and deleted successfully.

C:\WINDOWS\SYSTEM32\dll32.dll (Backdoor.Bot.Q) -> Delete on reboot.

Logfile of HijackThis v1.99.1

Scan saved at 5:51:57 PM, on 4/5/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16762)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe

C:\Program Files\Dell\Support\Alert\bin\DAMon.exe

C:\Program Files\Microsoft Hardware\Mouse\point32.exe

C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe

C:\PROGRA~1\AVG\AVG8\avgrsx.exe

C:\PROGRA~1\AVG\AVG8\avgemc.exe

C:\PROGRA~1\AVG\AVG8\avgnsx.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\DNA\btdna.exe

C:\Program Files\Dell Computer\Dell Image Expert\IXApplet.exe

C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe

C:\Program Files\AVG\AVG8\avgcsrvx.exe

C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\DOCUME~1\ANDREW~1\LOCALS~1\Temp\Rar$EX00.515\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:7171

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll

O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"

O4 - HKLM\..\Run: [Dell|Alert] C:\Program Files\Dell\Support\Alert\bin\DAMon.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [POINTER] point32.exe

O4 - HKLM\..\Run: [ETUPS] C:\WINDOWS\System32\ETUPS.exe

O4 - HKLM\..\Run: [icasServ] C:\WINDOWS\System32\icasServ.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe

O4 - HKCU\..\Run: [slbiop] C:\WINDOWS\System32\slbiop.exe

O4 - HKCU\..\Run: [winpack] C:\WINDOWS\System32\winpack.exe

O4 - HKCU\..\Run: [ssgrate.exe] C:\WINDOWS\System32\system.exe

O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe

O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"

O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [bitTorrent DNA] "C:\Program Files\DNA\btdna.exe"

O4 - Global Startup: Camio Viewer.lnk = C:\Program Files\Dell Computer\Dell Image Expert\IXApplet.exe

O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra button: UltimateBet - {10F055B8-F443-4adf-948A-EC551E9DBCE4} - C:\Documents and Settings\Andrew Nitchals\Start Menu\Programs\UltimateBet\UltimateBet.lnk

O9 - Extra 'Tools' menuitem: UltimateBet - {10F055B8-F443-4adf-948A-EC551E9DBCE4} - C:\Documents and Settings\Andrew Nitchals\Start Menu\Programs\UltimateBet\UltimateBet.lnk

O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe

O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll

O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe

O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll

O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe

O9 - Extra button: Royal Vegas Poker - {FA4904B4-1FAF-4afd-886C-C19D2297BA62} - C:\Program Files\royalvegasMPP\MPPoker.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International*

O16 - DPF: ConferenceRoom Java Client - http://chat.privatefeeds.com:8000/java/cr.cab

O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/games/clients/y/jt0_x.cab

O16 - DPF: Yahoo! Cribbage - http://download.games.yahoo.com/games/clients/y/it1_x.cab

O16 - DPF: Yahoo! Graffiti - http://download.games.yahoo.com/games/clients/y/grt5_x.cab

O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/games/clients/y/pt1_x.cab

O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab

O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab

O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha...v43/yacscom.cab

O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212...meInstaller.exe

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1204071334749

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1204071319530

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab

O16 - DPF: {7A32634B-029C-4836-A023-528983982A49} - http://fdl.msn.com/public/chat/msnchat42.cab

O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab

O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/...ymmapi_0727.dll

O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} - http://activex.microgaming.com/DLhelper/ve...n7/dlhelper.cab

O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Toolbar) - http://us.dl1.yimg.com/download.yahoo.com/...bio4_0_2_10.cab

O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab

O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll

O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll

O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe

O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

O23 - Service: Symantec RemoteAssist - Unknown owner - C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe (file missing)

Link to post
Share on other sites
  • Staff
miekiemoes

miekiemoes

Posted
  • Staff
Posted

Hi,

You have a nasty collection of malware there - and it looks like you're already infected for a while..

First of all, I see you are running Teatimer.

I suggest you to disable it because it can interfere with the changes you'll make on your system.

When everything is done and your log is clean again, you can enable it again.

If teatimer gives you a warning afterwards that some changes were made, allow this instead of blocking it.

How to disable TeaTimer <== click me for instructions.

Then, To fix your IE and connection:

In IE: Tools Menu -> Internet Options -> Connections Tab ->Lan Settings > uncheck "use a proxy server" or reconfigure the Proxy server again in case you have set it previously.

In Firefox in Tools Menu -> Options... -> Advanced Tab -> Network Tab -> "Settings" under Connection.

Then update mbam and post a new log together with a new HijackThislog

Link to post
Share on other sites
Ozmo

Ozmo

Posted
  • Author
Posted

Yeah Mbam found alot of problems on 4/3 but I think they all got on my computer at the same time because I had run Mbam a few days earlier and nothing was detected. As far as the problems Mbam detected I thought that they were all cleaned. I do not seem to have anything running in my taskmanager that shouldnt be there.

Thank you for the advice about the uncheck proxy server. This has allowed IE and Yahoo messenger to work again and I am now able to update to the most current Mbam. Did the virus cause the box to be checked when its not suppose to be?

I am going to just delete Spybot S&D since I really dont use it after discovering Mbam. This will get rid of the teatimer correct? After that I will run Mbam and Hijack this again and post those logs when they are complete.

Link to post
Share on other sites
Ozmo

Ozmo

Posted
  • Author
Posted

OK I deleted Spybot S&D and updated to the newest Mbam. I have the logs for both Mbam and Hijackthis. The new Mbam scan found only 3 infections and I believe all were deleted. After posting these new logs I am going to run another scan and see what happens. I also did a full scan this time instead of the quick scan log I posted previously. Please let me know how everything looks.

Malwarebytes' Anti-Malware 1.35

Database version: 1943

Windows 5.1.2600 Service Pack 2

4/5/2009 9:09:55 PM

mbam-log-2009-04-05 (21-09-55).txt

Scan type: Full Scan (C:\|)

Objects scanned: 226112

Time elapsed: 1 hour(s), 32 minute(s), 29 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 1

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 2

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fraguba (Trojan.Agent) -> Delete on reboot.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\System Volume Information\_restore{21D7D692-4662-421F-93B0-877BC3820711}\RP1\A0001693.dll (Trojan.Agent) -> Quarantined and deleted successfully.

C:\WINDOWS\ucuxidigibavuk.dll (Trojan.Agent) -> Delete on reboot.

Logfile of HijackThis v1.99.1

Scan saved at 9:17:51 PM, on 4/5/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16762)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\wscntfy.exe

C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe

C:\Program Files\Dell\Support\Alert\bin\DAMon.exe

C:\Program Files\Microsoft Hardware\Mouse\point32.exe

C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\DNA\btdna.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Dell Computer\Dell Image Expert\IXApplet.exe

C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe

C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Downloaded Programs\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:7171

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll (file missing)

O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"

O4 - HKLM\..\Run: [Dell|Alert] C:\Program Files\Dell\Support\Alert\bin\DAMon.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [POINTER] point32.exe

O4 - HKLM\..\Run: [ETUPS] C:\WINDOWS\System32\ETUPS.exe

O4 - HKLM\..\Run: [icasServ] C:\WINDOWS\System32\icasServ.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

O4 - HKCU\..\Run: [slbiop] C:\WINDOWS\System32\slbiop.exe

O4 - HKCU\..\Run: [winpack] C:\WINDOWS\System32\winpack.exe

O4 - HKCU\..\Run: [ssgrate.exe] C:\WINDOWS\System32\system.exe

O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe

O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"

O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [bitTorrent DNA] "C:\Program Files\DNA\btdna.exe"

O4 - Global Startup: Camio Viewer.lnk = C:\Program Files\Dell Computer\Dell Image Expert\IXApplet.exe

O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra button: UltimateBet - {10F055B8-F443-4adf-948A-EC551E9DBCE4} - C:\Documents and Settings\Andrew Nitchals\Start Menu\Programs\UltimateBet\UltimateBet.lnk

O9 - Extra 'Tools' menuitem: UltimateBet - {10F055B8-F443-4adf-948A-EC551E9DBCE4} - C:\Documents and Settings\Andrew Nitchals\Start Menu\Programs\UltimateBet\UltimateBet.lnk

O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe

O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll

O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe

O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll

O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)

O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe

O9 - Extra button: Royal Vegas Poker - {FA4904B4-1FAF-4afd-886C-C19D2297BA62} - C:\Program Files\royalvegasMPP\MPPoker.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International*

O16 - DPF: ConferenceRoom Java Client - http://chat.privatefeeds.com:8000/java/cr.cab

O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/games/clients/y/jt0_x.cab

O16 - DPF: Yahoo! Cribbage - http://download.games.yahoo.com/games/clients/y/it1_x.cab

O16 - DPF: Yahoo! Graffiti - http://download.games.yahoo.com/games/clients/y/grt5_x.cab

O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/games/clients/y/pt1_x.cab

O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab

O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab

O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha...v43/yacscom.cab

O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212...meInstaller.exe

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1204071334749

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1204071319530

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab

O16 - DPF: {7A32634B-029C-4836-A023-528983982A49} - http://fdl.msn.com/public/chat/msnchat42.cab

O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab

O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/...ymmapi_0727.dll

O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} - http://activex.microgaming.com/DLhelper/ve...n7/dlhelper.cab

O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Toolbar) - http://us.dl1.yimg.com/download.yahoo.com/...bio4_0_2_10.cab

O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

O23 - Service: Symantec RemoteAssist - Unknown owner - C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe (file missing)

Link to post
Share on other sites
  • Staff
miekiemoes

miekiemoes

Posted
  • Staff
Posted

Hi,

Open IE,

In IE: Tools Menu -> Internet Options -> Connections Tab ->Lan Settings > uncheck "use a proxy server" or reconfigure the Proxy server again in case you have set it previously.

In Firefox in Tools Menu -> Options... -> Advanced Tab -> Network Tab -> "Settings" under Connection.

Then, * Please visit this webpage for instructions for downloading and running ComboFix:

http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Post the log from ComboFix in your next reply.

Please make sure you disable ALL of your Antivirus/Antispyware/Firewall before running ComboFix..This because Security Software may see some components ComboFix uses (prep.com for example) as suspicious and blocks the tool, or even deletes it. Please visit HERE if you don't know how.

Link to post
Share on other sites
Ozmo

Ozmo

Posted
  • Author
Posted

First of all I want to say thank you so much for helping me out miekiemoes. I know you dont have to help out strangers but it is much appreciated. I did some of my own investigating to learn how to interpret my Hijackthis log. I noticed teatimer was still running so I deleted that with Hijackthis as well as a few other items. I also realized there is alot more malware on my computer than I thought however I never experienced any problems until last friday. One thing I'm sure you will notice but I'd like to point out is that "Fraguba" now appears in my Hijackthis log for some reason when it was not on the previous ones. I will post my most current logs as much for my own reference as yours. I am going to start work with ComboFix right now and will post those results as soon as I have them.

Malwarebytes' Anti-Malware 1.35

Database version: 1944

Windows 5.1.2600 Service Pack 2

4/6/2009 1:11:48 AM

mbam-log-2009-04-06 (01-11-48).txt

Scan type: Quick Scan

Objects scanned: 101813

Time elapsed: 12 minute(s), 55 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 1

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fraguba (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\egaruculi.dll (Trojan.Agent) -> Delete on reboot.

Logfile of HijackThis v1.99.1

Scan saved at 1:12:28 AM, on 4/6/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16762)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe

C:\Program Files\Dell\Support\Alert\bin\DAMon.exe

C:\Program Files\Microsoft Hardware\Mouse\point32.exe

C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\DNA\btdna.exe

C:\Program Files\Dell Computer\Dell Image Expert\IXApplet.exe

C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe

C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:7171

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

F2 - REG:system.ini: UserInit=C:\WINDOWS\System32\Userinit.exe

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"

O4 - HKLM\..\Run: [Dell|Alert] C:\Program Files\Dell\Support\Alert\bin\DAMon.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [POINTER] point32.exe

O4 - HKLM\..\Run: [ETUPS] C:\WINDOWS\System32\ETUPS.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

O4 - HKLM\..\Run: [Fraguba] rundll32.exe "C:\WINDOWS\egaruculi.dll",e

O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKCU\..\Run: [slbiop] C:\WINDOWS\System32\slbiop.exe

O4 - HKCU\..\Run: [Microsoft Works Update Detection] C:\Program Files\Microsoft Works\WkDetect.exe

O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"

O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [bitTorrent DNA] "C:\Program Files\DNA\btdna.exe"

O4 - Global Startup: Camio Viewer.lnk = C:\Program Files\Dell Computer\Dell Image Expert\IXApplet.exe

O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra button: UltimateBet - {10F055B8-F443-4adf-948A-EC551E9DBCE4} - C:\Documents and Settings\Andrew Nitchals\Start Menu\Programs\UltimateBet\UltimateBet.lnk

O9 - Extra 'Tools' menuitem: UltimateBet - {10F055B8-F443-4adf-948A-EC551E9DBCE4} - C:\Documents and Settings\Andrew Nitchals\Start Menu\Programs\UltimateBet\UltimateBet.lnk

O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe

O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll

O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe

O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll

O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll

O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe

O9 - Extra button: Royal Vegas Poker - {FA4904B4-1FAF-4afd-886C-C19D2297BA62} - C:\Program Files\royalvegasMPP\MPPoker.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International*

O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/games/clients/y/jt0_x.cab

O16 - DPF: Yahoo! Cribbage - http://download.games.yahoo.com/games/clients/y/it1_x.cab

O16 - DPF: Yahoo! Graffiti - http://download.games.yahoo.com/games/clients/y/grt5_x.cab

O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/games/clients/y/pt1_x.cab

O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab

O16 - DPF: {1D0D9077-3798-49BB-9058-393499174D5D} - file://c:\counter.cab

O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha...v43/yacscom.cab

O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212...meInstaller.exe

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1204071334749

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1204071319530

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab

O16 - DPF: {7A32634B-029C-4836-A023-528983982A49} - http://fdl.msn.com/public/chat/msnchat42.cab

O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab

O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/...ymmapi_0727.dll

O16 - DPF: {AED98630-0251-4E83-917D-43A23D66D507} - http://activex.microgaming.com/DLhelper/ve...n7/dlhelper.cab

O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Toolbar) - http://us.dl1.yimg.com/download.yahoo.com/...bio4_0_2_10.cab

O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

O23 - Service: Symantec RemoteAssist - Unknown owner - C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe (file missing)

Link to post
Share on other sites
Ozmo

Ozmo

Posted
  • Author
Posted

Here is my ComboFix log. I followed all of the instructions but one thing to note is I did not realize it would reboot my computer towards the end of the process. After it rebooted my Ad-Aware Live came back on. This was only at the very end though so I'm not sure if it affects the results or not.

ComboFix 09-04-04.01 - Andrew Nitchals 2009-04-06 2:02:48.1 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.255.86 [GMT -5:00]

Running from: c:\documents and settings\Andrew Nitchals\Desktop\ComboFix.exe

* Created a new restore point

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\docume~1\ANDREW~1\LOCALS~1\Temp\tmp1.tmp

c:\docume~1\ANDREW~1\LOCALS~1\Temp\tmp2.tmp

c:\documents and settings\Andrew Nitchals\Application Data\CURITY~1

c:\windows\patch.exe

c:\windows\system32\calsdr.exe

c:\windows\system32\ClrSchP028.exe

c:\windows\system32\nfr.assembly

c:\windows\system32\wtssvit32.exe

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

.

-------\Legacy_TDSSSERV.SYS

-------\Service_TDSSserv.sys

((((((((((((((((((((((((( Files Created from 2009-03-06 to 2009-04-06 )))))))))))))))))))))))))))))))

.

2009-04-04 21:39 . 2009-04-04 21:39 <DIR> d--h-c--- c:\documents and settings\All Users\Application Data\{92E7A367-8E12-4830-AA70-29C32E331A81}

2009-04-04 21:24 . 2009-04-04 21:24 <DIR> d-------- c:\documents and settings\Andrew Nitchals\Application Data\ErrorSmart

2009-04-03 23:21 . 2009-04-03 23:21 <DIR> d-------- c:\documents and settings\Andrew Nitchals\Application Data\yosfkurp

2009-04-03 21:48 . 2009-04-03 21:48 1 --a------ c:\windows\9g2234wesdf3dfgjf23

2009-04-01 20:14 . 2009-03-09 14:06 15,688 --a------ c:\windows\SYSTEM32\lsdelete.exe

2009-04-01 17:41 . 2009-03-09 14:06 64,160 --a------ c:\windows\SYSTEM32\DRIVERS\Lbd.sys

2009-04-01 17:39 . 2009-04-01 17:39 <DIR> d--h-c--- c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-04-06 07:17 --------- d-----w c:\program files\DNA

2009-04-06 07:17 --------- d-----w c:\documents and settings\Andrew Nitchals\Application Data\DNA

2009-04-05 08:35 --------- d-----w c:\program files\Common Files\Symantec Shared

2009-04-05 06:41 --------- d-----w c:\program files\eDonkey2000

2009-04-04 21:39 --------- d-----w c:\documents and settings\Andrew Nitchals\Application Data\BitTorrent

2009-04-04 21:11 --------- d-----w c:\program files\PokerStars

2009-04-04 11:19 --------- d-----w c:\program files\Full Tilt Poker

2009-04-04 08:16 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec

2009-04-04 04:20 --------- d-----w c:\program files\Common Files\Mozilla Shared

2009-04-02 09:33 --------- d-----w c:\program files\UltimateBet

2009-04-02 02:21 --------- d-----w c:\program files\Malwarebytes' Anti-Malware

2009-04-01 22:38 --------- d-----w c:\program files\Lavasoft

2009-04-01 22:38 --------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft

2009-03-29 08:35 --------- d-----w c:\program files\Soulseek

2009-03-26 21:49 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys

2009-03-26 21:49 15,504 ----a-w c:\windows\system32\drivers\mbam.sys

2009-03-16 03:56 --------- d--h--w c:\program files\InstallShield Installation Information

2009-03-10 23:15 --------- d-----w c:\program files\Bodog Poker

2009-03-10 23:08 --------- d-----w c:\program files\mIRC

2005-10-27 01:26 80,384 --sha-w c:\program files\Thumbs.db

2005-10-03 02:26 5,488 ----a-r c:\documents and settings\Andrew Nitchals\Application Data\mpauth.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MoneyAgent"="c:\program files\Microsoft Money\System\Money Express.exe" [2001-07-25 184376]

"Yahoo! Pager"="c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2007-08-30 4670704]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2008-12-15 342848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-10-06 5058560]

"AdaptecDirectCD"="c:\program files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-04-10 679936]

"Dell|Alert"="c:\program files\Dell\Support\Alert\bin\DAMon.exe" [2002-04-03 282624]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2007-06-29 286720]

"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_11\bin\jusched.exe" [2006-12-15 75520]

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-04-28 185896]

"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-03-09 515416]

"Fraguba"="c:\windows\iqumihoyop.dll" [2007-03-08 156672]

"nwiz"="nwiz.exe" [2003-10-06 c:\windows\SYSTEM32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-02-01 8699904]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Camio Viewer.lnk - c:\program files\Dell Computer\Dell Image Expert\IXApplet.exe [2002-03-28 53248]

Microsoft Works Calendar Reminders.lnk - c:\program files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe [2001-08-07 24633]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"vidc.I420"= i263_32.drv

"VIDC.I263"= i263_32.drv

"msacm.divxa32"= DivXa32.acm

"vidc.xvid"= xvid.dll

"vidc.DIV3"= DivXc32.dll

"vidc.DIV4"= DivXc32f.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

Notification Packages REG_MULTI_SZ scecli DBDTEX.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\Program Files\\BitTorrent\\bittorrent.exe"=

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

"c:\\Program Files\\Soulseek\\slsk.exe"=

"c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=

"c:\\Program Files\\DNA\\btdna.exe"=

R0 Lbd;Lbd;c:\windows\SYSTEM32\DRIVERS\Lbd.sys [2009-04-01 64160]

R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-03-09 951632]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs

kgiilohl

.

Contents of the 'Scheduled Tasks' folder

2009-04-04 c:\windows\Tasks\At1.job

- c:\windows\system32\cnwrdvc.dll []

2009-04-05 c:\windows\Tasks\ErrorSmart Scheduled Scan.job

- c:\program files\ErrorSmart\ErrorSmart.exe []

2009-04-05 c:\windows\Tasks\ErrorSmart Scheduled Scan.job

- c:\program files\ErrorSmart []

.

- - - - ORPHANS REMOVED - - - -

HKCU-Run-slbiop - c:\windows\System32\slbiop.exe

HKCU-Run-Microsoft Works Update Detection - c:\program files\Microsoft Works\WkDetect.exe

HKLM-Run-ETUPS - c:\windows\System32\ETUPS.exe

HKLM-Run-POINTER - point32.exe

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.yahoo.com/

uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7

mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html

uInternet Settings,ProxyServer = http=localhost:7171

uInternet Settings,ProxyOverride = *.local;<local>

uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com

IE: {{10F055B8-F443-4adf-948A-EC551E9DBCE4} - c:\documents and settings\Andrew Nitchals\Start Menu\Programs\UltimateBet\UltimateBet.lnk

IE: {{FA4904B4-1FAF-4afd-886C-C19D2297BA62} - c:\program files\royalvegasMPP\MPPoker.exe

DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

FF - ProfilePath - c:\documents and settings\Andrew Nitchals\Application Data\Mozilla\Firefox\Profiles\z9s4hcbv.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/

FF - plugin: c:\documents and settings\Andrew Nitchals\Application Data\Mozilla\Firefox\Profiles\z9s4hcbv.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp07076007.dll

FF - plugin: c:\progra~1\Yahoo!\Common\npyaxmpb.dll

FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPJava11.dll

FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPJava12.dll

FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPJava13.dll

FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPJava14.dll

FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPJava32.dll

FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPJPI150_11.dll

FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPOJI610.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll

.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-04-06 02:17:50

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Dell|Alert = c:\program files\Dell\Support\Alert\bin\DAMon.exe?p?o?r?t?\?A?l?e?r?t?\?b?i?n?\?D?A?M?o?n?.?e?x?e???????????x:??p???x???P???X???????????P???P????(?w'(?w????????????(???{??????w????????????0????$?w7(?w?o?wS??w???w????????????X*@?????????X????????%@?e?????

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1858025970-4264649163-3499916212-1006\Software\Microsoft\SystemCertificates\AddressBook*]

@Allowed: (Read) (RestrictedCode)

@Allowed: (Read) (RestrictedCode)

.

--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'lsass.exe'(588)

c:\windows\DBDTEX.dll

.

------------------------ Other Running Processes ------------------------

.

c:\windows\SYSTEM32\nvsvc32.exe

c:\program files\Microsoft Hardware\Mouse\point32.exe

c:\windows\SYSTEM32\wdfmgr.exe

c:\progra~1\Yahoo!\MESSEN~1\Ymsgr_tray.exe

c:\windows\SYSTEM32\WBEM\UNSECAPP.EXE

c:\windows\SYSTEM32\wscntfy.exe

.

**************************************************************************

.

Completion time: 2009-04-06 2:30:36 - machine was rebooted

ComboFix-quarantined-files.txt 2009-04-06 07:30:31

Pre-Run: 43,141,443,584 bytes free

Post-Run: 45,301,940,224 bytes free

WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe

[boot loader]

timeout=2

default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS

[operating systems]

c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons

multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn

194 --- E O F --- 2008-12-16 09:49:18

Link to post
Share on other sites
Ozmo

Ozmo

Posted
  • Author
Posted

For the sake of completeness here are my Mbam and Hijackthis logs after running ComboFix. To my untrained eye they appear to be much cleaner except for that pesky "Fraguba" trojan that wont go away. What I find a little strange is that "Fraguba" did not even show up in Hijackthis at first but now is the one that causing the most trouble. It will be a few hours until I check back. Anyway here are the newest logs.

Malwarebytes' Anti-Malware 1.35

Database version: 1944

Windows 5.1.2600 Service Pack 2

4/6/2009 4:36:55 AM

mbam-log-2009-04-06 (04-36-55).txt

Scan type: Quick Scan

Objects scanned: 77305

Time elapsed: 3 minute(s), 28 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 1

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 1

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\fraguba (Trojan.Agent) -> Quarantined and deleted successfully.

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

C:\WINDOWS\equvacasatox.dll (Trojan.Agent) -> Delete on reboot.

Logfile of HijackThis v1.99.1

Scan saved at 4:37:14 AM, on 4/6/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16762)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe

C:\Program Files\Dell\Support\Alert\bin\DAMon.exe

C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\DNA\btdna.exe

C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wuauclt.exe

C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=localhost:7171

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local;<local>

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"

O4 - HKLM\..\Run: [Dell|Alert] C:\Program Files\Dell\Support\Alert\bin\DAMon.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

O4 - HKLM\..\Run: [Fraguba] rundll32.exe "C:\WINDOWS\equvacasatox.dll",e

O4 - HKLM\..\RunOnce: [Malwarebytes Anti-Malware (reboot)] "C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript

O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"

O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [bitTorrent DNA] "C:\Program Files\DNA\btdna.exe"

O4 - Global Startup: Camio Viewer.lnk = C:\Program Files\Dell Computer\Dell Image Expert\IXApplet.exe

O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra button: UltimateBet - {10F055B8-F443-4adf-948A-EC551E9DBCE4} - C:\Documents and Settings\Andrew Nitchals\Start Menu\Programs\UltimateBet\UltimateBet.lnk

O9 - Extra 'Tools' menuitem: UltimateBet - {10F055B8-F443-4adf-948A-EC551E9DBCE4} - C:\Documents and Settings\Andrew Nitchals\Start Menu\Programs\UltimateBet\UltimateBet.lnk

O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe

O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll

O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe

O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll

O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll

O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe

O9 - Extra button: Royal Vegas Poker - {FA4904B4-1FAF-4afd-886C-C19D2297BA62} - C:\Program Files\royalvegasMPP\MPPoker.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International*

O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/games/clients/y/jt0_x.cab

O16 - DPF: Yahoo! Cribbage - http://download.games.yahoo.com/games/clients/y/it1_x.cab

O16 - DPF: Yahoo! Graffiti - http://download.games.yahoo.com/games/clients/y/grt5_x.cab

O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/games/clients/y/pt1_x.cab

O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab

O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha...v43/yacscom.cab

O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212...meInstaller.exe

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1204071334749

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1204071319530

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab

O16 - DPF: {7A32634B-029C-4836-A023-528983982A49} - http://fdl.msn.com/public/chat/msnchat42.cab

O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab

O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/...ymmapi_0727.dll

O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Toolbar) - http://us.dl1.yimg.com/download.yahoo.com/...bio4_0_2_10.cab

O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

O23 - Service: Symantec RemoteAssist - Unknown owner - C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe (file missing)

Link to post
Share on other sites
  • Staff
miekiemoes

miekiemoes

Posted
  • Staff
Posted

Hi,

* Open notepad - don't use any other texteditor than notepad or the script will fail.

Copy/paste the text in the quotebox below into notepad:

File::

c:\windows\DBDTEX.dll

c:\windows\Tasks\ErrorSmart Scheduled Scan.job

c:\windows\Tasks\At1.job

c:\windows\iqumihoyop.dll

c:\windows\9g2234wesdf3dfgjf23

DDS::

uInternet Settings,ProxyServer = http=localhost:7171

uInternet Settings,ProxyOverride = *.local;<local>

Netsvc::

kgiilohl

Folder::

c:\documents and settings\Andrew Nitchals\Application Data\ErrorSmart

Dirlook::

c:\documents and settings\Andrew Nitchals\Application Data\yosfkurp

c:\documents and settings\All Users\Application Data\{92E7A367-8E12-4830-AA70-29C32E331A81}

Registry::

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]

"Notification Packages"=hex(7):73,63,65,63,6c,69,00,00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Fraguba"=-

Save this as txtfile CFScript

Then drag the CFScript into ComboFix.exe as you see in the screenshot below.

CFScript.gif

This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply.

Link to post
Share on other sites
Ozmo

Ozmo

Posted
  • Author
Posted

Here is the newest ComboFix log.

ComboFix 09-04-04.01 - Andrew Nitchals 2009-04-06 17:27:09.2 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.255.102 [GMT -5:00]

Running from: c:\documents and settings\Andrew Nitchals\Desktop\ComboFix.exe

Command switches used :: c:\documents and settings\Andrew Nitchals\Desktop\CFScript.txt

* Created a new restore point

FILE ::

c:\windows\9g2234wesdf3dfgjf23

c:\windows\DBDTEX.dll

c:\windows\iqumihoyop.dll

c:\windows\Tasks\At1.job

c:\windows\Tasks\ErrorSmart Scheduled Scan.job

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

c:\documents and settings\Andrew Nitchals\Application Data\ErrorSmart

c:\documents and settings\Andrew Nitchals\Application Data\ErrorSmart\Log\2009 Apr 04 - 09_24_26 PM_562.log

c:\documents and settings\Andrew Nitchals\Application Data\ErrorSmart\Log\2009 Apr 05 - 03_30_06 AM_390.log

c:\windows\9g2234wesdf3dfgjf23

c:\windows\Tasks\At1.job

c:\windows\Tasks\ErrorSmart Scheduled Scan.job

.

((((((((((((((((((((((((( Files Created from 2009-03-06 to 2009-04-06 )))))))))))))))))))))))))))))))

.

2009-04-04 21:39 . 2009-04-04 21:39 <DIR> d--h-c--- c:\documents and settings\All Users\Application Data\{92E7A367-8E12-4830-AA70-29C32E331A81}

2009-04-03 23:21 . 2009-04-03 23:21 <DIR> d-------- c:\documents and settings\Andrew Nitchals\Application Data\yosfkurp

2009-04-01 20:14 . 2009-03-09 14:06 15,688 --a------ c:\windows\SYSTEM32\lsdelete.exe

2009-04-01 17:41 . 2009-03-09 14:06 64,160 --a------ c:\windows\SYSTEM32\DRIVERS\Lbd.sys

2009-04-01 17:39 . 2009-04-01 17:39 <DIR> d--h-c--- c:\documents and settings\All Users\Application Data\{7972B2E5-3E09-4E5E-81B7-FE5819D6772F}

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2009-04-06 22:30 --------- d-----w c:\documents and settings\Andrew Nitchals\Application Data\DNA

2009-04-06 22:20 --------- d-----w c:\program files\DNA

2009-04-06 22:13 --------- d-----w c:\program files\Malwarebytes' Anti-Malware

2009-04-06 20:32 38,496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys

2009-04-06 20:32 15,504 ----a-w c:\windows\system32\drivers\mbam.sys

2009-04-05 08:35 --------- d-----w c:\program files\Common Files\Symantec Shared

2009-04-05 06:41 --------- d-----w c:\program files\eDonkey2000

2009-04-04 21:39 --------- d-----w c:\documents and settings\Andrew Nitchals\Application Data\BitTorrent

2009-04-04 21:11 --------- d-----w c:\program files\PokerStars

2009-04-04 11:19 --------- d-----w c:\program files\Full Tilt Poker

2009-04-04 08:16 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec

2009-04-04 04:20 --------- d-----w c:\program files\Common Files\Mozilla Shared

2009-04-02 09:33 --------- d-----w c:\program files\UltimateBet

2009-04-01 22:38 --------- d-----w c:\program files\Lavasoft

2009-04-01 22:38 --------- d-----w c:\documents and settings\All Users\Application Data\Lavasoft

2009-03-29 08:35 --------- d-----w c:\program files\Soulseek

2009-03-16 03:56 --------- d--h--w c:\program files\InstallShield Installation Information

2009-03-10 23:15 --------- d-----w c:\program files\Bodog Poker

2009-03-10 23:08 --------- d-----w c:\program files\mIRC

2005-10-27 01:26 80,384 --sha-w c:\program files\Thumbs.db

2005-10-03 02:26 5,488 ----a-r c:\documents and settings\Andrew Nitchals\Application Data\mpauth.dat

.

(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

---- Directory of c:\documents and settings\All Users\Application Data\{92E7A367-8E12-4830-AA70-29C32E331A81} ----

---- Directory of c:\documents and settings\Andrew Nitchals\Application Data\yosfkurp ----

2009-04-03 23:21 96173 --a------ c:\documents and settings\Andrew Nitchals\Application Data\yosfkurp\Profiles\uq7eneaj.default\xpti.dat

2009-04-03 23:21 8750 --a------ c:\documents and settings\Andrew Nitchals\Application Data\yosfkurp\Profiles\uq7eneaj.default\pluginreg.dat

2009-04-03 23:21 65536 --a------ c:\documents and settings\Andrew Nitchals\Application Data\yosfkurp\Profiles\uq7eneaj.default\cert8.db

2009-04-03 23:21 510 --a------ c:\documents and settings\Andrew Nitchals\Application Data\yosfkurp\Profiles\uq7eneaj.default\localstore.rdf

2009-04-03 23:21 4100 --ah---t- c:\documents and settings\Andrew Nitchals\Application Data\yosfkurp\Profiles\uq7eneaj.default\places.sqlite-stmtjrnl

2009-04-03 23:21 4096 --a------ c:\documents and settings\Andrew Nitchals\Application Data\yosfkurp\Profiles\uq7eneaj.default\formhistory.sqlite

2009-04-03 23:21 367 --a------ c:\documents and settings\Andrew Nitchals\Application Data\yosfkurp\Profiles\uq7eneaj.default\prefs.js

2009-04-03 23:21 207 --a------ c:\documents and settings\Andrew Nitchals\Application Data\yosfkurp\Profiles\uq7eneaj.default\compatibility.ini

2009-04-03 23:21 2048 --a------ c:\documents and settings\Andrew Nitchals\Application Data\yosfkurp\Profiles\uq7eneaj.default\webappsstore.sqlite

2009-04-03 23:21 2048 --a------ c:\documents and settings\Andrew Nitchals\Application Data\yosfkurp\Profiles\uq7eneaj.default\permissions.sqlite

2009-04-03 23:21 2048 --a------ c:\documents and settings\Andrew Nitchals\Application Data\yosfkurp\Profiles\uq7eneaj.default\cookies.sqlite

2009-04-03 23:21 16384 --a------ c:\documents and settings\Andrew Nitchals\Application Data\yosfkurp\Profiles\uq7eneaj.default\secmod.db

2009-04-03 23:21 16384 --a------ c:\documents and settings\Andrew Nitchals\Application Data\yosfkurp\Profiles\uq7eneaj.default\key3.db

2009-04-03 23:21 131072 --a------ c:\documents and settings\Andrew Nitchals\Application Data\yosfkurp\Profiles\uq7eneaj.default\places.sqlite

2009-04-03 23:21 127820 --a------ c:\documents and settings\Andrew Nitchals\Application Data\yosfkurp\Profiles\uq7eneaj.default\compreg.dat

2009-04-03 23:21 111 --a------ c:\documents and settings\Andrew Nitchals\Application Data\yosfkurp\profiles.ini

2009-04-03 23:21 0 --a------ c:\documents and settings\Andrew Nitchals\Application Data\yosfkurp\Profiles\uq7eneaj.default\places.sqlite-journal

2009-04-03 23:21 0 --a------ c:\documents and settings\Andrew Nitchals\Application Data\yosfkurp\Profiles\uq7eneaj.default\parent.lock

((((((((((((((((((((((((((((( SnapShot@2009-04-06_ 2.29.24.68 )))))))))))))))))))))))))))))))))))))))))

.

- 2009-04-04 21:18:49 32,768 ----a-w c:\windows\SYSTEM32\CONFIG\systemprofile\Cookies\INDEX.DAT

+ 2009-04-06 08:03:08 32,768 ----a-w c:\windows\SYSTEM32\CONFIG\systemprofile\Cookies\INDEX.DAT

- 2009-04-04 21:18:49 32,768 ----a-w c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\INDEX.DAT

+ 2009-04-06 08:03:08 32,768 ----a-w c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\History\History.IE5\INDEX.DAT

- 2009-04-04 21:18:49 32,768 ----a-w c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat

+ 2009-04-06 08:03:08 32,768 ----a-w c:\windows\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\index.dat

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"MoneyAgent"="c:\program files\Microsoft Money\System\Money Express.exe" [2001-07-25 184376]

"Yahoo! Pager"="c:\progra~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" [2007-08-30 4670704]

"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2008-12-15 342848]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"NvCplDaemon"="c:\windows\System32\NvCpl.dll" [2003-10-06 5058560]

"AdaptecDirectCD"="c:\program files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe" [2002-04-10 679936]

"Dell|Alert"="c:\program files\Dell\Support\Alert\bin\DAMon.exe" [2002-04-03 282624]

"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2007-06-29 286720]

"SunJavaUpdateSched"="c:\program files\Java\jre1.5.0_11\bin\jusched.exe" [2006-12-15 75520]

"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-04-28 185896]

"Ad-Watch"="c:\program files\Lavasoft\Ad-Aware\AAWTray.exe" [2009-03-09 515416]

"nwiz"="nwiz.exe" [2003-10-06 c:\windows\SYSTEM32\nwiz.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]

"MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-02-01 8699904]

c:\documents and settings\All Users\Start Menu\Programs\Startup\

Camio Viewer.lnk - c:\program files\Dell Computer\Dell Image Expert\IXApplet.exe [2002-03-28 53248]

Microsoft Works Calendar Reminders.lnk - c:\program files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe [2001-08-07 24633]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]

"vidc.I420"= i263_32.drv

"VIDC.I263"= i263_32.drv

"msacm.divxa32"= DivXa32.acm

"vidc.xvid"= xvid.dll

"vidc.DIV3"= DivXc32.dll

"vidc.DIV4"= DivXc32f.dll

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

@="Service"

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]

"DisableMonitoring"=dword:00000001

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]

"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]

"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]

"c:\\Program Files\\BitTorrent\\bittorrent.exe"=

"%windir%\\system32\\sessmgr.exe"=

"%windir%\\Network Diagnostic\\xpnetdiag.exe"=

"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

"c:\\Program Files\\Soulseek\\slsk.exe"=

"c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"=

"c:\\Program Files\\DNA\\btdna.exe"=

R0 Lbd;Lbd;c:\windows\SYSTEM32\DRIVERS\Lbd.sys [2009-04-01 64160]

S3 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\Lavasoft\Ad-Aware\AAWService.exe [2009-03-09 951632]

.

.

------- Supplementary Scan -------

.

uStart Page = hxxp://www.yahoo.com/

uSearchMigratedDefaultURL = hxxp://search.yahoo.com/search?p={searchTerms}&ei=utf-8&fr=b1ie7

mSearch Bar = hxxp://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html

uSearchURL,(Default) = hxxp://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com

IE: {{10F055B8-F443-4adf-948A-EC551E9DBCE4} - c:\documents and settings\Andrew Nitchals\Start Menu\Programs\UltimateBet\UltimateBet.lnk

IE: {{FA4904B4-1FAF-4afd-886C-C19D2297BA62} - c:\program files\royalvegasMPP\MPPoker.exe

DPF: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab

FF - ProfilePath - c:\documents and settings\Andrew Nitchals\Application Data\Mozilla\Firefox\Profiles\z9s4hcbv.default\

FF - prefs.js: browser.startup.homepage - hxxp://www.yahoo.com/

FF - plugin: c:\documents and settings\Andrew Nitchals\Application Data\Mozilla\Firefox\Profiles\z9s4hcbv.default\extensions\moveplayer@movenetworks.com\platform\WINNT_x86-msvc\plugins\npmnqmp07076007.dll

FF - plugin: c:\progra~1\Yahoo!\Common\npyaxmpb.dll

FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPJava11.dll

FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPJava12.dll

FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPJava13.dll

FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPJava14.dll

FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPJava32.dll

FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPJPI150_11.dll

FF - plugin: c:\program files\Java\jre1.5.0_11\bin\NPOJI610.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\npbittorrent.dll

FF - plugin: c:\program files\Mozilla Firefox\plugins\NPTURNMED.dll

.

**************************************************************************

catchme 0.3.1375 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2009-04-06 17:32:27

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

HKLM\Software\Microsoft\Windows\CurrentVersion\Run

Dell|Alert = c:\program files\Dell\Support\Alert\bin\DAMon.exe?p?o?r?t?\?A?l?e?r?t?\?b?i?n?\?D?A?M?o?n?.?e?x?e???????????x:??p???x???P???X???????????P???P????(?w'(?w????????????(???{??????w????????????0????$?w7(?w?o?wS??w???w????????????X*@?????????X????????%@?e?????

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

--------------------- LOCKED REGISTRY KEYS ---------------------

[HKEY_USERS\S-1-5-21-1858025970-4264649163-3499916212-1006\Software\Microsoft\SystemCertificates\AddressBook*]

@Allowed: (Read) (RestrictedCode)

@Allowed: (Read) (RestrictedCode)

.

Completion time: 2009-04-06 17:41:08

ComboFix-quarantined-files.txt 2009-04-06 22:40:29

ComboFix2.txt 2009-04-06 07:30:39

Pre-Run: 45,305,552,896 bytes free

Post-Run: 45,297,307,648 bytes free

183 --- E O F --- 2008-12-16 09:49:18

Link to post
Share on other sites
  • Staff
miekiemoes

miekiemoes

Posted
  • Staff
Posted

Hi,

This looks OK again.

* Go to start > run and copy and paste next command in the field:

ComboFix /u

Make sure there's a space between Combofix and /

Then hit enter.

This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again.

Let me know in your next reply how things are now.

Link to post
Share on other sites
Ozmo

Ozmo

Posted
  • Author
Posted

Here are my latest Mbam and Hijackthis logs. They both look good to me but let me know what you think. I do have a couple questions about a few items in Hijackthis log. If you dont want to help with those its totally fine. You have done enough to help already.

What is this and do I need it? I'm assuming since it says no file that it doesnt do anything. Can I fix this in Hijack this?

O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)

I never use Camio Viewer so I can just delete IxApplet.exe in my taskmanager and then fix with Hijack this correct?

O4 - Global Startup: Camio Viewer.lnk = C:\Program Files\Dell Computer\Dell Image Expert\IXApplet.exe

This says file missing but I know I shouldnt mess with O23 items but since the file is missing does it do anything?

O23 - Service: Symantec RemoteAssist - Unknown owner - C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe (file missing)

Again you do not need to help with these if you dont want to.

Malwarebytes' Anti-Malware 1.36

Database version: 1946

Windows 5.1.2600 Service Pack 2

4/6/2009 10:25:54 PM

mbam-log-2009-04-06 (22-25-54).txt

Scan type: Quick Scan

Objects scanned: 77456

Time elapsed: 3 minute(s), 27 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 0

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 0

Files Infected: 0

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

(No malicious items detected)

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

(No malicious items detected)

Files Infected:

(No malicious items detected)

Logfile of HijackThis v1.99.1

Scan saved at 10:26:11 PM, on 4/6/2009

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16762)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe

C:\Program Files\Dell\Support\Alert\bin\DAMon.exe

C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\DNA\btdna.exe

C:\Program Files\Dell Computer\Dell Image Expert\IXApplet.exe

C:\Program Files\Common Files\Microsoft Shared\Works Shared\wkcalrem.exe

C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\system32\wscntfy.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll

O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - C:\Program Files\Microsoft Money\System\mnyviewer.dll

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"

O4 - HKLM\..\Run: [Dell|Alert] C:\Program Files\Dell\Support\Alert\bin\DAMon.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe

O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\Money Express.exe"

O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [bitTorrent DNA] "C:\Program Files\DNA\btdna.exe"

O4 - Global Startup: Camio Viewer.lnk = C:\Program Files\Dell Computer\Dell Image Expert\IXApplet.exe

O4 - Global Startup: Microsoft Works Calendar Reminders.lnk = ?

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll

O9 - Extra button: UltimateBet - {10F055B8-F443-4adf-948A-EC551E9DBCE4} - C:\Documents and Settings\Andrew Nitchals\Start Menu\Programs\UltimateBet\UltimateBet.lnk

O9 - Extra 'Tools' menuitem: UltimateBet - {10F055B8-F443-4adf-948A-EC551E9DBCE4} - C:\Documents and Settings\Andrew Nitchals\Start Menu\Programs\UltimateBet\UltimateBet.lnk

O9 - Extra button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files\PokerStars\PokerStarsUpdate.exe

O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll

O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0411.dll

O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe

O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll

O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyviewer.dll

O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - C:\Program Files\Bodog Poker\BPGame.exe

O9 - Extra button: Royal Vegas Poker - {FA4904B4-1FAF-4afd-886C-C19D2297BA62} - C:\Program Files\royalvegasMPP\MPPoker.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O11 - Options group: [iNTERNATIONAL] International*

O16 - DPF: Yahoo! Blackjack - http://download.games.yahoo.com/games/clients/y/jt0_x.cab

O16 - DPF: Yahoo! Cribbage - http://download.games.yahoo.com/games/clients/y/it1_x.cab

O16 - DPF: Yahoo! Graffiti - http://download.games.yahoo.com/games/clients/y/grt5_x.cab

O16 - DPF: Yahoo! Poker - http://download.games.yahoo.com/games/clients/y/pt1_x.cab

O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab

O16 - DPF: {2B323CD9-50E3-11D3-9466-00A0C9700498} (Yahoo! Audio Conferencing) - http://us.chat1.yimg.com/us.yimg.com/i/cha...v43/yacscom.cab

O16 - DPF: {30528230-99F7-4BB4-88D8-FA1D4F56A2AB} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://a1540.g.akamai.net/7/1540/52/200212...meInstaller.exe

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1204071334749

O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftu...b?1204071319530

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab

O16 - DPF: {7A32634B-029C-4836-A023-528983982A49} - http://fdl.msn.com/public/chat/msnchat42.cab

O16 - DPF: {7D1E9C49-BD6A-11D3-87A8-009027A35D73} (Yahoo! Audio UI1) - http://chat.yahoo.com/cab/yacsui.cab

O16 - DPF: {A17E30C4-A9BA-11D4-8673-60DB54C10000} (YahooYMailTo Class) - http://us.dl1.yimg.com/download.yahoo.com/...ymmapi_0727.dll

O16 - DPF: {EF99BD32-C1FB-11D2-892F-0090271D4F88} (Yahoo! Toolbar) - http://us.dl1.yimg.com/download.yahoo.com/...bio4_0_2_10.cab

O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab

O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe

O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: Symantec Core LC - Unknown owner - C:\PROGRA~1\COMMON~1\SYMANT~1\CCPD-LC\symlcsvc.exe

O23 - Service: Symantec RemoteAssist - Unknown owner - C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe (file missing)

Link to post
Share on other sites
  • Staff
miekiemoes

miekiemoes

Posted
  • Staff
Posted

Hi,

To answer your questions..

What is this and do I need it? I'm assuming since it says no file that it doesnt do anything. Can I fix this in Hijack this?

O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - (no file)

Yes, you can fix that one, it's an orphaned leftover related with Symantec Intrusion Prevention.
I never use Camio Viewer so I can just delete IxApplet.exe in my taskmanager and then fix with Hijack this correct?
If you never use it, then I rather suggest to uninstall it. If you only use it once in a while, then, yes, fix in HijackThis
This says file missing but I know I shouldnt mess with O23 items but since the file is missing does it do anything?

O23 - Service: Symantec RemoteAssist - Unknown owner - C:\Program Files\Common Files\Symantec Shared\Support Controls\ssrc.exe (file missing)

It's a leftover as well. To delete it, go to start > run and copy and paste next command in the field:

sc delete "Symantec RemoteAssist"

Hit enter

Extra note, please install an Antivirus, because you really need one to prevent further infection.

* Please install Avira Antivirus: http://www.free-av.com/

Perform a full scan with Avira and let it delete everything it is finding.

Then reboot.

After reboot, open your Avira and select "reports".

There doubleclick the report from the Full scan you have done. Click the "Report File" button and copy and paste this report in your next reply.

Link to post
Share on other sites
Ozmo

Ozmo

Posted
  • Author
Posted

Thank you so much for your help. It seems my computer is completely clean at the moment and I was even able to clean up some things that were not really a problem. I know I need a new antivirus program. I had been running Norton Internet Security but wasnt happy with its performance so I allowed the subscription to lapse and I removed it a few weeks ago. My main problem with Norton was that it used so much memory my computer slowed way down. What effect will Avira have? Are there any other options or is this the one you recommend over any others?

Link to post
Share on other sites
  • Staff
miekiemoes

miekiemoes

Posted
  • Staff
Posted

Hi,

The reason why I recommend Avira is because it isn't such a resource hog, it's great in detection and it's free.

If you purchase the premium version (which is cheap btw), then it has more options either. See the link I gave you to compare with free and premium.

Ofcourse there are also other Antivirus to choose from. See my link here: http://users.telenet.be/bluepatchy/miekiemoes/Links.html

Link to post
Share on other sites
Ozmo

Ozmo

Posted
  • Author
Posted

Here is my Avira scan log. It detected a lot more than I was expecting unfortunately. It looks like most of the things were taken care of but not all. Let me know what you think.

Avira AntiVir Personal

Report file date: Tuesday, April 07, 2009 15:36

Scanning for 1343465 virus strains and unwanted programs.

Licensee : Avira AntiVir Personal - FREE Antivirus

Serial number : 0000149996-ADJIE-0000001

Platform : Windows XP

Windows version : (Service Pack 2) [5.1.2600]

Boot mode : Normally booted

Username : SYSTEM

Computer name : ANDREW

Version information:

BUILD.DAT : 9.0.0.387 17962 Bytes 3/24/2009 11:04:00

AVSCAN.EXE : 9.0.3.3 464641 Bytes 2/24/2009 17:13:26

AVSCAN.DLL : 9.0.3.0 40705 Bytes 2/27/2009 15:58:24

LUKE.DLL : 9.0.3.2 209665 Bytes 2/20/2009 16:35:49

LUKERES.DLL : 9.0.2.0 12033 Bytes 2/27/2009 15:58:52

ANTIVIR0.VDF : 7.1.0.0 15603712 Bytes 10/27/2008 17:30:36

ANTIVIR1.VDF : 7.1.2.12 3336192 Bytes 2/11/2009 01:33:26

ANTIVIR2.VDF : 7.1.3.0 1330176 Bytes 4/1/2009 10:39:34

ANTIVIR3.VDF : 7.1.3.27 117760 Bytes 4/7/2009 20:35:37

Engineversion : 8.2.0.138

AEVDF.DLL : 8.1.1.0 106868 Bytes 1/27/2009 22:36:42

AESCRIPT.DLL : 8.1.1.73 373114 Bytes 4/7/2009 10:40:03

AESCN.DLL : 8.1.1.10 127348 Bytes 4/7/2009 10:40:02

AERDL.DLL : 8.1.1.3 438645 Bytes 10/29/2008 23:24:41

AEPACK.DLL : 8.1.3.12 397687 Bytes 4/7/2009 10:40:01

AEOFFICE.DLL : 8.1.0.36 196987 Bytes 2/27/2009 01:01:56

AEHEUR.DLL : 8.1.0.114 1700214 Bytes 4/7/2009 10:39:55

AEHELP.DLL : 8.1.2.2 119158 Bytes 2/27/2009 01:01:56

AEGEN.DLL : 8.1.1.33 340340 Bytes 4/7/2009 10:39:43

AEEMU.DLL : 8.1.0.9 393588 Bytes 10/9/2008 19:32:40

AECORE.DLL : 8.1.6.7 176502 Bytes 4/7/2009 10:39:42

AEBB.DLL : 8.1.0.3 53618 Bytes 10/9/2008 19:32:40

AVWINLL.DLL : 9.0.0.3 18177 Bytes 12/12/2008 13:47:59

AVPREF.DLL : 9.0.0.1 43777 Bytes 12/5/2008 15:32:15

AVREP.DLL : 8.0.0.3 155905 Bytes 1/20/2009 19:34:28

AVREG.DLL : 9.0.0.0 36609 Bytes 12/5/2008 15:32:09

AVARKT.DLL : 9.0.0.1 292609 Bytes 2/9/2009 12:52:24

AVEVTLOG.DLL : 9.0.0.7 167169 Bytes 1/30/2009 15:37:08

SQLITE3.DLL : 3.6.1.0 326401 Bytes 1/28/2009 20:03:49

SMTPLIB.DLL : 9.2.0.25 28417 Bytes 2/2/2009 13:21:33

NETNT.DLL : 9.0.0.0 11521 Bytes 12/5/2008 15:32:10

RCIMAGE.DLL : 9.0.0.21 2438401 Bytes 2/9/2009 16:45:45

RCTEXT.DLL : 9.0.35.0 87297 Bytes 3/11/2009 20:55:12

Configuration settings for the scan:

Jobname.............................: Complete system scan

Configuration file..................: c:\program files\avira\antivir desktop\sysscan.avp

Logging.............................: low

Primary action......................: interactive

Secondary action....................: ignore

Scan master boot sector.............: on

Scan boot sector....................: on

Boot sectors........................: C:,

Process scan........................: on

Scan registry.......................: on

Search for rootkits.................: on

Integrity checking of system files..: off

Scan all files......................: All files

Scan archives.......................: on

Recursion depth.....................: 20

Smart extensions....................: on

Macro heuristic.....................: on

File heuristic......................: medium

Start of the scan: Tuesday, April 07, 2009 15:36

Starting search for hidden objects.

'37766' objects were checked, '0' hidden objects were found.

The scan of running processes will be started

Scan process 'avscan.exe' - '1' Module(s) have been scanned

Scan process 'avcenter.exe' - '1' Module(s) have been scanned

Scan process 'wuauclt.exe' - '1' Module(s) have been scanned

Scan process 'wscntfy.exe' - '1' Module(s) have been scanned

Scan process 'wuauclt.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'alg.exe' - '1' Module(s) have been scanned

Scan process 'wdfmgr.exe' - '1' Module(s) have been scanned

Scan process 'nvsvc32.exe' - '1' Module(s) have been scanned

Scan process 'avguard.exe' - '1' Module(s) have been scanned

Scan process 'Ymsgr_tray.exe' - '1' Module(s) have been scanned

Scan process 'WkCalRem.exe' - '1' Module(s) have been scanned

Scan process 'btdna.exe' - '1' Module(s) have been scanned

Scan process 'ctfmon.exe' - '1' Module(s) have been scanned

Scan process 'avgnt.exe' - '1' Module(s) have been scanned

Scan process 'jusched.exe' - '1' Module(s) have been scanned

Scan process 'DAMon.exe' - '1' Module(s) have been scanned

Scan process 'Directcd.exe' - '1' Module(s) have been scanned

Scan process 'sched.exe' - '1' Module(s) have been scanned

Scan process 'spoolsv.exe' - '1' Module(s) have been scanned

Scan process 'explorer.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'svchost.exe' - '1' Module(s) have been scanned

Scan process 'lsass.exe' - '1' Module(s) have been scanned

Scan process 'services.exe' - '1' Module(s) have been scanned

Scan process 'winlogon.exe' - '1' Module(s) have been scanned

Scan process 'csrss.exe' - '1' Module(s) have been scanned

Scan process 'smss.exe' - '1' Module(s) have been scanned

31 processes with 31 modules were scanned

Starting master boot sector scan:

Start scanning boot sectors:

Starting to scan executable files (registry).

The registry was scanned ( '70' files ).

Starting the file scan:

Begin scan in 'C:\' <Local Disk>

C:\hiberfil.sys

[WARNING] The file could not be opened!

[NOTE] This file is a Windows system file.

[NOTE] This file cannot be opened for scanning.

C:\pagefile.sys

[WARNING] The file could not be opened!

[NOTE] This file is a Windows system file.

[NOTE] This file cannot be opened for scanning.

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\32ntntsy32.exe.bac_a00180

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\32ntntsy32.exe.bac_a00180

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\32orPE64.exe.bac_a00180

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\32orPE64.exe.bac_a00180

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\32SPSP64.exe.bac_a00180

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\32SPSP64.exe.bac_a00180

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\32sysy32sy.exe.bac_a00180

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\32sysy32sy.exe.bac_a00180

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\4oPlfyhw.dll.bac_a00180

[DETECTION] Is the TR/Crypt.ULPM.Gen Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\64PE32.exe.bac_a00180

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\64PE32.exe.bac_a00180

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\64syhh.exe.bac_a00180

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\64syhh.exe.bac_a00180

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112830.exe.bac_a00660

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112830.exe.bac_a00660

[DETECTION] Contains recognition pattern of the ADSPY/WebSearch.BF.4 adware or spyware

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112831.dll.bac_a00660

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112831.dll.bac_a00660

[DETECTION] Contains recognition pattern of the ADSPY/WebSearch.BF adware or spyware

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112832.exe.bac_a00660

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112832.exe.bac_a00660

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112833.exe.bac_a00660

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112833.exe.bac_a00660

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112834.exe.bac_a00660

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112834.exe.bac_a00660

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112835.exe.bac_a00660

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112835.exe.bac_a00660

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112836.exe.bac_a00660

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112836.exe.bac_a00660

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112837.exe.bac_a00660

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112837.exe.bac_a00660

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112838.exe.bac_a00660

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112838.exe.bac_a00660

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112839.exe.bac_a00660

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112839.exe.bac_a00660

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112840.dll.bac_a00660

[DETECTION] Is the TR/Crypt.ULPM.Gen Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112841.exe.bac_a00660

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112841.exe.bac_a00660

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112842.exe.bac_a00660

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112842.exe.bac_a00660

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112843.exe.bac_a00660

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112843.exe.bac_a00660

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112844.dll.bac_a00660

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112844.dll.bac_a00660

--> Object

[2] Archive type: OVL

--> Object

[DETECTION] Is the TR/Stomcc.4 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112845.exe.bac_a00660

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112845.exe.bac_a00660

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112846.exe.bac_a00660

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112846.exe.bac_a00660

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112847.exe.bac_a00660

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112847.exe.bac_a00660

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112848.exe.bac_a00660

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112848.exe.bac_a00660

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112849.exe.bac_a00660

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112849.exe.bac_a00660

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112850.exe.bac_a00660

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112850.exe.bac_a00660

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112851.exe.bac_a00660

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112851.exe.bac_a00660

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112852.exe.bac_a00660

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112852.exe.bac_a00660

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112853.exe.bac_a00660

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112853.exe.bac_a00660

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112854.exe.bac_a00660

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112854.exe.bac_a00660

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112855.exe.bac_a00660

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112855.exe.bac_a00660

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112856.exe.bac_a00660

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112856.exe.bac_a00660

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112857.exe.bac_a00660

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112857.exe.bac_a00660

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112858.exe.bac_a00660

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112858.exe.bac_a00660

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0120440.exe.bac_a01784

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0120440.exe.bac_a01784

[DETECTION] Is the TR/Dldr.PurityScan.EG.30 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\backup-20051026-204450-918.dll.bac_a00180

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\backup-20051026-204450-918.dll.bac_a00180

[DETECTION] Contains recognition pattern of the ADSPY/WebSearch.BF adware or spyware

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\bH.dll.bac_a00180

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\bH.dll.bac_a00180

--> Object

[2] Archive type: OVL

--> Object

[DETECTION] Is the TR/Stomcc.4 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\camplugin.exe.bac_a00180

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\camplugin.exe.bac_a00180

[DETECTION] Contains recognition pattern of the ADSPY/WebSearch.BF.4 adware or spyware

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\D18F.tmp.bac_a01784

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\D18F.tmp.bac_a01784

[DETECTION] Contains recognition pattern of the DR/Dldr.PurityScan.EG.82 dropper

--> [unknownShellDir]/Yazzle1552OinAdmin.exe

[DETECTION] Is the TR/Dldr.PurityScan.EG.30 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\hhPEoror.exe.bac_a00180

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\hhPEoror.exe.bac_a00180

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\hhsyPEorsy.exe.bac_a00180

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\hhsyPEorsy.exe.bac_a00180

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\hhsySP.exe.bac_a00180

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\hhsySP.exe.bac_a00180

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\msnthhPEs-.exe.bac_a00180

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\msnthhPEs-.exe.bac_a00180

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\msnts-.exe.bac_a00180

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\msnts-.exe.bac_a00180

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\msPEmssy.exe.bac_a00180

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\msPEmssy.exe.bac_a00180

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\msSP.exe.bac_a00180

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\msSP.exe.bac_a00180

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\ntor32sy.exe.bac_a00180

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\ntor32sy.exe.bac_a00180

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\ntsynt32.exe.bac_a00180

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\ntsynt32.exe.bac_a00180

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\or6432sy.exe.bac_a00180

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\or6432sy.exe.bac_a00180

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\PE64.exe.bac_a00180

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\PE64.exe.bac_a00180

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\PEorsySP.exe.bac_a00180

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\PEorsySP.exe.bac_a00180

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\PEs-SPnt.exe.bac_a00180

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\PEs-SPnt.exe.bac_a00180

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\pscanw.exe.bac_a00180

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\pscanw.exe.bac_a00180

[DETECTION] Contains recognition pattern of the DR/PurityScan.W dropper

--> [TempDir]/wups.exe

[DETECTION] Contains recognition pattern of the ADSPY/PurityScan.W.31 adware or spyware

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\ptf_0002.exe.bac_a01784

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\ptf_0002.exe.bac_a01784

[DETECTION] Contains recognition pattern of the ADSPY/Pacer.D adware or spyware

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\rpswrzfn.exe.bac_a00180

[DETECTION] Is the TR/Crypt.ULPM.Gen Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\s-hhorSP.exe.bac_a00180

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\s-hhorSP.exe.bac_a00180

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\s-s-SPPE.exe.bac_a00180

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\s-s-SPPE.exe.bac_a00180

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\s-sysysy.exe.bac_a00180

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\s-sysysy.exe.bac_a00180

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\SP32ors-.exe.bac_a00180

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\SP32ors-.exe.bac_a00180

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\SPhhsy.exe.bac_a00180

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\SPhhsy.exe.bac_a00180

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\syhhhhsy.exe.bac_a00180

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\syhhhhsy.exe.bac_a00180

[DETECTION] Is the TR/Dldr.Small.EE.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\temp.frFCFB.bac_a00180

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\temp.frFCFB.bac_a00180

[DETECTION] Is the TR/MultiDrop.DR.1 Trojan

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\wmplayer.exe.tmp.bac_a00660

[0] Archive type: HIDDEN

--> FIL\\\?\C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\wmplayer.exe.tmp.bac_a00660

[DETECTION] Is the TR/Drop.Small.BR.2 Trojan

C:\Documents and Settings\Andrew Nitchals\Application Data\HouseCall 6.6\Backup\A0121174.exe.bac_a02356

[DETECTION] Is the TR/Downloader.Gen Trojan

C:\Program Files\HijackThis\backups\backup-20051026-210453-994.inf

[DETECTION] Contains recognition pattern of the ADSPY/Redhotnetwo adware or spyware

C:\Program Files\Yahoo!\Messenger\Profiles\call_me_j_2003\Archive\Messages\candy_shop_gurl353\20070315-call_me_j_2003.dat

[0] Archive type: MacBinary

--> E.info

[WARNING] The file could not be read!

[WARNING] The file could not be read!

C:\WINDOWS\backup\S\50315000.DAT

[DETECTION] Contains recognition pattern of the ADSPY/F1Organizer.h adware or spyware

C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\CMZ3G8RD\164[1].exe

[DETECTION] Is the TR/Dropper.Gen Trojan

C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.bak

[DETECTION] Is the TR/AntiHosts.Gen Trojan

Beginning disinfection:

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\32ntntsy32.exe.bac_a00180

[NOTE] The file was moved to '4a49c9a8.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\32orPE64.exe.bac_a00180

[NOTE] The file was moved to '4a4ac9a8.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\32SPSP64.exe.bac_a00180

[NOTE] The file was moved to '4a2ec9a8.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\32sysy32sy.exe.bac_a00180

[NOTE] The file was moved to '4a4ec9a8.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\4oPlfyhw.dll.bac_a00180

[DETECTION] Is the TR/Crypt.ULPM.Gen Trojan

[NOTE] The file was moved to '4a2bc9e5.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\64PE32.exe.bac_a00180

[NOTE] The file was moved to '4a2bc9aa.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\64syhh.exe.bac_a00180

[NOTE] The file was moved to '4a4ec9aa.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112830.exe.bac_a00660

[NOTE] The file was moved to '4a0cc9a7.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112831.dll.bac_a00660

[NOTE] The file was moved to '4e33d120.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112832.exe.bac_a00660

[NOTE] The file was moved to '4fe5dfd8.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112833.exe.bac_a00660

[NOTE] The file was moved to '4fe6d790.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112834.exe.bac_a00660

[NOTE] The file was moved to '4fe7efa8.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112835.exe.bac_a00660

[NOTE] The file was moved to '4fe0e460.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112836.exe.bac_a00660

[NOTE] The file was moved to '4fe1fc38.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112837.exe.bac_a00660

[NOTE] The file was moved to '4fe2f4f0.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112838.exe.bac_a00660

[NOTE] The file was moved to '4fe38c88.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112839.exe.bac_a00660

[NOTE] The file was moved to '4ffc8540.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112840.dll.bac_a00660

[DETECTION] Is the TR/Crypt.ULPM.Gen Trojan

[NOTE] The file was moved to '4ffd9d18.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112841.exe.bac_a00660

[NOTE] The file was moved to '4a0cc9a8.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112842.exe.bac_a00660

[NOTE] The file was moved to '4fffade9.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112843.exe.bac_a00660

[NOTE] The file was moved to '4ff8a5a1.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112844.dll.bac_a00660

[NOTE] The file was moved to '4ff9ba79.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112845.exe.bac_a00660

[NOTE] The file was moved to '4e3a13e1.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112846.exe.bac_a00660

[NOTE] The file was moved to '4ffab231.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112847.exe.bac_a00660

[NOTE] The file was moved to '4ff44281.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112848.exe.bac_a00660

[NOTE] The file was moved to '4ff55b59.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112849.exe.bac_a00660

[NOTE] The file was moved to '4ff65311.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112850.exe.bac_a00660

[NOTE] The file was moved to '4ff76b29.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112851.exe.bac_a00660

[NOTE] The file was moved to '4ff063e1.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112852.exe.bac_a00660

[NOTE] The file was moved to '4ff17bb9.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112853.exe.bac_a00660

[NOTE] The file was moved to '4ff27071.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112854.exe.bac_a00660

[NOTE] The file was moved to '4ff30809.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112855.exe.bac_a00660

[NOTE] The file was moved to '4c0c00c1.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112856.exe.bac_a00660

[NOTE] The file was moved to '4c0d1899.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112857.exe.bac_a00660

[NOTE] The file was moved to '4c0e1151.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0112858.exe.bac_a00660

[NOTE] The file was moved to '4c0f2969.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\A0120440.exe.bac_a01784

[NOTE] The file was moved to '4c082121.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\backup-20051026-204450-918.dll.bac_a00180

[NOTE] The file was moved to '4a3ec9d9.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\bH.dll.bac_a00180

[NOTE] The file was moved to '4a09c9c0.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\camplugin.exe.bac_a00180

[NOTE] The file was moved to '4a48c9da.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\D18F.tmp.bac_a01784

[NOTE] The file was moved to '4a13c9aa.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\hhPEoror.exe.bac_a00180

[NOTE] The file was moved to '4a2bc9e1.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\hhsyPEorsy.exe.bac_a00180

[NOTE] The file was moved to '4a4ec9e1.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\hhsySP.exe.bac_a00180

[NOTE] The file was moved to '4c42edf2.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\msnthhPEs-.exe.bac_a00180

[NOTE] The file was moved to '4a49c9ec.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\msnts-.exe.bac_a00180

[NOTE] The file was moved to '4c47f42d.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\msPEmssy.exe.bac_a00180

[NOTE] The file was moved to '4a2bc9ec.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\msSP.exe.bac_a00180

[NOTE] The file was moved to '4a2ec9ec.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\ntor32sy.exe.bac_a00180

[NOTE] The file was moved to '4a4ac9ed.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\ntsynt32.exe.bac_a00180

[NOTE] The file was moved to '4a4ec9ed.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\or6432sy.exe.bac_a00180

[NOTE] The file was moved to '4a11c9eb.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\PE64.exe.bac_a00180

[NOTE] The file was moved to '4a11c9be.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\PEorsySP.exe.bac_a00180

[NOTE] The file was moved to '4a4ac9be.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\PEs-SPnt.exe.bac_a00180

[NOTE] The file was moved to '4a4ec9be.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\pscanw.exe.bac_a00180

[NOTE] The file was moved to '4a3ec9ec.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\ptf_0002.exe.bac_a01784

[NOTE] The file was moved to '4a41c9ed.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\rpswrzfn.exe.bac_a00180

[DETECTION] Is the TR/Crypt.ULPM.Gen Trojan

[NOTE] The file was moved to '4a4ec9e9.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\s-hhorSP.exe.bac_a00180

[NOTE] The file was moved to '4a43c9a6.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\s-s-SPPE.exe.bac_a00180

[NOTE] The file was moved to '4a4ec9a6.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\s-sysysy.exe.bac_a00180

[NOTE] The file was moved to '4c520787.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\SP32ors-.exe.bac_a00180

[NOTE] The file was moved to '4a0ec9c9.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\SPhhsy.exe.bac_a00180

[NOTE] The file was moved to '4a43c9c9.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\syhhhhsy.exe.bac_a00180

[NOTE] The file was moved to '4a43c9f2.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\temp.frFCFB.bac_a00180

[NOTE] The file was moved to '4a48c9df.qua'!

C:\Documents and Settings\Andrew Nitchals\.housecall6.6\Quarantine\wmplayer.exe.tmp.bac_a00660

[NOTE] The file was moved to '4a4bc9e7.qua'!

C:\Documents and Settings\Andrew Nitchals\Application Data\HouseCall 6.6\Backup\A0121174.exe.bac_a02356

[DETECTION] Is the TR/Downloader.Gen Trojan

[NOTE] The file was moved to '4a0cc9aa.qua'!

C:\Program Files\HijackThis\backups\backup-20051026-210453-994.inf

[DETECTION] Contains recognition pattern of the ADSPY/Redhotnetwo adware or spyware

[NOTE] The file was moved to '4a3ec9db.qua'!

C:\WINDOWS\backup\S\50315000.DAT

[DETECTION] Contains recognition pattern of the ADSPY/F1Organizer.h adware or spyware

[NOTE] The file was moved to '4a0ec9aa.qua'!

C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Local Settings\Temporary Internet Files\Content.IE5\CMZ3G8RD\164[1].exe

[DETECTION] Is the TR/Dropper.Gen Trojan

[NOTE] The file was moved to '4a0fc9b1.qua'!

C:\WINDOWS\SYSTEM32\DRIVERS\ETC\hosts.bak

[DETECTION] Is the TR/AntiHosts.Gen Trojan

[NOTE] The file was moved to '4a4ec9ea.qua'!

End of the scan: Tuesday, April 07, 2009 16:45

Used time: 1:03:17 Hour(s)

The scan has been done completely.

19194 Scanned directories

231514 Files were scanned

72 Viruses and/or unwanted programs were found

0 Files were classified as suspicious

0 files were deleted

0 Viruses and unwanted programs were repaired

70 Files were moved to quarantine

0 Files were renamed

2 Files cannot be scanned

231440 Files not concerned

6254 Archives were scanned

4 Warnings

72 Notes

37766 Objects were scanned with rootkit scan

0 Hidden objects were found

Link to post
Share on other sites
  • Staff
miekiemoes

miekiemoes

Posted
  • Staff
Posted

Hi,

There's really nothing to worry about. What Avira found were files that were already quarantined by Trendmicro's online scan (Housecall) and some other small leftovers that won't do anything anyway. :o

I hope you understand now why an Antivirus is so important? It may already prevent a lot! So please do not uninstall it again as you did with AVG.

Also,

Please read my Prevention page with lots of info and tips how to prevent this in the future.

And if you want to improve speed/system performance after malware removal, take a look here.

Extra note: Make sure your programs are up to date - because older versions may contain Security Leaks. To find out what programs need to be updated, please run the Secunia Software Inspector Scan.

Happy Surfing again!

Link to post
Share on other sites
Ozmo

Ozmo

Posted
  • Author
Posted

Yeah after posting I went through the log and noticed it was pretty much all stuff Housecall had quarantined so that really was nothing to worry about. This one seems strange to me though. You say there is no problem with it?

C:\Program Files\Yahoo!\Messenger\Profiles\call_me_j_2003\Archive\Messages\candy_shop_gurl353\20070315-call_me_j_2003.dat

[0] Archive type: MacBinary

--> E.info

[WARNING] The file could not be read!

I do understand the importance of antivirus software. As I said before I had been using Norton Internet Security but didn't like the performance. The AVG I tried to use while I still had some infections and it just wouldnt work right so I got rid of it. I havent done much surfing yet since I got Avira but so far it seems to be working great so I will be keeping it. I'll also check out the other links you provided.

Link to post
Share on other sites
  • Staff
miekiemoes

miekiemoes

Posted
  • Staff
Posted

Since this issue appears resolved ... this Topic is closed.

If you need this topic reopened for continuations of existing problems, please request this by sending me a PM with the address of the thread. This applies only to the original topic starter.

Everyone else please begin a New Topic.

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.