Jump to content

pcprivacytool.com popup

ccarbo

By ccarbo
in Resolved Malware Removal Logs

 Share

Recommended Posts

ccarbo

ccarbo

Posted
Posted

i ran AVG anti spyware, superantispyware, combofix, now HJT. the first 2 say clean, combo fixed some. Here is the combo fix and HJT results. I also added a attachment from Panda active scan. I can't shake this one, I am pretty good but this one has me. Please help!!

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 10:46:56 PM, on 10/4/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\WINDOWS\System32\GEARSec.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe

C:\WINDOWS\system32\svchost.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

C:\Program Files\Viewpoint\Common\ViewpointService.exe

C:\WINDOWS\System32\alertic.exe

C:\WINDOWS\Explorer.EXE

C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\PccGuide.exe

C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe

C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\system32\hkcmd.exe

C:\Program Files\Dell\Media Experience\DMXLauncher.exe

C:\WINDOWS\System32\DLA\DLACTRLW.EXE

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\DellSupport\DSAgnt.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\system32\dlcccoms.exe

C:\Program Files\Digital Line Detect\DLG.exe

C:\Program Files\Sierra\Planner\Plnrnote.exe

C:\Program Files\MSN Messenger\usnsvc.exe

C:\WINDOWS\system32\msiexec.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll

O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [DLCCCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll,_RunDLLEntry@16

O4 - HKLM\..\Run: [dlccmon.exe] "C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe"

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide

O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe"

O4 - HKLM\..\Run: [Norton Ghost 10.0] "C:\Program Files\Norton Ghost\Agent\GhostTray.exe"

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [iSUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup

O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe

O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"

O4 - HKCU\..\Run: [OE_OEM] "C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe"

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')

O4 - Global Startup: Digital Line Detect.lnk = ?

O4 - Global Startup: Event Planner Reminders Tray Icon.lnk = ?

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://melmm2012.spaces.live.com/PhotoUplo....cab?10,0,912,0

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab

O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

O23 - Service: dlcc_device - - C:\WINDOWS\system32\dlcccoms.exe

O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe

O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Intel NCS NetService (NetSvc) - Intel

Activescan.txt

Activescan.txt

Link to post
Share on other sites
__RiP_ChAiN_

__RiP_ChAiN_

Posted
Posted

Hello ccarbo,

Using Add Or Remove Programs remove the following entries (if present): (To get into add Or Remove Programs press the START button > Control Panel > Add Or Remove Programs.)

ViewPoint

1. Please open Notepad

  • Click Start , then Run
  • Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

File::

C:\WINDOWS\System32\alertic.exe

C:\Documents and Settings\All Users\Application Data\SecTaskMan\WinAvXX.exe.q_8041E00_q

C:\Documents and Settings\megan mueller\Cookies\megan_mueller@atdmt[2].txt

C:\Documents and Settings\megan mueller\Cookies\megan_mueller@doubleclick[1].txt

C:\RECYCLER\S-1-5-21-1813478142-433029708-2422734990-500\Dc1.exe

C:\RECYCLER\S-1-5-21-1813478142-433029708-2422734990-500\Dc2.exe

C:\RECYCLER\S-1-5-21-1813478142-433029708-2422734990-500\Dc3.exe

C:\RECYCLER\S-1-5-21-1813478142-433029708-2422734990-500\Dc4.exe

Driver::

Winalert

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

CFScript.gif

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

  • Combofix.txt
  • A new HijackThis log.
Link to post
Share on other sites
ccarbo

ccarbo

Posted
  • Author
Posted

Kev, I have attached the Combofix and HJT logs. thanks for the help!!

Hello ccarbo,

Using Add Or Remove Programs remove the following entries (if present): (To get into add Or Remove Programs press the START button > Control Panel > Add Or Remove Programs.)

ViewPoint

1. Please open Notepad

  • Click Start , then Run
  • Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

3. Save the above as CFScript.txt

4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

CFScript.gif

5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:

  • Combofix.txt
  • A new HijackThis log.

combofix.txt

hijackthis.txt

combofix.txt

hijackthis.txt

Link to post
Share on other sites
ccarbo

ccarbo

Posted
  • Author
Posted

Ok sorry, hey if there 4 people that log into this machine do I have to run these fixes against each login or just one? (that has admin privledges). Do you want me to repost the correct way?

Pease don't post them as attachments, whenever somebody else opens them they look all jumbled and are very difficult to read. Please simply paste them in your next reply.
Link to post
Share on other sites
ccarbo

ccarbo

Posted
  • Author
Posted

Ouch, that sucks. Hey, one good thing is that I have had it running now and NO popups. I logged into another user and no popus either! that is a good sign! thanks. Let me know what to do next.

Unfortunately, each user account will have to be cleaned out seperately, but we'll strat with this ucrrent one and work our way down from there. Please do re-post the logs in a reply to this topic.
Link to post
Share on other sites
ccarbo

ccarbo

Posted
  • Author
Posted

Here is the Combofix log. sorry about that. clint

ComboFix 07-10-04.5 - megan mueller 2007-10-05 11:13:15.2 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.404 [GMT -5:00]

Running from: C:\temp\ComboFix.exe

Command switches used :: C:\temp\CFScript.txt

FILE::

C:\Documents and Settings\All Users\Application Data\SecTaskMan\WinAvXX.exe.q_8041E00_q

C:\Documents and Settings\megan mueller\Cookies\megan_mueller@atdmt[2].txt

C:\Documents and Settings\megan mueller\Cookies\megan_mueller@doubleclick[1].txt

C:\RECYCLER\S-1-5-21-1813478142-433029708-2422734990-500\Dc1.exe

C:\RECYCLER\S-1-5-21-1813478142-433029708-2422734990-500\Dc2.exe

C:\RECYCLER\S-1-5-21-1813478142-433029708-2422734990-500\Dc3.exe

C:\RECYCLER\S-1-5-21-1813478142-433029708-2422734990-500\Dc4.exe

C:\WINDOWS\System32\alertic.exe

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Documents and Settings\All Users\Application Data\SecTaskMan\WinAvXX.exe.q_8041E00_q

C:\Documents and Settings\megan mueller\Cookies\megan_mueller@atdmt[2].txt

C:\RECYCLER\S-1-5-21-1813478142-433029708-2422734990-500\Dc1.exe

C:\RECYCLER\S-1-5-21-1813478142-433029708-2422734990-500\Dc2.exe

C:\RECYCLER\S-1-5-21-1813478142-433029708-2422734990-500\Dc3.exe

C:\RECYCLER\S-1-5-21-1813478142-433029708-2422734990-500\Dc4.exe

C:\WINDOWS\System32\alertic.exe

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

-------\LEGACY_WINALERT

-------\Winalert

((((((((((((((((((((((((( Files Created from 2007-09-05 to 2007-10-05 )))))))))))))))))))))))))))))))

.

2007-10-05 11:12 1,471,257 --a------ C:\temp\ComboFix.exe

2007-10-05 09:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

2007-10-05 09:28 <DIR> d-------- C:\temp\Qoofix

2007-10-04 22:58 <DIR> d-------- C:\WINDOWS\system32\ActiveScan

2007-10-04 22:08 <DIR> d-------- C:\Program Files\Enigma Software Group

2007-10-04 21:56 51,200 --a------ C:\WINDOWS\NirCmd.exe

2007-10-04 20:59 <DIR> d-------- C:\Documents and Settings\karen kropp-mueller\Application Data\SUPERAntiSpyware.com

2007-10-04 14:12 <DIR> d-------- C:\Program Files\SUPERAntiSpyware

2007-10-04 14:12 <DIR> d-------- C:\Documents and Settings\megan mueller\Application Data\SUPERAntiSpyware.com

2007-10-04 14:12 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com

2007-10-04 11:14 <DIR> d-------- C:\Program Files\CCleaner

2007-10-04 11:12 <DIR> d-------- C:\Program Files\RogueRemover FREE

2007-10-04 09:25 <DIR> d-------- C:\temp\SmitfraudFix

2007-10-04 09:19 812,344 --a------ C:\temp\HJTInstall.exe

2007-10-04 09:19 686,608 --a------ C:\temp\rr-free-setup.exe

2007-10-04 09:19 383,836 --a------ C:\temp\smitRem.exe

2007-10-04 09:19 3,988,032 --a------ C:\temp\Free-SpyHunter-Scanner-Install.exe

2007-10-04 09:19 2,628,296 --a------ C:\temp\ccsetup201.exe

2007-10-04 09:19 1,034,347 --a------ C:\temp\SmitfraudFix.exe

2007-10-04 09:14 2,574 --a------ C:\WINDOWS\system32\tmp.reg

2007-10-04 09:11 <DIR> d-------- C:\Program Files\Trend Micro

2007-10-03 17:18 <DIR> d-------- C:\temp

2007-10-03 15:56 <DIR> d-------- C:\Program Files\Windows Defender

2007-10-03 15:31 <DIR> d-------- C:\Documents and Settings\jeff mueller\Application Data\MSNInstaller

2007-10-03 15:19 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Help

2007-10-03 14:07 <DIR> d-------- C:\WINDOWS\BDOSCAN8

2007-10-03 13:58 94,480 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys

2007-10-03 13:56 <DIR> d-------- C:\Documents and Settings\jeff mueller\Application Data\HouseCall 6.6

2007-10-03 13:04 <DIR> d-------- C:\Program Files\SDU

2007-10-03 12:53 <DIR> d-------- C:\Program Files\Common Files\PC Tools

2007-10-03 12:20 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SecTaskMan

2007-10-03 01:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft

2007-10-03 01:05 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard

2007-10-03 00:55 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP

2007-10-03 00:54 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll

2007-10-02 23:31 <DIR> d-------- C:\Program Files\a-squared Free

2007-10-02 21:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys

2007-10-02 20:47 21,504 --a------ C:\WINDOWS\system32\hidserv.dll

2007-10-02 20:47 21,504 --a------ C:\WINDOWS\system32\dllcache\hidserv.dll

2007-09-29 23:34 <DIR> d-------- C:\Documents and Settings\megan mueller\Application Data\systemerrorfixer

2007-09-29 09:55 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll

2007-09-28 20:15 <DIR> dr------- C:\Documents and Settings\All Users\Application Data\systemerrorfixer

2007-09-28 18:08 664 --a------ C:\WINDOWS\system32\d3d9caps.dat

2007-09-26 20:12 <DIR> d-------- C:\WINDOWS\system32\spool

2007-09-26 19:59 <DIR> d-------- C:\Program Files\Dell Photo AIO Printer 924

2007-09-26 19:59 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Symantec

2007-09-20 22:48 <DIR> d-------- C:\Documents and Settings\jeff mueller\Application Data\Help

2007-09-19 20:50 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Help

2007-09-19 11:17 <DIR> d-------- C:\Documents and Settings\jeff mueller\Application Data\Leadertech

2007-09-14 19:20 <DIR> d-------- C:\WINDOWS\pss

2007-09-14 19:20 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Citrix

2007-09-14 19:19 60,968 --a------ C:\Documents and Settings\jeff mueller\GoToAssistDownloadHelper.exe

2007-09-07 18:33 <DIR> d-------- C:\Documents and Settings\karen kropp-mueller\Contacts

2007-09-07 16:55 <DIR> d-------- C:\Documents and Settings\karen kropp-mueller\Application Data\Corel Photo Album

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2007-10-05 11:16 --------- d-------- C:\Program Files\Viewpoint

2007-10-05 11:08 --------- d-------- C:\Documents and Settings\All Users\Application Data\Viewpoint

2007-10-05 10:13 --------- d-------- C:\Documents and Settings\All Users\Application Data\Symantec

2007-10-04 23:59 --------- d-------- C:\Program Files\MSN Messenger

2007-10-04 23:56 --------- d-------- C:\Program Files\iTunes

2007-10-04 23:56 --------- d-------- C:\Program Files\Google

2007-10-04 23:56 --------- d-------- C:\Program Files\Digital Line Detect

2007-10-04 23:56 --------- d-------- C:\Program Files\DellSupport

2007-10-04 23:55 --------- d-------- C:\Program Files\Common Files\Symantec Shared

2007-10-03 15:30 --------- d-------- C:\Program Files\Dell

2007-10-03 15:28 --------- d-------- C:\Program Files\Common Files\AOL

2007-10-03 15:28 --------- d-------- C:\Documents and Settings\All Users\Application Data\AOL

2007-09-28 20:02 --------- d-------- C:\Program Files\Dl_cats

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 12:09]

"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 19:58]

"DLCCCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll" [2005-09-14 00:50]

"dlccmon.exe"="C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe" [2005-10-21 02:40]

"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 04:25]

"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 20:20]

"pccguide.exe"="C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe" [2005-08-22 22:21]

"Norton Ghost 10.0"="C:\Program Files\Norton Ghost\Agent\GhostTray.exe" [2005-12-07 16:05]

"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 10:36]

"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 10:44]

"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 10:44]

"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-14 20:49]

"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-10-14 20:50]

"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-14 20:46]

"DMXLauncher"="C:\Program Files\Dell\Media Experience\DMXLauncher.exe" [2005-11-01 03:12]

"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-08 05:20]

"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-12-13 15:30]

"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 04:06]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"OE_OEM"="C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe" [2006-04-11 20:39]

"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-21 22:07]

"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 13:54]

"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 12:09]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00]

"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-10-04 15:23]

"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]

"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\

Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-08-31 09:39:35]

Event Planner Reminders Tray Icon.lnk - C:\Program Files\Sierra\Planner\Plnrnote.exe [2006-10-21 22:04:37]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\

Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-08-31 09:39:35]

Event Planner Reminders Tray Icon.lnk - C:\Program Files\Sierra\Planner\Plnrnote.exe [2006-10-21 22:04:37]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]

"DisableRegistryTools"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL 2007-10-04 15:23 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL

R1 V2IMount;V2IMount;C:\WINDOWS\system32\drivers\V2IMount.sys

.

Contents of the 'Scheduled Tasks' folder

"2007-10-04 14:25:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"

"2007-10-05 15:42:45 C:\WINDOWS\Tasks\MP Scheduled Scan.job"

- C:\Program Files\Windows Defender\MpCmdRun.exe

.

**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2007-10-05 11:17:36

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 2007-10-05 11:19:23 - machine was rebooted

C:\ComboFix-quarantined-files.txt ... 2007-10-05 11:19

C:\ComboFix2.txt ... 2007-10-04 22:02

.

--- E O F ---

*************************** HJT log *****************************

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:23:29 AM, on 10/5/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\WINDOWS\System32\GEARSec.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe

C:\WINDOWS\system32\svchost.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe

C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe

C:\WINDOWS\system32\dlcccoms.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\system32\hkcmd.exe

C:\Program Files\Dell\Media Experience\DMXLauncher.exe

C:\WINDOWS\System32\DLA\DLACTRLW.EXE

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\DellSupport\DSAgnt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Digital Line Detect\DLG.exe

C:\Program Files\Sierra\Planner\Plnrnote.exe

C:\Program Files\MSN Messenger\usnsvc.exe

C:\WINDOWS\system32\notepad.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll

O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [DLCCCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll,_RunDLLEntry@16

O4 - HKLM\..\Run: [dlccmon.exe] "C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe"

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide

O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe"

O4 - HKLM\..\Run: [Norton Ghost 10.0] "C:\Program Files\Norton Ghost\Agent\GhostTray.exe"

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [iSUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup

O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe

O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKCU\..\Run: [OE_OEM] "C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe"

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')

O4 - Global Startup: Digital Line Detect.lnk = ?

O4 - Global Startup: Event Planner Reminders Tray Icon.lnk = ?

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://melmm2012.spaces.live.com/PhotoUplo....cab?10,0,912,0

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab

O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

O23 - Service: dlcc_device - - C:\WINDOWS\system32\dlcccoms.exe

O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe

O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe

O23 - Service: Norton Ghost - Symantec Corporation - C:\Program Files\Norton Ghost\Agent\VProSvc.exe

O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe

O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe

O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe

O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

--

End of file - 9378 bytes

Pease don't post them as attachments, whenever somebody else opens them they look all jumbled and are very difficult to read. Please simply paste them in your next reply.
Link to post
Share on other sites
ccarbo

ccarbo

Posted
  • Author
Posted
Hello ccarbo,

Please post the HijackThis log and combofix report again, but this time not as an attachment.

I am not sure if this posted right, here it is.....

Here is the Combofix log. sorry about that. clint

ComboFix 07-10-04.5 - megan mueller 2007-10-05 11:13:15.2 - NTFSx86

Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.404 [GMT -5:00]

Running from: C:\temp\ComboFix.exe

Command switches used :: C:\temp\CFScript.txt

FILE::

C:\Documents and Settings\All Users\Application Data\SecTaskMan\WinAvXX.exe.q_8041E00_q

C:\Documents and Settings\megan mueller\Cookies\megan_mueller@atdmt[2].txt

C:\Documents and Settings\megan mueller\Cookies\megan_mueller@doubleclick[1].txt

C:\RECYCLER\S-1-5-21-1813478142-433029708-2422734990-500\Dc1.exe

C:\RECYCLER\S-1-5-21-1813478142-433029708-2422734990-500\Dc2.exe

C:\RECYCLER\S-1-5-21-1813478142-433029708-2422734990-500\Dc3.exe

C:\RECYCLER\S-1-5-21-1813478142-433029708-2422734990-500\Dc4.exe

C:\WINDOWS\System32\alertic.exe

.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

.

C:\Documents and Settings\All Users\Application Data\SecTaskMan\WinAvXX.exe.q_8041E00_q

C:\Documents and Settings\megan mueller\Cookies\megan_mueller@atdmt[2].txt

C:\RECYCLER\S-1-5-21-1813478142-433029708-2422734990-500\Dc1.exe

C:\RECYCLER\S-1-5-21-1813478142-433029708-2422734990-500\Dc2.exe

C:\RECYCLER\S-1-5-21-1813478142-433029708-2422734990-500\Dc3.exe

C:\RECYCLER\S-1-5-21-1813478142-433029708-2422734990-500\Dc4.exe

C:\WINDOWS\System32\alertic.exe

.

((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

-------\LEGACY_WINALERT

-------\Winalert

((((((((((((((((((((((((( Files Created from 2007-09-05 to 2007-10-05 )))))))))))))))))))))))))))))))

.

2007-10-05 11:12 1,471,257 --a------ C:\temp\ComboFix.exe

2007-10-05 09:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy

2007-10-05 09:28 <DIR> d-------- C:\temp\Qoofix

2007-10-04 22:58 <DIR> d-------- C:\WINDOWS\system32\ActiveScan

2007-10-04 22:08 <DIR> d-------- C:\Program Files\Enigma Software Group

2007-10-04 21:56 51,200 --a------ C:\WINDOWS\NirCmd.exe

2007-10-04 20:59 <DIR> d-------- C:\Documents and Settings\karen kropp-mueller\Application Data\SUPERAntiSpyware.com

2007-10-04 14:12 <DIR> d-------- C:\Program Files\SUPERAntiSpyware

2007-10-04 14:12 <DIR> d-------- C:\Documents and Settings\megan mueller\Application Data\SUPERAntiSpyware.com

2007-10-04 14:12 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com

2007-10-04 11:14 <DIR> d-------- C:\Program Files\CCleaner

2007-10-04 11:12 <DIR> d-------- C:\Program Files\RogueRemover FREE

2007-10-04 09:25 <DIR> d-------- C:\temp\SmitfraudFix

2007-10-04 09:19 812,344 --a------ C:\temp\HJTInstall.exe

2007-10-04 09:19 686,608 --a------ C:\temp\rr-free-setup.exe

2007-10-04 09:19 383,836 --a------ C:\temp\smitRem.exe

2007-10-04 09:19 3,988,032 --a------ C:\temp\Free-SpyHunter-Scanner-Install.exe

2007-10-04 09:19 2,628,296 --a------ C:\temp\ccsetup201.exe

2007-10-04 09:19 1,034,347 --a------ C:\temp\SmitfraudFix.exe

2007-10-04 09:14 2,574 --a------ C:\WINDOWS\system32\tmp.reg

2007-10-04 09:11 <DIR> d-------- C:\Program Files\Trend Micro

2007-10-03 17:18 <DIR> d-------- C:\temp

2007-10-03 15:56 <DIR> d-------- C:\Program Files\Windows Defender

2007-10-03 15:31 <DIR> d-------- C:\Documents and Settings\jeff mueller\Application Data\MSNInstaller

2007-10-03 15:19 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Help

2007-10-03 14:07 <DIR> d-------- C:\WINDOWS\BDOSCAN8

2007-10-03 13:58 94,480 --a------ C:\WINDOWS\system32\drivers\tmcomm.sys

2007-10-03 13:56 <DIR> d-------- C:\Documents and Settings\jeff mueller\Application Data\HouseCall 6.6

2007-10-03 13:04 <DIR> d-------- C:\Program Files\SDU

2007-10-03 12:53 <DIR> d-------- C:\Program Files\Common Files\PC Tools

2007-10-03 12:20 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SecTaskMan

2007-10-03 01:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft

2007-10-03 01:05 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard

2007-10-03 00:55 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP

2007-10-03 00:54 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll

2007-10-02 23:31 <DIR> d-------- C:\Program Files\a-squared Free

2007-10-02 21:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys

2007-10-02 20:47 21,504 --a------ C:\WINDOWS\system32\hidserv.dll

2007-10-02 20:47 21,504 --a------ C:\WINDOWS\system32\dllcache\hidserv.dll

2007-09-29 23:34 <DIR> d-------- C:\Documents and Settings\megan mueller\Application Data\systemerrorfixer

2007-09-29 09:55 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll

2007-09-28 20:15 <DIR> dr------- C:\Documents and Settings\All Users\Application Data\systemerrorfixer

2007-09-28 18:08 664 --a------ C:\WINDOWS\system32\d3d9caps.dat

2007-09-26 20:12 <DIR> d-------- C:\WINDOWS\system32\spool

2007-09-26 19:59 <DIR> d-------- C:\Program Files\Dell Photo AIO Printer 924

2007-09-26 19:59 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Symantec

2007-09-20 22:48 <DIR> d-------- C:\Documents and Settings\jeff mueller\Application Data\Help

2007-09-19 20:50 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\Help

2007-09-19 11:17 <DIR> d-------- C:\Documents and Settings\jeff mueller\Application Data\Leadertech

2007-09-14 19:20 <DIR> d-------- C:\WINDOWS\pss

2007-09-14 19:20 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Citrix

2007-09-14 19:19 60,968 --a------ C:\Documents and Settings\jeff mueller\GoToAssistDownloadHelper.exe

2007-09-07 18:33 <DIR> d-------- C:\Documents and Settings\karen kropp-mueller\Contacts

2007-09-07 16:55 <DIR> d-------- C:\Documents and Settings\karen kropp-mueller\Application Data\Corel Photo Album

.

(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2007-10-05 11:16 --------- d-------- C:\Program Files\Viewpoint

2007-10-05 11:08 --------- d-------- C:\Documents and Settings\All Users\Application Data\Viewpoint

2007-10-05 10:13 --------- d-------- C:\Documents and Settings\All Users\Application Data\Symantec

2007-10-04 23:59 --------- d-------- C:\Program Files\MSN Messenger

2007-10-04 23:56 --------- d-------- C:\Program Files\iTunes

2007-10-04 23:56 --------- d-------- C:\Program Files\Google

2007-10-04 23:56 --------- d-------- C:\Program Files\Digital Line Detect

2007-10-04 23:56 --------- d-------- C:\Program Files\DellSupport

2007-10-04 23:55 --------- d-------- C:\Program Files\Common Files\Symantec Shared

2007-10-03 15:30 --------- d-------- C:\Program Files\Dell

2007-10-03 15:28 --------- d-------- C:\Program Files\Common Files\AOL

2007-10-03 15:28 --------- d-------- C:\Documents and Settings\All Users\Application Data\AOL

2007-09-28 20:02 --------- d-------- C:\Program Files\Dl_cats

.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))

.

.

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Adobe Photo Downloader"="C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe" [2007-03-09 12:09]

"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 19:58]

"DLCCCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll" [2005-09-14 00:50]

"dlccmon.exe"="C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe" [2005-10-21 02:40]

"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 04:25]

"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 20:20]

"pccguide.exe"="C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe" [2005-08-22 22:21]

"Norton Ghost 10.0"="C:\Program Files\Norton Ghost\Agent\GhostTray.exe" [2005-12-07 16:05]

"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 10:36]

"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 10:44]

"ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 10:44]

"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2005-10-14 20:49]

"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2005-10-14 20:50]

"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2005-10-14 20:46]

"DMXLauncher"="C:\Program Files\Dell\Media Experience\DMXLauncher.exe" [2005-11-01 03:12]

"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-09-08 05:20]

"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2004-12-13 15:30]

"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 04:06]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"OE_OEM"="C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe" [2006-04-11 20:39]

"swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-05-21 22:07]

"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 13:54]

"DellSupport"="C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 12:09]

"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00]

"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-10-04 15:23]

"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]

"swg"=C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

"DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\

Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-08-31 09:39:35]

Event Planner Reminders Tray Icon.lnk - C:\Program Files\Sierra\Planner\Plnrnote.exe [2006-10-21 22:04:37]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\

Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-08-31 09:39:35]

Event Planner Reminders Tray Icon.lnk - C:\Program Files\Sierra\Planner\Plnrnote.exe [2006-10-21 22:04:37]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]

"DisableRegistryTools"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]

C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL 2007-10-04 15:23 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL

R1 V2IMount;V2IMount;C:\WINDOWS\system32\drivers\V2IMount.sys

.

Contents of the 'Scheduled Tasks' folder

"2007-10-04 14:25:00 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"

"2007-10-05 15:42:45 C:\WINDOWS\Tasks\MP Scheduled Scan.job"

- C:\Program Files\Windows Defender\MpCmdRun.exe

.

**************************************************************************

catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2007-10-05 11:17:36

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully

hidden files: 0

**************************************************************************

.

Completion time: 2007-10-05 11:19:23 - machine was rebooted

C:\ComboFix-quarantined-files.txt ... 2007-10-05 11:19

C:\ComboFix2.txt ... 2007-10-04 22:02

.

--- E O F ---

*************************** HJT log *****************************

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 11:23:29 AM, on 10/5/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16512)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\WINDOWS\System32\GEARSec.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe

C:\WINDOWS\system32\svchost.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe

C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe

C:\WINDOWS\system32\dlcccoms.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe

C:\WINDOWS\system32\igfxpers.exe

C:\WINDOWS\system32\hkcmd.exe

C:\Program Files\Dell\Media Experience\DMXLauncher.exe

C:\WINDOWS\System32\DLA\DLACTRLW.EXE

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe

C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

C:\Program Files\DellSupport\DSAgnt.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Digital Line Detect\DLG.exe

C:\Program Files\Sierra\Planner\Plnrnote.exe

C:\Program Files\MSN Messenger\usnsvc.exe

C:\WINDOWS\system32\notepad.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll

O4 - HKLM\..\Run: [Adobe Photo Downloader] "C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [DLCCCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCCtime.dll,_RunDLLEntry@16

O4 - HKLM\..\Run: [dlccmon.exe] "C:\Program Files\Dell Photo AIO Printer 924\dlccmon.exe"

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide

O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe"

O4 - HKLM\..\Run: [Norton Ghost 10.0] "C:\Program Files\Norton Ghost\Agent\GhostTray.exe"

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [iSUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start

O4 - HKLM\..\Run: [iSUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup

O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe

O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe

O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe

O4 - HKLM\..\Run: [DMXLauncher] C:\Program Files\Dell\Media Experience\DMXLauncher.exe

O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKCU\..\Run: [OE_OEM] "C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe"

O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background

O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [sUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKUS\S-1-5-18\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')

O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe (User 'Default user')

O4 - Global Startup: Digital Line Detect.lnk = ?

O4 - Global Startup: Event Planner Reminders Tray Icon.lnk = ?

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINDOWS\bdoscandel.exe

O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://melmm2012.spaces.live.com/PhotoUplo....cab?10,0,912,0

O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-US/a-UNO1/GAME_UNO1.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab

O16 - DPF: {7B297BFD-85E4-4092-B2AF-16A91B2EA103} (WScanCtl Class) - http://www.ca.com/us/securityadvisor/virusinfo/webscan.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab

O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

O23 - Service: dlcc_device - - C:\WINDOWS\system32\dlcccoms.exe

O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe

O23 - Service: GEARSecurity - GEAR Software - C:\WINDOWS\System32\GEARSec.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: Intel NCS NetService (NetSvc) - Intel

Link to post
Share on other sites
__RiP_ChAiN_

__RiP_ChAiN_

Posted
Posted

Hello ccarbo,

Please go HERE to run Panda's ActiveScan

  • Once you are on the Panda site click the Scan your PC button
  • A new window will open...click the Check Now button
  • Enter your Country
  • Enter your State/Province
  • Enter your e-mail address and click send
  • Select either Home User or Company
  • Click the big Scan Now button
  • If it wants to install an ActiveX component allow it
  • It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
  • When download is complete, click on My Computer to start the scan
  • When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Post the contents of the ActiveScan report
Link to post
Share on other sites
ccarbo

ccarbo

Posted
  • Author
Posted

Rip, here is the results of the scan. I ran it now for overnight and all day with no popups.

Incident Status Location

Virus:Eicar.Mod Not disinfected C:\Program Files\Trend Micro\Internet Security 12\tmhelp.chm[/PCC12/Test_virus.htm]

Adware:Adware/WinAntiVirus2007 Not disinfected C:\qoobox\Quarantine\C\Documents and Settings\All Users\Application Data\SecTaskMan\WinAvXX.exe.q_8041E00_q.vir

Spyware:Cookie/Atlas DMT Not disinfected C:\qoobox\Quarantine\C\Documents and Settings\megan mueller\Cookies\megan_mueller@atdmt[2].txt.vir

Adware:Adware/WinAntiVirus2007 Not disinfected C:\qoobox\Quarantine\C\RECYCLER\S-1-5-21-1813478142-433029708-2422734990-500\Dc1.exe.vir

Adware:Adware/WinAntiVirus2007 Not disinfected C:\qoobox\Quarantine\C\RECYCLER\S-1-5-21-1813478142-433029708-2422734990-500\Dc2.exe.vir

Adware:Adware/WinAntiVirus2007 Not disinfected C:\qoobox\Quarantine\C\RECYCLER\S-1-5-21-1813478142-433029708-2422734990-500\Dc3.exe.vir

Adware:Adware/WinAntiVirus2007 Not disinfected C:\qoobox\Quarantine\C\RECYCLER\S-1-5-21-1813478142-433029708-2422734990-500\Dc4.exe.vir

Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\temp\ComboFix.exe[nircmd.exe]

Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\temp\ComboFix.exe[nircmd.cfexe]

Potentially unwanted tool:Application/Processor Not disinfected C:\temp\SmitfraudFix\Process.exe

Potentially unwanted tool:Application/SuperFast Not disinfected C:\temp\SmitfraudFix\restart.exe

Potentially unwanted tool:Application/Processor Not disinfected C:\temp\smitRem.exe[smitRem/Process.exe]

Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\WINDOWS\NirCmd.exe

Hello ccarbo,

Please go HERE to run Panda's ActiveScan

  • Once you are on the Panda site click the Scan your PC button
  • A new window will open...click the Check Now button
  • Enter your Country
  • Enter your State/Province
  • Enter your e-mail address and click send
  • Select either Home User or Company
  • Click the big Scan Now button
  • If it wants to install an ActiveX component allow it
  • It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
  • When download is complete, click on My Computer to start the scan
  • When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Post the contents of the ActiveScan report
Link to post
Share on other sites
__RiP_ChAiN_

__RiP_ChAiN_

Posted
Posted

Hello ccarbo,

Time for some housekeeping

  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
    • CF_Cleanup.png

    [*] When shown the disclaimer, Select "2"

The above procedure will:

  • Delete the following:
    • ComboFix and its associated files and folders.
    • VundoFix backups, if present
    • The C:\Deckard folder, if present
    • The C:_OtMoveIt folder, if present

    [*] Reset the clock settings.

    [*] Hide file extensions, if required.

    [*] Hide System/Hidden files, if required.

    [*] Set a new, clean Restore Point.

Congratulations, your computer is now clean of malware!

Next, let's clean your restore points and set a new one:

Reset and Re-enable your System Restore to remove infected files that have been backed up by Windows. The files in System Restore are protected to prevent any programs from changing those files. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected)

  • 1. Turn off System Restore.
    • On the Desktop, right-click My Computer.
      Click Properties.
      Click the System Restore tab.
      Check Turn off System Restore.
      Click Apply, and then click OK.

2. Restart your computer.

3. Turn ON System Restore.

  • On the Desktop, right-click My Computer.
    Click Properties.
    Click the System Restore tab.
    UN-Check Turn off System Restore.
    Click Apply, and then click OK.

System Restore will now be active again.

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:

  1. Make your Internet Explorer more secure - This can be done by following these simple instructions:
    2. From within Internet Explorer click on the Tools menu and then click on Options.
    3. Click once on the Security tab
    4. Click once on the Internet icon so it becomes highlighted.
    5. Click once on the Custom Level button.
      1. Change the Download signed ActiveX controls to Prompt
      2. Change the Download unsigned ActiveX controls to Disable
      3. Change the Initialize and script ActiveX controls not marked as safe to Disable
      4. Change the Installation of desktop items to Prompt
      5. Change the Launching programs and files in an IFRAME to Prompt
      6. Change the Navigate sub-frames across different domains to Prompt
      7. When all these settings have been made, click on the OK button.
      8. If it prompts you as to whether or not you want to save the settings, press the Yes button.

      9. Next press the Apply button and then the OK to exit the Internet Properties page.


      10. Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.
        See this link for a listing of some online & their stand-alone antivirus programs:
        Virus, Spyware, and Malware Protection and Removal Resources
      11. Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.
      12. Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.
        For a tutorial on Firewalls and a listing of some available ones see the link below:
        Understanding and Using Firewalls
      13. Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.
      14. Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.
        A tutorial on installing & using this product can be found here:
        Using SpywareBlaster to protect your computer from Spyware and Malware
      15. Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.

        Follow this list and your potential for being infected again will reduce dramatically.
        here are some additional utilities that will enhance your safety
        • IE/Spyad <= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
        • MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
        • Google Toolbar <= Get the free google toolbar to help stop pop up windows.
        • Winpatrol <= Download and install the free version of Winpatrol. a tutorial for this product is located here:
          Using Winpatrol to protect your computer from malicious software
Link to post
Share on other sites
__RiP_ChAiN_

__RiP_ChAiN_

Posted
Posted

Hello ccarbo,

where did those programs embed themselves ??

Believe it or not, this is some of the easier malware to remove out there. All we really dealt with was a case of the SmitFraud type infection. Do a quick google search on "SmitFraud Infections" to find much more detailed info on this type of infection.

Link to post
Share on other sites
ccarbo

ccarbo

Posted
  • Author
Posted

wow really, yeh I will read up on it for future run ins. What is some of the toughest? I would like to read up on those as well. thanks again.

Hello ccarbo,

Believe it or not, this is some of the easier malware to remove out there. All we really dealt with was a case of the SmitFraud type infection. Do a quick google search on "SmitFraud Infections" to find much more detailed info on this type of infection.

Link to post
Share on other sites
ccarbo

ccarbo

Posted
  • Author
Posted

Yeh I would be.. I run a small computer service shop on the side and alot of my issues are spyware and virus problems. This would cut down my time involved to fix this. Hard to bill @ $50/hr and spend 5 hours and charge $250! May as well wipe it clean and start over for $100 to be fair to the customer.

thanks, Rip_Chain

If you'd really be interested in learning more about this stuff, there are some online training classes available for free - would you be interested in that type of thing?
Link to post
Share on other sites
__RiP_ChAiN_

__RiP_ChAiN_

Posted
Posted

Hello ccarbo,

Yeh I would be.. I run a small computer service shop on the side and alot of my issues are spyware and virus problems. This would cut down my time involved to fix this. Hard to bill @ $50/hr and spend 5 hours and charge $250! May as well wipe it clean and start over for $100 to be fair to the customer.

Well, when the training is provided it is somewhat assumed, but not mandatory by any means that you would also help users online on occasion to help repay the hours that were put into your training. It isn't a quick process either, training can take anywehre from a month for some to over a six months for other very inactive ones. If you're still interested I listed some "schools" below for you to look at.

Geekstogo

Malware Removal

Link to post
Share on other sites
ccarbo

ccarbo

Posted
  • Author
Posted

Thanks Rip_Chain,

I will look into these...... thanks!

Hello ccarbo,

Well, when the training is provided it is somewhat assumed, but not mandatory by any means that you would also help users online on occasion to help repay the hours that were put into your training. It isn't a quick process either, training can take anywehre from a month for some to over a six months for other very inactive ones. If you're still interested I listed some "schools" below for you to look at.

Geekstogo

Malware Removal

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.