spybot@mxt... help!!

nicko75 · November 16, 2007

Hi there, just read the thread on removing spybot@mxt dated 8 nov 2007 mrhorus87. Just wondered if you could take a look at my log results from the scans and give me any further advice. Cheers and thanks for the help so far!!!

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 23:22:51, on 16/11/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\ALCXMNTR.EXE

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Messenger\msmsgs.exe

C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIE.EXE

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\Program Files\Internet Explorer\IEXPLORE.EXE

C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {23B760D6-C98B-450B-9B32-26C7775CDF83} - C:\Program Files\Video Add-on\isfmdl.dll (file missing)

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O4 - HKLM\..\Run: [speedTouch USB Diagnostics] "C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon

O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [DiskeeperSystray] "C:\Program Files\Diskeeper Corporation\Diskeeper\DkIcon.exe"

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [EPSON Stylus Photo R220 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIAIE.EXE /FU "C:\WINDOWS\TEMP\E_S79.tmp" /EF "HKCU"

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onecare.live.com/resource/...lscbase4009.cab

O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/Facebo...otoUploader.cab

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{598B7FE4-242A-4D56-9AE4-797BC62BC28C}: NameServer = 212.139.132.22 212.139.132.23

O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe

O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: Diskeeper - Diskeeper Corporation - C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

--

End of file - 5859 bytes

Incident Status Location

Spyware:Cookie/Adserver Not disinfected C:\Documents and Settings\nick owen\Cookies\nick_owen@adserver.easyad[2].txt

Spyware:Cookie/bravenetA Not disinfected C:\Documents and Settings\nick owen\Cookies\nick_owen@bravenet[1].txt

Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\nick owen\Cookies\nick_owen@com[2].txt

Spyware:Cookie/888 Not disinfected C:\Documents and Settings\nick owen\Cookies\nick_owen@int.sitestat[1].txt

Spyware:Cookie/Cassava Not disinfected C:\Documents and Settings\nick owen\Cookies\nick_owen@int.sitestat[2].txt

Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\nick owen\Cookies\nick_owen@toplist[1].txt

Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\nick owen\Cookies\nick_owen@xiti[1].txt

Potentially unwanted tool:Application/AntivirusGolden Not disinfected C:\Documents and Settings\nick owen\Local Settings\Temporary Internet Files\Content.IE5\SZL5HIBK\asg_install[1].exe[AntiSpygolden 5.1.exe]

Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Owner\Cookies\owner@com[1].txt

Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\Owner\Cookies\owner@toplist[1].txt

Potentially unwanted tool:Application/KillApp.B Not disinfected C:\hp\bin\KillIt.exe

Potentially unwanted tool:Application/KillApp.A Not disinfected C:\hp\bin\Terminator.exe

---------------------------------------------------------

AVG Anti-Spyware - Scan Report

---------------------------------------------------------

+ Created at: 20:38:56 16/11/2007

+ Scan result:

C:\Documents and Settings\nick owen\Local Settings\Temporary Internet Files\Content.IE5\65L1O5ZZ\install_en[1].exe -> Not-A-Virus.Downloader.Win32.WinFixer.au : No action taken.

C:\Documents and Settings\nick owen\Local Settings\Temporary Internet Files\Content.IE5\CXQB8PIB\setup_en[1].exe -> Not-A-Virus.Downloader.Win32.WinFixer.au : No action taken.

C:\System Volume Information\_restore{812000F5-FA70-4501-81E9-F728C4FE0311}\RP106\A0004727.exe -> Not-A-Virus.Downloader.Win32.WinFixer.au : No action taken.

C:\Documents and Settings\nick owen\Cookies\nick_owen@2o7[1].txt -> TrackingCookie.2o7 : No action taken.

C:\Documents and Settings\nick owen\Cookies\nick_owen@msnportal.112.2o7[2].txt -> TrackingCookie.2o7 : No action taken.

C:\Documents and Settings\nick owen\Cookies\nick_owen@msnservices.112.2o7[1].txt -> TrackingCookie.2o7 : No action taken.

C:\Documents and Settings\nick owen\Cookies\nick_owen@atdmt[2].txt -> TrackingCookie.Atdmt : No action taken.

C:\Documents and Settings\nick owen\Cookies\nick_owen@bs.serving-sys[1].txt -> TrackingCookie.Serving-sys : No action taken.

C:\Documents and Settings\nick owen\Cookies\nick_owen@serving-sys[2].txt -> TrackingCookie.Serving-sys : No action taken.

C:\Documents and Settings\nick owen\Cookies\nick_owen@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : No action taken.

C:\Documents and Settings\nick owen\Cookies\nick_owen@m.webtrends[2].txt -> TrackingCookie.Webtrends : No action taken.

::Report end

Activescan.txt

Report_Scan_20071116_203856.txt

hijack.txt

Activescan.txt

Report_Scan_20071116_203856.txt

hijack.txt

JeanInMontana · November 17, 2007

Hi nicko75 and welcome to Malwarebytes. You didn't take action when you scanned with AVG. Please disable TeaTimer in Spybot Search & Destroy for now and scan again with AVG, this time let the program remove what it finds. Get a free trial of RogueRemoverPro from the link in my signature and run a scan with it also. Post the new AVG log and a new HJT log back into your next post. AVG first then HJT.

nicko75 · November 18, 2007

cheers for the reply. here's the logs you asked for, hope i've got them right this time!!

---------------------------------------------------------

AVG Anti-Spyware - Scan Report

---------------------------------------------------------

+ Created at: 23:53:59 17/11/2007

+ Scan result:

C:\Documents and Settings\nick owen\Cookies\nick_owen@2o7[2].txt -> TrackingCookie.2o7 : Cleaned.

C:\Documents and Settings\nick owen\Cookies\nick_owen@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.

C:\Documents and Settings\nick owen\Cookies\nick_owen@pandasoftware.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned.

C:\Documents and Settings\nick owen\Cookies\nick_owen@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned.

::Report end

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 00:05:10, on 18/11/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v7.00 (7.00.6000.16544)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe

C:\Program Files\Alwil Software\Avast4\ashServ.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\Diskeeper Corporation\Diskeeper\DkService.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe

C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe

C:\WINDOWS\ALCXMNTR.EXE

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe

C:\Program Files\Alwil Software\Avast4\ashWebSv.exe

C:\Program Files\Adobe\Reader 8.0\Reader\AcroRd32.exe

C:\Program Files\RogueRemover PRO\RogueRemoverPRO.exe