Jump to content

Spyware Infection - Please Help! (Logs Included)

mvz2102

By mvz2102
in Resolved Malware Removal Logs

 Share

Recommended Posts

mvz2102

mvz2102

Posted
Posted

Hi guys. So my computer is having a bit of a spyware/malware problem and I was hoping someone could help. I've included the logs from AVG Anti-Spyware, Panda Active Scan, and Hijack This. Any help would be greatly appreciated!

AVG Abti-Spyware Log:

---------------------------------------------------------

AVG Anti-Spyware - Scan Report

---------------------------------------------------------

+ Created at: 7:46:57 PM 11/19/2007

+ Scan result:

:mozilla.10:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.

:mozilla.116:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.

:mozilla.11:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.

:mozilla.12:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.

:mozilla.13:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.

:mozilla.14:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.

:mozilla.15:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.

:mozilla.16:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.

:mozilla.17:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.

:mozilla.18:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.

:mozilla.19:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.

:mozilla.20:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.

:mozilla.21:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.

:mozilla.22:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.

:mozilla.23:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.

:mozilla.24:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.

:mozilla.25:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.

:mozilla.343:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.

:mozilla.359:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.

:mozilla.363:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.

:mozilla.404:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.

:mozilla.431:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.

:mozilla.623:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.

:mozilla.6:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.

:mozilla.7:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.

:mozilla.8:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.

:mozilla.9:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.2o7 : Cleaned.

:mozilla.47:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.

:mozilla.48:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.

:mozilla.49:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Adbrite : Cleaned.

:mozilla.71:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Adtech : Cleaned.

:mozilla.78:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.

:mozilla.79:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.

:mozilla.80:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.

:mozilla.81:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.

:mozilla.82:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Advertising : Cleaned.

:mozilla.96:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned.

:mozilla.816:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Burstbeacon : Cleaned.

:mozilla.684:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Clickhype : Cleaned.

:mozilla.687:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Cnn : Cleaned.

:mozilla.145:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Com : Cleaned.

:mozilla.53:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.

:mozilla.54:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.

:mozilla.55:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.

:mozilla.56:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.

:mozilla.57:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.

:mozilla.685:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Euroclick : Cleaned.

:mozilla.824:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.

:mozilla.825:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Googleadservices : Cleaned.

:mozilla.264:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.

:mozilla.265:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned.

:mozilla.317:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Intelli-direct : Cleaned.

:mozilla.319:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Ivwbox : Cleaned.

:mozilla.768:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.

:mozilla.769:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Liveperson : Cleaned.

:mozilla.545:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Netflame : Cleaned.

:mozilla.428:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Overture : Cleaned.

:mozilla.429:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Overture : Cleaned.

:mozilla.437:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Overture : Cleaned.

:mozilla.833:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Paypal : Cleaned.

:mozilla.62:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.

:mozilla.63:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.

:mozilla.64:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.

:mozilla.65:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.

:mozilla.66:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.

:mozilla.67:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.

:mozilla.68:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.

:mozilla.69:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.

:mozilla.70:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Pointroll : Cleaned.

:mozilla.457:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.

:mozilla.458:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Questionmarket : Cleaned.

:mozilla.460:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.

:mozilla.461:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.

:mozilla.462:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.

:mozilla.463:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.

:mozilla.464:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.

:mozilla.465:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.

:mozilla.466:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Realmedia : Cleaned.

:mozilla.479:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.

:mozilla.480:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.

:mozilla.481:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.

:mozilla.482:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.

:mozilla.483:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.

:mozilla.484:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.

:mozilla.485:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.

:mozilla.486:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.

:mozilla.487:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.

:mozilla.488:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.

:mozilla.489:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.

:mozilla.490:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.

:mozilla.491:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.

:mozilla.492:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.

:mozilla.493:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.

:mozilla.689:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Revsci : Cleaned.

:mozilla.117:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.

:mozilla.514:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.

:mozilla.515:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.

:mozilla.516:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.

:mozilla.517:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.

:mozilla.518:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Serving-sys : Cleaned.

:mozilla.535:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.

:mozilla.536:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.

:mozilla.537:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.

:mozilla.538:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.

:mozilla.539:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.

:mozilla.58:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.

:mozilla.59:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.

:mozilla.60:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.

:mozilla.61:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Specificclick : Cleaned.

:mozilla.552:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.

:mozilla.553:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.

:mozilla.554:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.

:mozilla.555:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.

:mozilla.556:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.

:mozilla.692:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.

:mozilla.695:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Tacoda : Cleaned.

:mozilla.587:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.

:mozilla.588:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.

:mozilla.589:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.

:mozilla.590:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.

:mozilla.591:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.

:mozilla.592:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.

:mozilla.593:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.

:mozilla.594:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.

:mozilla.595:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Trafficmp : Cleaned.

:mozilla.599:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned.

:mozilla.758:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Webtrends : Cleaned.

:mozilla.679:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.

:mozilla.680:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.

:mozilla.681:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.

:mozilla.682:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.

:mozilla.683:C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned.

::Report end

Panda Active Scan Log:

Incident Status Location

Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\amltwbig.dll

Adware:Adware/UltimateDefender Not disinfected C:\Program Files\fyrqpedo\dofetsvs.dll

Spyware:Spyware/SecureCenter Not disinfected C:\Program Files\SecCenter\scprot4.exe

Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\kgapqhtv.dll

Spyware:Spyware/Vundo Not disinfected C:\WINDOWS\system32\cbxwtus.dll

Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt[.atdmt.com/]

Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt[.overture.com/]

Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt[.112.2o7.net/]

Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt[.tribalfusion.com/]

Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt[.go.com/]

Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt[.adtech.de/]

Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt[.questionmarket.com/]

Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt[.realmedia.com/]

Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt[ad.yieldmanager.com/]

Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt[.serving-sys.com/]

Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt[.bs.serving-sys.com/]

Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt[.serving-sys.com/]

Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt[.com.com/]

Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt[.advertising.com/]

Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt[.ads.pointroll.com/]

Spyware:Cookie/adultfriendfinder Not disinfected C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt[.adultfriendfinder.com/]

Spyware:Cookie/NewMedia Not disinfected C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt[.anm.co.uk/]

Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt[.atwola.com/]

Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt[.perf.overture.com/]

Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt[.trafficmp.com/]

Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt[.xiti.com/]

Spyware:Cookie/fe.lea.lycos Not disinfected C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt[fe.lea.lycos.es/]

Spyware:Cookie/BurstBeacon Not disinfected C:\Documents and Settings\Max\Application Data\Mozilla\Firefox\Profiles\kmdz2id6.default\cookies.txt[www.burstbeacon.com/]

Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Max\Cookies\max@atwola[1].txt

Spyware:Spyware/Virtumonde Not disinfected C:\Documents and Settings\Max\Local Settings\Temporary Internet Files\Content.IE5\SPQ1UZUN\pochki20071106[1]

Spyware:Spyware/Vundo Not disinfected C:\Program Files\Accmbmmc\tdzuzukl.dll

Spyware:Spyware/Vundo Not disinfected C:\Program Files\Cnpykyki\nhkmeulj.dll

Spyware:Spyware/Vundo Not disinfected C:\Program Files\Rhqnxuoz\pxqbfnhy.dll

Spyware:Spyware/SecureCenter Not disinfected C:\Program Files\SecCenter\scprot4.exe.bak

Spyware:Spyware/Vundo Not disinfected C:\Program Files\Vqkuoqic\fkxebaqi.dll

Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\agampvrf.dll

Potentially unwanted tool:Application/UltimateCleaner Not disinfected C:\WINDOWS\system32\fibagbia\fibagbia3.exe

Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\kgapqhtv.dll_old

Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\kmgtbxew.dll

Spyware:Spyware/Virtumonde Not disinfected C:\WINDOWS\system32\wxhanevp.exe

HiJack This Log:

Logfile of Trend Micro HijackThis v2.0.0 (BETA)

Scan saved at 9:15:08 PM, on 11/19/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\S24EvMon.exe

C:\WINDOWS\system32\ZCfgSvc.exe

C:\WINDOWS\System32\1XConfig.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\WINDOWS\System32\DVDRAMSV.exe

C:\Program Files\Norton AntiVirus\navapsvc.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\System32\RegSrvc.exe

c:\TOSHIBA\IVP\swupdate\swupdtmr.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\AGRSMMSG.exe

C:\Program Files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe

C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\WINDOWS\System32\00THotkey.exe

C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe

C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\WINDOWS\system32\TFNF5.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\DAEMON Tools\daemon.exe

C:\Program Files\SecCenter\scprot4.exe

C:\WINDOWS\system32\RAMASST.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\Program Files\AIM95\aim.exe

C:\toshiba\ivp\ism\ivpsvmgr.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\explorer.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\Program Files\Messenger\msmsgs.exe

C:\Documents and Settings\Max\Desktop\HiJackThis_v2.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.toshiba.com/search

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.columbia.edu/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://toshibadirect.com/

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://toshibadirect.com/

O2 - BHO: (no name) - {2C80EAD3-74CD-4700-83A4-AA878CD1C03C} - C:\WINDOWS\system32\cbxwtus.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: (no name) - {A95B2816-1D7E-4561-A202-68C0DE02353A} - C:\WINDOWS\system32\kgapqhtv.dll

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O2 - BHO: (no name) - {FEC27192-C84F-4A9A-A836-D38E380421DB} - C:\WINDOWS\system32\khfcb.dll

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: Security Toolbar - {11A69AE4-FBED-4832-A2BF-45AF82825583} - C:\WINDOWS\system32\kgapqhtv.dll

O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet

O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe

O4 - HKLM\..\Run: [sigmaTel StacMon] C:\Program Files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe

O4 - HKLM\..\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\System32\00THotkey.exe

O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe

O4 - HKLM\..\Run: [TFncKy] TFncKy.exe

O4 - HKLM\..\Run: [smoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [TFNF5] TFNF5.exe

O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run

O4 - HKLM\..\Run: [PRONoMgr.exe] c:\Program Files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe

O4 - HKLM\..\Run: [symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [fyrqpedo] rundll32.exe "C:\Program Files\fyrqpedo\dofetsvs.dll",Init

O4 - HKLM\..\Run: [lwxahujo] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\lwxahujo.dll"

O4 - HKLM\..\Run: [DeadAIM] rundll32.exe "C:\PROGRA~1\AIM95\\DeadAIM.ocm",ExportedCheckODLs

O4 - HKLM\..\Run: [gpmvsnyz] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\gpmvsnyz.dll"

O4 - HKLM\..\Run: [ninyrgbg] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\ninyrgbg.dll"

O4 - HKLM\..\Run: [60438a46] rundll32.exe "C:\WINDOWS\system32\amltwbig.dll",b

O4 - HKLM\..\Run: [topevkzs] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\topevkzs.dll"

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKLM\..\RunOnce: [spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck

O4 - HKLM\..\RunOnce: [spybotDeletingA4719] command /c del "C:\WINDOWS\system32\kgapqhtv.dllbox"

O4 - HKLM\..\RunOnce: [spybotDeletingC6953] cmd /c del "C:\WINDOWS\system32\kgapqhtv.dllbox"

O4 - HKLM\..\RunOnce: [spybotDeletingA4522] command /c del "C:\WINDOWS\system32\kgapqhtv.dll_old"

O4 - HKLM\..\RunOnce: [spybotDeletingC1792] cmd /c del "C:\WINDOWS\system32\kgapqhtv.dll_old"

O4 - HKLM\..\RunOnce: [spybotDeletingA2983] command /c del "C:\WINDOWS\system32\kgapqhtv.dll"

O4 - HKLM\..\RunOnce: [spybotDeletingC264] cmd /c del "C:\WINDOWS\system32\kgapqhtv.dll"

O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: AOL Instant Messenger (SM) - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O14 - IERESET.INF: START_PAGE_URL=http://www.toshiba.com

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1193282735378

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O20 - Winlogon Notify: cbxwtus - C:\WINDOWS\SYSTEM32\cbxwtus.dll

O20 - Winlogon Notify: kgapqhtv - C:\WINDOWS\SYSTEM32\kgapqhtv.dll

O20 - Winlogon Notify: winocp32 - winocp32.dll (file missing)

O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\Program Files\MATLAB71\webserver\bin\win32\matlabserver.exe

O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe

O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe

O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe

O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

O23 - Service: Swupdtmr - Unknown owner - c:\TOSHIBA\IVP\swupdate\swupdtmr.exe

--

End of file - 10010 bytes

Let me know what the best way to proceed is. Thanks!

Link to post
Share on other sites
JeanInMontana

JeanInMontana

Posted
Posted

Hi mvz2102 and welcome to Malwarebytes. The best way to proceed is to do this please. Move HJT from your desktop to program files.

Please download VundoFix.exe

to your desktop. http://www.atribune.org/ccount/click.php?id=4

* Double-click VundoFix.exe to run it.

* Click the Scan for Vundo button.

* Once it's done scanning, click the Remove Vundo button.

* You will receive a prompt asking if you want to remove the files, click YES

* Once you click yes, your desktop will go blank as it starts removing Vundo.

* When completed, it will prompt that it will reboot your computer, click OK.

* Please post the contents of C:\vundofix.txt and a new HiJackThis log.

Note: It is possible that VundoFix encountered a file it could not remove.

In this case, VundoFix will run on reboot, simply follow the above

instructions starting from "Click the Scan for Vundo button." when

VundoFix appears at reboot.

Link to post
Share on other sites
mvz2102

mvz2102

Posted
  • Author
Posted

Hi there! Thanks for the recommendation. Here is the log you requested.

VundoFix V6.6.2

Checking Java version...

Java version is 1.4.2.3

Old versions of java are exploitable and should be removed.

Scan started at 10:32:48 PM 11/20/2007

Listing files found while scanning....

C:\windows\system32\bcfhk.ini

C:\windows\system32\bcfhk.ini2

C:\WINDOWS\system32\kgapqhtv.dll

C:\windows\system32\khfcb.dll

C:\windows\system32\kmgtbxew.dll

Beginning removal...

Attempting to delete C:\windows\system32\bcfhk.ini

C:\windows\system32\bcfhk.ini Has been deleted!

Attempting to delete C:\windows\system32\bcfhk.ini2

C:\windows\system32\bcfhk.ini2 Has been deleted!

Attempting to delete C:\windows\system32\khfcb.dll

C:\windows\system32\khfcb.dll Has been deleted!

Attempting to delete C:\windows\system32\kmgtbxew.dll

C:\windows\system32\kmgtbxew.dll Has been deleted!

Performing Repairs to the registry.

Done!

HiJackThis Log:

Logfile of Trend Micro HijackThis v2.0.0 (BETA)

Scan saved at 10:56:26 PM, on 11/20/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\S24EvMon.exe

C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

C:\WINDOWS\system32\ZCfgSvc.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

C:\WINDOWS\system32\ucxqapia.exe

C:\WINDOWS\System32\DVDRAMSV.exe

C:\WINDOWS\AGRSMMSG.exe

C:\Program Files\Norton AntiVirus\navapsvc.exe

C:\Program Files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe

C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\System32\00THotkey.exe

C:\WINDOWS\System32\RegSrvc.exe

C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe

c:\TOSHIBA\IVP\swupdate\swupdtmr.exe

C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe

C:\Program Files\Common Files\Symantec Shared\ccApp.exe

C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

C:\WINDOWS\system32\TFNF5.exe

C:\toshiba\ivp\ism\pinger.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\WINDOWS\system32\rundll32.exe

C:\Program Files\iPod\bin\iPodService.exe

C:\WINDOWS\system32\regsvr32.exe

C:\Program Files\SecCenter\scprot4.exe

C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\System32\1XConfig.exe

C:\WINDOWS\system32\wuauclt.exe

C:\WINDOWS\system32\RAMASST.exe

C:\Program Files\Mozilla Firefox\firefox.exe

C:\Program Files\HiJackThis\HiJackThis_v2.exe

C:\Program Files\Messenger\msmsgs.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://www.toshiba.com/search

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.columbia.edu/

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://toshibadirect.com/

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://toshibadirect.com/

O2 - BHO: (no name) - {200D0AAD-71B1-51C9-DDB0-092BA4662A54} - C:\Program Files\Dbycjzow\ohirtsbs.dll

O2 - BHO: (no name) - {2C80EAD3-74CD-4700-83A4-AA878CD1C03C} - C:\WINDOWS\system32\cbxwtus.dll

O2 - BHO: (no name) - {4AE396DB-00D3-4284-825C-4D15D09EB15F} - C:\WINDOWS\system32\khfcb.dll (file missing)

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll

O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)

O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet

O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe

O4 - HKLM\..\Run: [sigmaTel StacMon] C:\Program Files\SigmaTel\SigmaTel AC97 Audio Drivers\stacmon.exe

O4 - HKLM\..\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe

O4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\System32\00THotkey.exe

O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe

O4 - HKLM\..\Run: [TFncKy] TFncKy.exe

O4 - HKLM\..\Run: [smoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [TFNF5] TFNF5.exe

O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run

O4 - HKLM\..\Run: [PRONoMgr.exe] c:\Program Files\Intel\PROSetWireless\NCS\PROSet\PRONoMgr.exe

O4 - HKLM\..\Run: [symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [fyrqpedo] rundll32.exe "C:\Program Files\fyrqpedo\dofetsvs.dll",Init

O4 - HKLM\..\Run: [lwxahujo] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\lwxahujo.dll"

O4 - HKLM\..\Run: [DeadAIM] rundll32.exe "C:\PROGRA~1\AIM95\\DeadAIM.ocm",ExportedCheckODLs

O4 - HKLM\..\Run: [gpmvsnyz] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\gpmvsnyz.dll"

O4 - HKLM\..\Run: [ninyrgbg] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\ninyrgbg.dll"

O4 - HKLM\..\Run: [topevkzs] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\topevkzs.dll"

O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [kvsfexox] regsvr32 /u "C:\Documents and Settings\All Users\Application Data\kvsfexox.dll"

O4 - HKLM\..\Run: [sC2] C:\Program Files\SecCenter\scprot4.exe

O4 - HKLM\..\Run: [60438a46] rundll32.exe "C:\WINDOWS\system32\oqqudime.dll",b

O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033

O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE

O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000

O9 - Extra button: AOL Instant Messenger (SM) - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O14 - IERESET.INF: START_PAGE_URL=http://www.toshiba.com

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupd...b?1193282735378

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O20 - Winlogon Notify: cbxwtus - C:\WINDOWS\SYSTEM32\cbxwtus.dll

O20 - Winlogon Notify: kgapqhtv - kgapqhtv.dll (file missing)

O20 - Winlogon Notify: winocp32 - winocp32.dll (file missing)

O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\System32\browseui.dll

O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\System32\browseui.dll

O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe

O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe

O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe

O23 - Service: DomainService - - C:\WINDOWS\system32\ucxqapia.exe

O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe

O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: MATLAB Server (matlabserver) - Unknown owner - C:\Program Files\MATLAB71\webserver\bin\win32\matlabserver.exe

O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe

O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe

O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe

O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe

O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe

O23 - Service: Swupdtmr - Unknown owner - c:\TOSHIBA\IVP\swupdate\swupdtmr.exe

--

End of file - 9431 bytes

Do you think this Vundo Trojan was the main problem, or what are the next steps? Thanks again for your help.

Link to post
Share on other sites
JeanInMontana

JeanInMontana

Posted
Posted

You are still seriously infected. Be patient and persistant.

Please scan the following files here http://www.virustotal.com

C:\Program Files\fyrqpedo\dofetsvs.dll

C:\Documents and Settings\All Users\Application Data\lwxahujo.dll

C:\Documents and Settings\All Users\Application Data\gpmvsnyz.dll

C:\Documents and Settings\All Users\Application Data\ninyrgbg.dll

C:\Documents and Settings\All Users\Application Data\topevkzs.dll

You will have to do one at a time and maybe be in a wait "line" please post what the results are.

Now I need you to run these scans also.

Download SDFix and save it to your Desktop.

Double click SDFix.exe and choose Install to extract it to its own folder on the Desktop. Please then reboot your computer in Safe Mode by doing the following :

  • Restart your computer
  • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
  • Instead of Windows loading as normal, the Advanced Options Menu should appear;
  • Select the first option, to run Windows in Safe Mode, then press Enter.
  • Choose your usual account.
  • Open the extracted SDFix folder and double click RunThis.bat to start the script.
  • Type Y to begin the cleanup process.
  • It will remove any Trojan Services or Registry Entries found then prompt you to press any key to Reboot.
  • Press any Key and it will restart the PC.
  • When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
  • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt.
  • Finally copy and paste the contents of the results file Report.txt back onto the forum.

After you post that log I need the results from this scan also please.

1. Download this file :

http://www.techsupportforum.com/sectools/combofix.exe

2. Double click combofix.exe & follow the prompts.

3. When finished, it shall produce a log for you. Post that log and a HiJack log in your next reply

Note:

Do not mouseclick combofix's window while its running. That may cause it to stall

Then a HJT log but remove the version your using and get this one please: HiJack This!

Link to post
Share on other sites
mvz2102

mvz2102

Posted
  • Author
Posted

Hi there.

Here is the log of the virus scan on the first file you requested. That was the only one I was able to do,

because the other files in the Application Data folder didn't exist. This may have something to due with my trying to

use HiJackThis to fix the problems last week, and removing a few of the files that I didn't recognize. Now, every time

I boot up my computer, it flashes a few messages indicating that those files were unable to load.

File dofetsvs.dll received on 11.21.2007 22:23:12 (CET)

Antivirus Version Last Update Result

AhnLab-V3 2007.11.22.0 2007.11.21 -

AntiVir 7.6.0.34 2007.11.21 TR/Dldr.Zlob.Gen

Authentium 4.93.8 2007.11.21 -

Avast 4.7.1074.0 2007.11.21 -

AVG 7.5.0.503 2007.11.21 Downloader.Zlob.RBQ

BitDefender 7.2 2007.11.21 -

CAT-QuickHeal 9.00 2007.11.21 -

ClamAV 0.91.2 2007.11.21 -

DrWeb 4.44.0.09170 2007.11.21 -

eSafe 7.0.15.0 2007.11.14 -

eTrust-Vet 31.3.5313 2007.11.21 Win32/Kewrih.G

Ewido 4.0 2007.11.21 -

FileAdvisor 1 2007.11.21 -

Fortinet 3.14.0.0 2007.11.21 -

F-Prot 4.4.2.54 2007.11.21 -

F-Secure 6.70.13030.0 2007.11.21 Trojan-Downloader.Win32.Zlob.ejm

Ikarus T3.1.1.12 2007.11.21 Trojan-Downloader.Win32.Zlob.ejm

Kaspersky 7.0.0.125 2007.11.21 Trojan-Downloader.Win32.Zlob.ejm

McAfee 5168 2007.11.21 -

Microsoft 1.3007 2007.11.21 -

NOD32v2 2676 2007.11.21 Win32/Adware.UltimateDefender

Norman 5.80.02 2007.11.21 Zlob.gen94

Panda 9.0.0.4 2007.11.21 Adware/UltimateDefender

Prevx1 V2 2007.11.21 -

Rising 20.19.21.00 2007.11.21 -

Sophos 4.23.0 2007.11.21 Troj/Virtum-Gen

Sunbelt 2.2.907.0 2007.11.21 IEDefender

Symantec 10 2007.11.21 -

TheHacker 6.2.9.136 2007.11.21 -

VBA32 3.12.2.5 2007.11.20 Trojan-Downloader.Win32.Zlob.ejm

VirusBuster 4.3.26:9 2007.11.21 -

Webwasher-Gateway 6.0.1 2007.11.21 Trojan.Dldr.Zlob.Gen

Additional information

File size: 57344 bytes

MD5: 1b0de76441a4d2bbe30a4363f6a4c4da

SHA1: 985bccac04f41130432d5eda3dc01f5e3a1cc9ce

SDFix Log:

SDFix: Version 1.115

Run by Max on Wed 11/21/2007 at 04:46 PM

Microsoft Windows XP [Version 5.1.2600]

Running From: C:\DOCUME~1\Max\Desktop\SDFix

Safe Mode:

Checking Services:

Restoring Windows Registry Values

Restoring Windows Default Hosts File

Rebooting...

Normal Mode:

Checking Files:

No Trojan Files Found

Removing Temp Files...

ADS Check:

C:\WINDOWS

No streams found.

C:\WINDOWS\system32

No streams found.

C:\WINDOWS\system32\svchost.exe

No streams found.

C:\WINDOWS\system32\ntoskrnl.exe

No streams found.

Final Check:

catchme 0.3.1262.1 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net

Rootkit scan 2007-11-21 16:57:24

Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden services & system hive ...

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg]

"s1"=dword:2df9c43f

"s2"=dword:110480d0

"h0"=dword:00000001

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]

"p0"="C:\Program Files\DAEMON Tools\"

"h0"=dword:00000000

"khjeh"=hex:79,de,69,3d,32,f7,b7,01,ca,91,14,43,d8,15,b0,1e,70,96,5e,90,10,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]

"a0"=hex:20,01,00,00,35,1b,26,4c,c2,5b,eb,6f,fd,d5,ed,26,13,fc,77,68,cb,..

"khjeh"=hex:04,2e,7d,2f,29,06,b7,a3,5a,83,e5,1d,54,cd,34,c3,dd,8b,06,92,8d,..

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]

"khjeh"=hex:be,93,4f,6d,5a,ca,06,38,9e,6b,8a,83,a6,b3,05,76,c5,e1,0d,0c,66,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4]

"p0"="C:\Program Files\DAEMON Tools\"

"h0"=dword:00000000

"khjeh"=hex:79,de,69,3d,32,f7,b7,01,ca,91,14,43,d8,15,b0,1e,70,96,5e,90,10,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001]

"a0"=hex:20,01,00,00,35,1b,26,4c,c2,5b,eb,6f,fd,d5,ed,26,13,fc,77,68,cb,..

"khjeh"=hex:04,2e,7d,2f,29,06,b7,a3,5a,83,e5,1d,54,cd,34,c3,dd,8b,06,92,8d,..

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\sptd\Cfg\19659239224E364682FA4BAF72C53EA4\00000001\0Jf40]

"khjeh"=hex:be,93,4f,6d,5a,ca,06,38,9e,6b,8a,83,a6,b3,05,76,c5,e1,0d,0c,66,..

scanning hidden registry entries ...

scanning hidden files ...

scan completed successfully

hidden processes: 0

hidden services: 0

hidden files: 0

Remaining Services:

------------------

Authorized Application Key Export:

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\\Program Files\\uTorrent\\uTorrent.exe"="C:\\Program Files\\uTorrent\\uTorrent.exe:*:Enabled:

Link to post
Share on other sites
JeanInMontana

JeanInMontana

Posted
Posted

Hi again. Hope you had a good Thanksgiving Holiday, if you celebrate.

Make sure you have your system set to show hidden files. This maybe why you couldn't find the ones requested to scan.

Please set your system to show

all files; Click Start.

Open My Computer.

Select the Tools menu and click Folder Options.

Select the View Tab.

Under the Hidden files and folders heading select Show hidden files and folders.

Uncheck the Hide protected operating system files (recommended) option.

Click Yes to confirm.

Click OK.

Now let's clean up a bit with HJT, please put a check next to the items below and click fix when

done.

O2 - BHO: (no name) - {200D0AAD-71B1-51C9-DDB0-092BA4662A54} - C:\Program Files\Dbycjzow\ohirtsbs.dll

O2 - BHO: (no name) - {2C80EAD3-74CD-4700-83A4-AA878CD1C03C} - C:\WINDOWS\system32\cbxwtus.dll

O2 - BHO: (no name) - {4AE396DB-00D3-4284-825C-4D15D09EB15F} - C:\WINDOWS\system32\khfcb.dll (file missing)

O9 - Extra button: (no name) - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - (no file)

O20 - Winlogon Notify: kgapqhtv - kgapqhtv.dll (file missing)

O20 - Winlogon Notify: winocp32 - winocp32.dll (file missing)

Reboot and run this please:

Print or Copy these instructions to notepad and save to your Desktoop as you will be offline with all browsers closed for this fix.

Download:

Use this URL to download the latest version (the file contains both English and French versions):

http://siri.urz.free.fr/Fix/SmitfraudFix.exe

* Double-click SmitfraudFix.exe

* Select 1 and hit Enter to create a report of the infected files. The report can be found at the root of the system drive, usually at C:\rapport.txt

Clean:

* Reboot your computer in Safe Mode (before the Windows icon appears, tap the F8 key continually)

* Double-click SmitfraudFix.exe

* Select 2 and hit Enter to delete infect files.

* You will be prompted: Do you want to clean the registry ? answer Y (yes) and hit Enter in order to remove the Desktop background and clean registry keys associated with the infection.

* The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found): Replace infected file ? answer Y (yes) and hit Enter to restore a clean file.

* A reboot may be needed to finish the cleaning process. The report can be found at the root of the system drive, usually at C:\rapport.txt

* Optional:

o To restore Trusted and Restricted site zone, select 3 and hit Enter.

o You will be prompted: Restore Trusted Zone ? answer Y (yes) and hit Enter to delete trusted zone.

Note:

process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool". It is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.

http://www.beyondlogic.org/consulting/proc...processutil.htm

Post this log and a new HJT log. You also need to remove your current version of Java, delete the program file also and get that latest version. You need to uninstall it via Add/Remove programs and delete the program file also. Then go here http://www.java.com/en/download/manual.jsp and install the correct version for your system. Choose the offline installation.

Link to post
Share on other sites
JeanInMontana

JeanInMontana

Posted
Posted

Five days no response I will close this topic. Should you decide to continue with the fixes send me a PM.

Advice in this topic is for this system only. Applying to your system can be ruination. If you need help open your own topic and someone will be happy to help you.

Link to post
Share on other sites
Guest
This topic is now closed to further replies.
 Share
Go to topic listing

  • Recently Browsing   0 members

    • No registered users viewing this page.
Back to top
×
×
  • Create New...

Important Information

This site uses cookies - We have placed cookies on your device to help make this website better. You can adjust your cookie settings, otherwise we'll assume you're okay to continue.