A Plea for Help 2

Scansy · February 19, 2008

Hello all. I have been experiencing annoying pop-ups (even with pop-blockers in use). They have been for all kinds of stuff, including warnings about virus threats so download our software, etc. Norton is finding regular attacks from Downloader.MisleadApp and stopping them. The problems started shortly after I upgraded to Norton Internet Security 2008 (from 2007).

Here is my Hijackthis log.

Thanks in advance for any help.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:32:19 PM, on 2/19/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\Program Files\Common Files\Symantec Shared\ccProxy.exe

C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe

C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe

C:\WINDOWS\System32\CTsvcCDA.exe

C:\WINDOWS\system32\crypserv.exe

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Viewpoint\Common\ViewpointService.exe

C:\WINDOWS\wanmpsvc.exe

C:\WINDOWS\System32\WFXSVC.EXE

C:\Program Files\WinFax\WFXMOD32.EXE

C:\WINDOWS\System32\MsPMSPSv.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

C:\WINDOWS\system32\ctfmon.exe

C:\WINDOWS\BCMSMMSG.exe

C:\WINDOWS\system32\dla\tfswctrl.exe

C:\WINDOWS\System32\DSentry.exe

C:\Program Files\Dell\Media Experience\PCMService.exe

C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe

C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe

C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe

C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe

C:\PROGRA~1\WinFax\WFXSWTCH.exe

C:\WINDOWS\system32\wfxsnt40.exe

C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe

C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

C:\PROGRA~1\MUSICM~1\MUSICM~2\MMDiag.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe

C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe

C:\Program Files\SmartDisk\FlashPath\sdstat.exe

C:\Program Files\Intuit\QuickBooks\Components\QBAgent\QBDAgent.exe

C:\Program Files\WinZip\WZQKPICK.EXE

C:\WINDOWS\system32\mrtMngr.EXE

C:\Program Files\Internet Explorer\iexplore.exe

C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE

C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE

C:\Program Files\Common Files\Symantec Shared\Privacy Control\ccEmFlSv.exe

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com/

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: (no name) - {5B8D7726-E61D-403D-B9C4-FB30463806Eb} - C:\WINDOWS\system32\pplywarx.dll

O2 - BHO: NCO 2.0 IE BHO - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll

O2 - BHO: Symantec Intrusion Prevention - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O2 - BHO: ATLDistrib Object - {93C6313C-9DB4-4694-8BD0-E378C573A9AD} - C:\WINDOWS\system32\gebyy.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll

O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll

O2 - BHO: (no name) - {B8C5186E-EC37-4889-9C2E-F73649FFB7BB} - C:\Program Files\Video ActiveX Access\iesplg.dll (file missing)

O2 - BHO: (no name) - {F2FA09FB-EE7A-46d8-9145-A1EEF7850052} - C:\WINDOWS\system32\mlljj.dll (file missing)

O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll

O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll

O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe

O4 - HKLM\..\Run: [bCMSMMSG] BCMSMMSG.exe

O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe

O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe

O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe

O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"

O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [MMTray] "C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe"

O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe

O4 - HKLM\..\Run: [share-to-Web Namespace Daemon] C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

O4 - HKLM\..\Run: [DeviceDiscovery] C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe"

O4 - HKLM\..\Run: [updateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r

O4 - HKLM\..\Run: [WFXSwtch] C:\PROGRA~1\WinFax\WFXSWTCH.exe

O4 - HKLM\..\Run: [WinFaxAppPortStarter] wfxsnt40.exe

O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"

O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe

O4 - HKLM\..\Run: [crqh32.exe] C:\WINDOWS\system32\crqh32.exe

O4 - HKLM\..\Run: [Windows AdStatus] C:\Program Files\Windows AdStatus\WinStat.exe

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [tibs5] C:\WINDOWS\System32\tibs5.exe

O4 - HKLM\..\Run: [AdobeVersionCue] C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe

O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"

O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"

O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"

O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Firewall auto setup] C:\DOCUME~1\PAULSC~1\LOCALS~1\Temp\winlogon.exe

O4 - HKCU\..\Run: [Windows update loader] C:\Windows\xpupdate.exe

O4 - HKLM\..\Policies\Explorer\Run: [rare] C:\Program Files\Video ActiveX Access\imsmain.exe

O4 - HKLM\..\Policies\Explorer\Run: [user32.dll] C:\Program Files\Video ActiveX Access\iesmn.exe

O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe

O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe

O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart16.exe

O4 - Global Startup: FlashPath Monitor.lnk = C:\Program Files\SmartDisk\FlashPath\sdstat.exe

O4 - Global Startup: QuickBooks Delivery Agent.lnk = C:\Program Files\Intuit\QuickBooks\Components\QBAgent\QBDAgent.exe

O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE

O8 - Extra context menu item: &Search - http://bar.mywebsearch.com/menusearch.html?p=ZZ

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O15 - Trusted Zone: *.frame.crazywinnings.com (HKLM)

O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

O16 - DPF: {1A26F07F-0D60-4835-91CF-1E1766A0EC56} (WebInstall Class) - http://scanner2.malware-scan.com/setup/webinst.cab

O16 - DPF: {200B3EE9-7242-4EFD-B1E4-D97EE825BA53} (VerifyGMN Class) - http://h20270.www2.hp.com/ediags/gmn/insta...staller_gmn.cab

O16 - DPF: {2253F320-AB68-4A07-917D-4F12D8884A06} (ChainCast VMR Client Proxy) - http://www.streamaudio.com/download/ccpm_0237.cab

O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab

O16 - DPF: {78AF2F24-A9C3-11D3-BF8C-0060B0FCC122} (AcDcToday Control) - file://C:\Program Files\AutoCAD 2002\AcDcToday.ocx

O16 - DPF: {AE563720-B4F5-11D4-A415-00108302FDFD} (NOXLATE-BANR) - file://C:\Program Files\AutoCAD 2002\InstBanr.ocx

O16 - DPF: {C6637286-300D-11D4-AE0A-0010830243BD} (InstaFred) - file://C:\Program Files\AutoCAD 2002\InstFred.ocx

O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://i.grab.com/media/6512bd/games/files...aploader_v6.cab

O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/...379/mcfscan.cab

O16 - DPF: {F281A59C-7B65-11D3-8617-0010830243BD} (AcPreview Control) - file://C:\Program Files\AutoCAD 2002\AcPreview.ocx

O18 - Protocol: x-cnote - {8D32BA61-D15B-11D4-894B-000000000000} - C:\WINDOWS\SYSTEM32\hsppp.dll

O20 - Winlogon Notify: gebyy - C:\WINDOWS\system32\gebyy.dll

O20 - Winlogon Notify: mlljj - mlljj.dll (file missing)

O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe

O23 - Service: AdobeVersionCue - Adobe Sytems - C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe

O23 - Service: AOL Connectivity Service (AOL ACS) - America Online, Inc. - C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe

O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe

O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe

O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe

O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe

O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.exe

O23 - Service: Crypkey License - Kenonic Controls Ltd. - C:\WINDOWS\SYSTEM32\crypserv.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: hpdj - Unknown owner - C:\DOCUME~1\PAULSC~1\LOCALS~1\Temp\hpdj.exe (file missing)

O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE

O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe

O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe

O23 - Service: WinFax PRO (wfxsvc) - Symantec Corporation - C:\WINDOWS\System32\WFXSVC.EXE

O23 - Service: Remote Procedure Call (RPC) Helper (

JeanInMontana · February 19, 2008

Hi Scansy and welcome to Malwarebytes. Please follow the instructions here http://www.malwarebytes.org/forums/index.php?showtopic=2936

Scansy · February 20, 2008

Thanks Jean. I will do all of that first.

Scansy · February 20, 2008

Here is the Malwarebytes log. I'll run the pandaactivescan next

Malwarebytes' Anti-Malware 1.04

Database version: 385

Scan type: Full Scan (A:\|C:\|D:\|)

Objects scanned: 200005

Time elapsed: 1 hour(s), 47 minute(s), 53 second(s)

Memory Processes Infected: 0

Memory Modules Infected: 0

Registry Keys Infected: 21

Registry Values Infected: 0

Registry Data Items Infected: 0

Folders Infected: 1

Files Infected: 3

Memory Processes Infected:

(No malicious items detected)

Memory Modules Infected:

(No malicious items detected)

Registry Keys Infected:

HKEY_CLASSES_ROOT\malwarealarm.webinstall (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\malwarealarm.webinstall.1 (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{1a26f07f-0d60-4835-91cf-1e1766a0ec56} (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{1a26f07f-0d60-4835-91cf-1e1766a0ec56} (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\Typelib\{7543fbd5-2279-4d03-8f29-eb21531fa2fe} (Trojan.Agent) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\ntservice.control.1 (BackDoor.Dimpy) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{e7bc34a3-ba86-11cf-84b1-cbc2da68bf6c} (BackDoor.Dimpy) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\atldistrib.atldistrib (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\atldistrib.atldistrib.1 (Trojan.Vundo) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Features\4301aebd288588a40833184cfec0af92 (Adware.UUSee) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Installer\Products\4301aebd288588a40833184cfec0af92 (Adware.UUSee) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Products\4301aebd288588a40833184cfec0af92 (Adware.UUSee) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\AppID\{4a3d609a-43b8-4406-b793-84f244246325} (Rogue.Multiple) -> Quarantined and deleted successfully.

HKEY_CURRENT_USER\Software\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{ad8ec84e-600f-11d6-aec4-0000c0a675b5} (Trojan.Downloader) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{ad8ec852-600f-11d6-aec4-0000c0a675b5} (Trojan.Downloader) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{2137dab8-b070-11d2-ba72-0020afdd8935} (Trojan.Downloader) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\CLSID\{2137dabb-b070-11d2-ba72-0020afdd8935} (Trojan.Downloader) -> Quarantined and deleted successfully.

HKEY_CLASSES_ROOT\AppID\webinst.dll (Rogue.Multiple) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ICF (Rootkit.Agent) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

Registry Values Infected:

(No malicious items detected)

Registry Data Items Infected:

(No malicious items detected)

Folders Infected:

C:\DOCUME~1\Paul Scansaroli\LOCALS~1\Temp\NI.UGA6P_0001_N120M1710 (Rogue.Multiple) -> Quarantined and deleted successfully.

Files Infected:

C:\Documents and Settings\Paul Scansaroli\Local Settings\Temp\NI.UGA6P_0001_N120M1710\settings.ini (Rogue.Multiple) -> Quarantined and deleted successfully.

C:\WINDOWS\SYSTEM32\basex232.dll (Trojan.Downloader) -> Quarantined and deleted successfully.

C:\WINDOWS\SYSTEM32\basex32.dll (Trojan.Downloader) -> Quarantined and deleted successfully.

Scansy · February 21, 2008

Here is the pandaactivescan log

Now I will move on to the hijack this scan

Incident Status Location

Potentially unwanted tool:application/winfixer2005 Not disinfected c:\windows\downloaded program files\UGA6P_0001_N120M1710NetInstaller.exe

Adware:adware/wupd Not disinfected c:\program files\Windows AdStatus

Dialer:dialer.bb Not disinfected hkey_local_machine\software\microsoft\windows\currentversion\run\tibs5

Virus:trj/downloader.coy Disinfected Operating system

Adware:adware/beginto Not disinfected Windows Registry

Spyware:spyware/media-motor Not disinfected Windows Registry

Adware:adware/ieplugin Not disinfected Windows Registry

Adware:adware/wintools Not disinfected Windows Registry

Spyware:spyware/betterinet Not disinfected Windows Registry

Adware:adware/exact.bargainbuddy Not disinfected Windows Registry

Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Paul Scansaroli\Cookies\paul scansaroli@247realmedia[1].txt

Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Paul Scansaroli\Cookies\paul scansaroli@ad.yieldmanager[2].txt

Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Paul Scansaroli\Cookies\paul scansaroli@ads.pointroll[1].txt

Spyware:Cookie/AdvancedCleaner Not disinfected C:\Documents and Settings\Paul Scansaroli\Cookies\paul scansaroli@advancedcleaner[2].txt

Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Paul Scansaroli\Cookies\paul scansaroli@advertising[2].txt

Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Paul Scansaroli\Cookies\paul scansaroli@apmebf[2].txt

Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Paul Scansaroli\Cookies\paul scansaroli@atdmt[2].txt

Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Paul Scansaroli\Cookies\paul scansaroli@fastclick[2].txt

Spyware:Cookie/Findwhat Not disinfected C:\Documents and Settings\Paul Scansaroli\Cookies\paul scansaroli@findwhat[1].txt

Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Paul Scansaroli\Cookies\paul scansaroli@mediaplex[1].txt

Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Paul Scansaroli\Cookies\paul scansaroli@overture[1].txt

Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Paul Scansaroli\Cookies\paul scansaroli@realmedia[2].txt

Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\Documents and Settings\Paul Scansaroli\Cookies\paul scansaroli@server.iad.liveperson[2].txt

Spyware:Cookie/onestat.com Not disinfected C:\Documents and Settings\Paul Scansaroli\Cookies\paul scansaroli@stat.onestat[2].txt

Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\Paul Scansaroli\Cookies\paul scansaroli@trafficmp[2].txt

Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Paul Scansaroli\Cookies\paul scansaroli@tribalfusion[1].txt

Spyware:Cookie/BurstBeacon Not disinfected C:\Documents and Settings\Paul Scansaroli\Cookies\paul scansaroli@www.burstbeacon[1].txt

Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Paul Scansaroli\Local Settings\Temp\Cookies\paul scansaroli@ad.yieldmanager[1].txt

Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Paul Scansaroli\Local Settings\Temp\Cookies\paul scansaroli@adrevolver[2].txt

Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Paul Scansaroli\Local Settings\Temp\Cookies\paul scansaroli@advertising[1].txt

Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Paul Scansaroli\Local Settings\Temp\Cookies\paul scansaroli@apmebf[1].txt

Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Paul Scansaroli\Local Settings\Temp\Cookies\paul scansaroli@atdmt[2].txt

Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Paul Scansaroli\Local Settings\Temp\Cookies\paul scansaroli@casalemedia[1].txt

Spyware:Cookie/Hitslink Not disinfected C:\Documents and Settings\Paul Scansaroli\Local Settings\Temp\Cookies\paul scansaroli@counter.hitslink[1].txt

Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Paul Scansaroli\Local Settings\Temp\Cookies\paul scansaroli@doubleclick[2].txt

Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Paul Scansaroli\Local Settings\Temp\Cookies\paul scansaroli@fastclick[2].txt

Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Paul Scansaroli\Local Settings\Temp\Cookies\paul scansaroli@mediaplex[1].txt

Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\Paul Scansaroli\Local Settings\Temp\Cookies\paul scansaroli@statse.webtrendslive[2].txt

Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Paul Scansaroli\Local Settings\Temp\Cookies\paul scansaroli@tribalfusion[1].txt

Potentially unwanted tool:Application/AVSystemCare Not disinfected C:\Documents and Settings\Paul Scansaroli\Local Settings\Temporary Internet Files\Content.IE5\H01KLD5F\installer_en[1].cab[uGDC_0001_N122M0502NetInstaller.exe]

Adware:Adware/ErrClean Not disinfected C:\Documents and Settings\Paul Scansaroli\Local Settings\Temporary Internet Files\Content.IE5\WJFJ5DH0\setup_en[1].cab[uGES_0001_N122M0502NetInstaller.exe]

Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Shelly Scansaroli\Cookies\shelly scansaroli@ehg-dig.hitbox[2].txt

Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Shelly Scansaroli\Cookies\shelly scansaroli@go[2].txt

Possible Virus. Not disinfected C:\Program Files\InstallShield Installation Information\{7F142D56-3326-11D5-B229-002078017FBF}\Setup.exe

Spyware:Cookie/Weborama Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc1032.txt

Spyware:Cookie/Winantivirus Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc1042.txt

Spyware:Cookie/BurstBeacon Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc1116.txt

Spyware:Cookie/RealMedia Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc118.txt

Spyware:Cookie/myaffiliateprogram Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc1222.txt

Spyware:Cookie/Xiti Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc1335.txt

Spyware:Cookie/Yadro Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc1338.txt

Spyware:Cookie/Zedo Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc1345.txt

Spyware:Cookie/YieldManager Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc154.txt

Spyware:Cookie/Adrevolver Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc161.txt

Spyware:Cookie/AdDynamix Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc162.txt

Spyware:Cookie/PointRoll Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc167.txt

Spyware:Cookie/Advertising Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc171.txt

Spyware:Cookie/Apmebf Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc196.txt

Spyware:Cookie/Atlas DMT Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc208.txt

Spyware:Cookie/Bluestreak Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc241.txt

Spyware:Cookie/bravenetA Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc249.txt

Spyware:Cookie/Serving-sys Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc255.txt

Spyware:Cookie/Casalemedia Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc276.txt

Spyware:Cookie/Ccbill Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc287.txt

Spyware:Cookie/Cgi-bin Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc294.txt

Spyware:Cookie/Cgi-bin Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc295.txt

Spyware:Cookie/Com.com Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc320.txt

Spyware:Cookie/Sextracker Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc333.txt

Spyware:Cookie/Hitslink Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc334.txt

Spyware:Cookie/Doubleclick Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc387.txt

Spyware:Cookie/DriveCleaner Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc392.txt

Spyware:Cookie/Hitbox Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc418.txt

Spyware:Cookie/FastClick Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc467.txt

Spyware:Cookie/Go Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc500.txt

Spyware:Cookie/GoStats Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc507.txt

Spyware:Cookie/Screensavers Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc546.txt

Spyware:Cookie/Mediaplex Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc642.txt

Spyware:Cookie/Overture Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc730.txt

Spyware:Cookie/Overture Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc744.txt

Spyware:Cookie/QuestionMarket Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc776.txt

Spyware:Cookie/Searchportal Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc844.txt

Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc846.txt

Spyware:Cookie/Serving-sys Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc848.txt

Spyware:Cookie/Sextracker Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc853.txt

Spyware:Cookie/SpyLog Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc880.txt

Spyware:Cookie/onestat.com Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc884.txt

Spyware:Cookie/Statcounter Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc885.txt

Spyware:Cookie/Reliablestats Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc889.txt

Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc891.txt

Spyware:Cookie/Traffic Marketplace Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc965.txt

Spyware:Cookie/Tribalfusion Not disinfected C:\RECYCLER\S-1-5-21-1941108434-3882185040-454733581-1008\Dc970.txt

Possible Virus. Not disinfected C:\WINDOWS\Downloaded Program Files\UPRP_0001_D21M2103NetInstaller.exe

Potentially unwanted tool:Application/Processor Not disinfected C:\WINDOWS\SYSTEM32\Process.exe

Scansy · February 21, 2008

Here is the hijack this log.

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 4:28:54 AM, on 2/21/2008

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Boot mode: Normal

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\System32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\Program Files\Common Files\Symantec Shared\ccProxy.exe

C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

C:\WINDOWS\system32\spoolsv.exe

C:\PROGRA~1\COMMON~1\AOL\ACS\acsd.exe

C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe

C:\WINDOWS\System32\CTsvcCDA.exe

C:\WINDOWS\system32\crypserv.exe

C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe

C:\WINDOWS\System32\svchost.exe

C:\Program Files\Viewpoint\Common\ViewpointService.exe

C:\WINDOWS\wanmpsvc.exe

C:\WINDOWS\System32\WFXSVC.EXE

C:\Program Files\WinFax\WFXMOD32.EXE

C:\WINDOWS\System32\MsPMSPSv.exe

C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\BCMSMMSG.exe

C:\WINDOWS\system32\dla\tfswctrl.exe

C:\WINDOWS\System32\DSentry.exe

C:\Program Files\Dell\Media Experience\PCMService.exe

C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe

C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

C:\WINDOWS\System32\spool\drivers\w32x86\3\hpztsb09.exe

C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnd.exe

C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe

C:\Program Files\Hewlett-Packard\HP Software Update\HPWuSchd.exe

C:\Program Files\Hewlett-Packard\HP Share-to-Web\hpgs2wnf.exe

C:\PROGRA~1\WinFax\WFXSWTCH.exe

C:\WINDOWS\system32\wfxsnt40.exe

C:\Program Files\HP\hpcoretech\hpcmpmgr.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe

C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe

C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe

C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mim.exe

C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\MMDiag.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe

C:\Program Files\SmartDisk\FlashPath\sdstat.exe

C:\Program Files\Intuit\QuickBooks\Components\QBAgent\QBDAgent.exe

C:\WINDOWS\system32\mrtMngr.EXE

C:\Program Files\WinZip\WZQKPICK.EXE

C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com/

R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll

O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\ActiveX\AcroIEHelper.dll

O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll