joe9000 Posted October 22, 2008 ID:31852 Share Posted October 22, 2008 my mcafee has recently picked this sft_ver1.1454.0.exe up as trying to connec tto internt but found out its some sort of spyware,but when trying to delete it it just appears again a couple of days later,have used malwarebytes anti malware but the same when detected and deleted it just comes back,was wondering how to remove this as i dont know what it is or what it does but i wan tto get rid of it.Thanks in advance.heres hijackthis log file report!!Logfile of HijackThis v1.99.1Scan saved at 18:16:15, on 22/10/2008Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)Running processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exeC:\PROGRA~1\McAfee\MSC\mcmscsvc.exec:\program files\common files\mcafee\mna\mcnasvc.exec:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exeC:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exeC:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exeC:\Program Files\McAfee\MPF\MPFSrv.exeC:\Program Files\McAfee\MSK\MskSrver.exeC:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exeC:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exeC:\WINDOWS\system32\nvsvc32.exeC:\Program Files\SiteAdvisor\6145\SAService.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exeC:\WINDOWS\system32\wscntfy.exec:\PROGRA~1\mcafee.com\agent\mcagent.exeC:\WINDOWS\Explorer.EXEC:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exeC:\Program Files\SiteAdvisor\6145\SiteAdv.exeC:\WINDOWS\SOUNDMAN.EXEC:\Documents and Settings\joe\Application Data\Adobe\Player.exeC:\DOCUME~1\joe\LOCALS~1\Temp\sft_ver1.1454.0.exeC:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exeC:\Program Files\HijackThis\HijackThis.exeR1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6145\SiteAdv.dllO2 - BHO: McAfee Phishing Filter - {27B4851A-3207-45A2-B947-BE8AFE6163AB} - c:\PROGRA~1\mcafee\msk\mskapbho.dllO2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\PROGRA~1\mcafee\VIRUSS~1\scriptsn.dllO3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6145\SiteAdv.dllO4 - HKLM\..\Run: [nTrayFw] C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nTrayFw.exeO4 - HKLM\..\Run: [siteAdvisor] C:\Program Files\SiteAdvisor\6145\SiteAdv.exeO4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hideO4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkeyO4 - HKLM\..\Run: [nwiz] nwiz.exe /installO4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [soundMan] SOUNDMAN.EXEO4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exeO4 - HKCU\..\Run: [Player] C:\Documents and Settings\joe\Application Data\Adobe\Player.exeO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dllO10 - Unknown file in Winsock LSP: c:\windows\system32\nvappfilter.dllO18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6145\SiteAdv.dllO20 - Winlogon Notify: dimsntfy - %SystemRoot%\System32\dimsntfy.dll (file missing)O23 - Service: ForceWare Intelligent Application Manager (IAM) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcAppFlt.exeO23 - Service: Forceware Web Interface (ForcewareWebInterface) - Unknown owner - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\Apache Group\Apache2\bin\apache.exe" -k runservice (file missing)O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exeO23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exeO23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exeO23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exeO23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exeO23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exeO23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exeO23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exeO23 - Service: ForceWare IP service (nSvcIp) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcIp.exeO23 - Service: ForceWare user log service (nSvcLog) - NVIDIA - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin\nSvcLog.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exeO23 - Service: SiteAdvisor Service - Unknown owner - C:\Program Files\SiteAdvisor\6145\SAService.exeO23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exeand heres malwarebytes log fileMalwarebytes' Anti-Malware 1.29Database version: 1306Windows 5.1.2600 Service Pack 322/10/2008 17:53:58mbam-log-2008-10-22 (17-53-52).txtScan type: Full Scan (C:\|)Objects scanned: 64677Time elapsed: 17 minute(s), 49 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 4Registry Data Items Infected: 0Folders Infected: 1Files Infected: 12Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yurbc.exe (Trojan.Agent) -> No action taken.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yurc1.exe (Trojan.Agent) -> No action taken.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yurc2.exe (Trojan.Agent) -> No action taken.HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\\yurc3.exe (Trojan.Agent) -> No action taken.Registry Data Items Infected:(No malicious items detected)Folders Infected:C:\Program Files\PCHealthCenter (Trojan.Fakealert) -> No action taken.Files Infected:C:\Documents and Settings\joe\Local Settings\Temp\IXP000.TMP\ZUJDGAC.sys (Trojan.Agent) -> No action taken.C:\Documents and Settings\joe\Local Settings\Temp\IXP001.TMP\ZUJDGAC.sys (Trojan.Agent) -> No action taken.C:\Documents and Settings\joe\My Documents\Newsbin Download\genuine\Windows_Genuine_Advantage_Validation_v1_8_31_uploaded_by_nathan\Setup.exe (Backdoor.Bot) -> No action taken.C:\Program Files\PCHealthCenter\0.gif (Trojan.Fakealert) -> No action taken.C:\Program Files\PCHealthCenter\1.gif (Trojan.Fakealert) -> No action taken.C:\Program Files\PCHealthCenter\1.ico (Trojan.Fakealert) -> No action taken.C:\Program Files\PCHealthCenter\2.gif (Trojan.Fakealert) -> No action taken.C:\Program Files\PCHealthCenter\2.ico (Trojan.Fakealert) -> No action taken.C:\Program Files\PCHealthCenter\3.gif (Trojan.Fakealert) -> No action taken.C:\Program Files\PCHealthCenter\foo.txt (Trojan.Fakealert) -> No action taken.C:\Program Files\PCHealthCenter\sc.html (Trojan.Fakealert) -> No action taken.C:\Documents and Settings\joe\Local Settings\Temp\sft_ver1.1454.0.exe (Trojan.FakeAlert) -> No action taken. Link to post Share on other sites More sharing options...
JeanInMontana Posted October 22, 2008 ID:31879 Share Posted October 22, 2008 Hello Joe9000 and welcome to Malwarebytes. You are not taking action when you scan with MBAM. Please update MBAM run another quick scan and post that log and then get the correct version of HJT and follow the rest of these instructions here http://www.malwarebytes.org/forums/index.php?showtopic=2936 Link to post Share on other sites More sharing options...
JeanInMontana Posted October 23, 2008 ID:31978 Share Posted October 23, 2008 Since you have started another thread and it shows illegal activity I will close this thread. Do Not open another topic. Link to post Share on other sites More sharing options...
Recommended Posts