brorobo Posted December 2, 2008 ID:37418 Share Posted December 2, 2008 Yesterday I downloaded WinRar from cnet.com to open a .rar file. After opening and installing, I got a pop up alert box that said 'intervalhehehe...intervalhehehe...intervalhehehe...' Even if I clicked to close it, it would come back every 5 minutes or so. Whenever I tried opening a web page, I was automatically redirected to a 'Microsoft Security Center' page with the following message:Alert : Your computer have been attacked by spyware or viruses!Please download AntiSpyware to fix.Download AntiSpyware Now with the last line linking to 'http://www.antispy.com/index.htm'I was immediately suspicious, and at first couldn't find out any information because I couldn't get to a search engine. Eventually I did, and found this site. I hope someone can help me.After reading the pre-HJT instructions, I have downloaded, installed and ran Spybot Search & Destroy, as well as the immunization. That removed about 66 objects. After they were removed, the intervalhehehe alert box threw an error, and now no longer pops up.I also downloaded Malwarebytes' Anti-Malware and did a scan. The log for that pasted below as LOG #1.I did Panda Active scan as well - that log is pasted below as LOG #2.Finally, I did a Hijack This scan, posted below as LOG #3.Any help can be posted here or please contact me directly at brianr[at]kidney[dot]orgThanks in advance for looking into this.----------------------------------BEGIN LOG #1 - Malwarebytes' Anti-Malware--------------------------------------Malwarebytes' Anti-Malware 1.30Database version: 1442Windows 5.1.2600 Service Pack 312/1/2008 5:55:10 PMmbam-log-2008-12-01 (17-55-10).txtScan type: Quick ScanObjects scanned: 63001Time elapsed: 8 minute(s), 42 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 1Registry Data Items Infected: 1Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Explore (Trojan.Agent) -> Quarantined and deleted successfully.Registry Data Items Infected:HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowHelp (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected)-------------------------------------END LOG #1 - Malwarebytes' Anti-Malware------------------------------------------------------------------------BEGIN LOG #2 - Panda Active Scan-------------------------------------------------;***********************************************************************************************************************************************************************************ANALYSIS: 2008-12-02 11:51:38PROTECTIONS: 1MALWARE: 14SUSPECTS: 0;***********************************************************************************************************************************************************************************PROTECTIONSDescription Version Active Updated;===================================================================================================================================================================================Symantec Antivirus Corporate Edition 10.1 No Yes;===================================================================================================================================================================================MALWAREId Description Type Active Severity Disinfectable Disinfected Location;===================================================================================================================================================================================00020994 W32/Bagle.pwdzip Virus No 0 Yes No C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\Recovery\CoolWWWSearchSmartSearch.zip00139059 Cookie/Traffic Marketplace TrackingCookie No 0 Yes No C:\Documents and Settings\BrianR\Cookies\brianr@trafficmp[2].txt00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Documents and Settings\BrianR\Cookies\brianr@atdmt[2].txt00145731 Cookie/Tribalfusion TrackingCookie No 0 Yes No C:\Documents and Settings\BrianR\Cookies\brianr@tribalfusion[1].txt00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\Documents and Settings\BrianR\Cookies\brianr@com[1].txt00168090 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\BrianR\Cookies\brianr@serving-sys[2].txt00168093 Cookie/Serving-sys TrackingCookie No 0 Yes No C:\Documents and Settings\BrianR\Cookies\brianr@bs.serving-sys[1].txt00168114 Cookie/onestat.com TrackingCookie No 0 Yes No C:\Documents and Settings\BrianR\Cookies\brianr@stat.onestat[2].txt00169190 Cookie/Advertising TrackingCookie No 0 Yes No C:\Documents and Settings\BrianR\Cookies\brianr@advertising[1].txt00170495 Cookie/PointRoll TrackingCookie No 0 Yes No C:\Documents and Settings\BrianR\Cookies\brianr@ads.pointroll[2].txt00170554 Cookie/Overture TrackingCookie No 0 Yes No C:\Documents and Settings\BrianR\Cookies\brianr@overture[2].txt00171982 Cookie/QuestionMarket TrackingCookie No 0 Yes No C:\Documents and Settings\BrianR\Cookies\brianr@questionmarket[2].txt00194327 Cookie/Go TrackingCookie No 0 Yes No C:\Documents and Settings\BrianR\Cookies\brianr@go[1].txt00207338 Cookie/Target TrackingCookie No 0 Yes No C:\Documents and Settings\BrianR\Cookies\brianr@target[1].txt;===================================================================================================================================================================================SUSPECTSSent Location *n;===================================================================================================================================================================================;===================================================================================================================================================================================VULNERABILITIESId Severity Description *n;===================================================================================================================================================================================;===================================================================================================================================================================================------------------------------------END LOG #2 - Panda Active Scan------------------------------------------------------------------------------------BEGIN LOG #3 - Hijack This Scan------------------------------------------------Logfile of Trend Micro HijackThis v2.0.2Scan saved at 11:58:07 AM, on 12/2/2008Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\System32\Novell\XTAgent.exeC:\WINDOWS\system32\ibmpmsvc.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\Program Files\Symantec AntiVirus\DefWatch.exeC:\Program Files\LogMeIn\x86\RaMaint.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\PROGRA~1\SYMANT~1\VPTray.exeC:\WINDOWS\system32\TpShocks.exeC:\WINDOWS\system32\dpmw32.exeC:\WINDOWS\system32\NWTRAY.EXEC:\Program Files\LogMeIn\x86\LogMeInSystray.exeC:\Program Files\Synaptics\SynTP\SynTPLpr.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\Program Files\LogMeIn\x86\LMIGuardian.exeC:\Program Files\Java\jre1.6.0_07\bin\jusched.exeC:\Program Files\Winamp\Winampa.exeC:\Program Files\Google\Gmail Notifier\gnotify.exeC:\Program Files\Common Files\Real\Update_OB\realsched.exeC:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Skype\Phone\Skype.exeC:\Program Files\Windows Live\Messenger\MsnMsgr.ExeC:\Documents and Settings\BrianR\Local Settings\Application Data\Google\Update\GoogleUpdate.exeC:\Program Files\Maxtor\Sync\SyncServices.exeC:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEC:\Program Files\Novell\ZENworks\nalntsrv.exeC:\WINDOWS\system32\nvsvc32.exeC:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm12.exeC:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Symantec AntiVirus\Rtvscan.exeC:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exeC:\WINDOWS\System32\TPHDEXLG.exeC:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exeC:\Program Files\Lenovo\Rescue and Recovery\rrservice.exeC:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exeC:\Program Files\Lenovo\Rescue and Recovery\UpdateMonitor.exeC:\Program Files\NetDrive\wdService.exeC:\Program Files\Webroot\Spy Sweeper\SpySweeper.exeC:\Program Files\Common Files\Lenovo\Logger\logmon.exeC:\Program Files\Novell\ZENworks\wm.exeC:\Program Files\Lenovo\System Update\SUService.exeC:\Program Files\Novell\ZENworks\WMRUNDLL.EXEC:\Program Files\Windows Live\Messenger\usnsvc.exeC:\Program Files\LogMeIn\x86\LogMeIn.exeC:\Program Files\LogMeIn\x86\LMIGuardian.exeC:\Program Files\Skype\Plugin Manager\skypePM.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exeC:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exeC:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrobat.exeC:\Program Files\Internet Explorer\iexplore.exeC:\Documents and Settings\BrianR\My Documents\unzipped\WorkPrograms\HiJackThis.exeR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.localR3 - URLSearchHook: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre0.dllO1 - Hosts: 61.157.217.210 www.yahoo.comO1 - Hosts: 61.157.217.210 www.google.comO1 - Hosts: 61.157.217.210 www.google.co.ukO1 - Hosts: 61.157.217.210 www.myspace.comO1 - Hosts: 61.157.217.210 www.youtube.comO1 - Hosts: 61.157.217.210 www.facebook.comO1 - Hosts: 61.157.217.210 www.antispy.comO1 - Hosts: 61.157.217.210 www.yahoo.comO1 - Hosts: 61.157.217.210 www.yahoo.co.ukO1 - Hosts: 61.157.217.210 www.antispyware.comO1 - Hosts: 61.157.217.210 antispyware.comO1 - Hosts: 61.157.217.210 antispy.comO1 - Hosts: 61.157.217.210 www.msn.comO1 - Hosts: 123.251.143.110 www.asdfasdfd.comO1 - Hosts: 123.251.143.110 www.gg.comO1 - Hosts: 123.251.143.110 www.ghfhj.comO1 - Hosts: 123.251.143.110 www.cvnbcvnb.comO1 - Hosts: 123.251.143.110 www.1.comO1 - Hosts: 123.251.143.110 www.3.comO1 - Hosts: 123.251.143.110 www.asdf4asdfd.comO1 - Hosts: 123.251.143.110 www.asdfawsdfd.comO1 - Hosts: 123.251.143.110 www.asdfatsdfd.comO1 - Hosts: 123.251.143.110 www.asdfasdfd.comO1 - Hosts: 123.251.143.110 www.asdfadsdfd.comO1 - Hosts: 123.251.143.110 www.asdfasdfd.comO1 - Hosts: 123.251.143.110 www.asdfafsdfd.comO1 - Hosts: 123.251.143.110 www.asdfasdfd.comO1 - Hosts: 123.251.143.110 www.asdfagsdfd.comO1 - Hosts: 123.251.143.110 www.asdfasgdfd.comO1 - Hosts: 123.251.143.110 www.asdfasdhfd.comO1 - Hosts: 123.251.143.110 www.asdfasdfjd.comO1 - Hosts: 123.251.143.110 www.asdfasdfkd.comO1 - Hosts: 123.251.143.110 www.asdfasdfld.comO1 - Hosts: 123.251.143.110 www.asdfasdf,d.comO1 - Hosts: 123.251.143.110 www.asxdfasdfd.comO1 - Hosts: 123.251.143.110 www.asdzfasdfd.comO1 - Hosts: 123.251.143.110 www.asdcfasdfd.comO1 - Hosts: 123.251.143.110 www.asdfvasdfd.comO1 - Hosts: 123.251.143.110 www.asdfabsdfd.comO1 - Hosts: 123.251.143.110 www.asdfasndfd.comO1 - Hosts: 123.251.143.110 www.asdfasdmfd.comO1 - Hosts: 123.251.143.110 www.asdfasdfd.comO1 - Hosts: 123.251.143.110 www.11asdfasdfd.comO1 - Hosts: 123.251.143.110 www.as222dfasdfd.comO1 - Hosts: 123.251.143.110 www.asdfa33sdfd.comO1 - Hosts: 123.251.143.110 www.asdfasd44fd.comO1 - Hosts: 123.251.143.110 www.asdfasdfd5.comO1 - Hosts: 123.251.143.110 www.as66dfasdfd.comO1 - Hosts: 123.251.143.110 www.asdf77asdfd.comO1 - Hosts: 123.251.143.110 www.asdf8asdfd.comO1 - Hosts: 123.251.143.110 www.asdf9asdfd.comO1 - Hosts: 123.251.143.110 www.asdf0asdfd.comO1 - Hosts: 123.251.143.110 www.asdf-asdfd.comO1 - Hosts: 123.251.143.110 www.aqqsdfasdfd.comO1 - Hosts: 123.251.143.110 www.aswwdfasdfd.comO1 - Hosts: 123.16.197.121 www.asdhhfasdfdyy.comO1 - Hosts: 61.157.217.210 www.live.comO1 - Hosts: 123.251.143.110 www.asdwwwfasdfd.comO1 - Hosts: 123.251.143.110 www.asdfeasdfd.comO1 - Hosts: 123.251.143.110 www.asdfrrasdfd.comO1 - Hosts: 123.251.143.110 www.asdfttasdfd.comO1 - Hosts: 123.251.143.110 www.asdfyyasdfd.comO1 - Hosts: 123.251.143.110 www.asdfuuuasdfd.comO1 - Hosts: 123.251.143.110 www.asdfaiisdfd.comO1 - Hosts: 123.251.143.110 www.asdfaoosdfd.comO1 - Hosts: 123.251.143.110 www.asdfappsdfd.comO1 - Hosts: 123.251.143.110 www.asdfasssdfd.comO1 - Hosts: 123.251.143.110 www.aswwdfasdfd.comO1 - Hosts: 123.251.143.110 www.asdeefasdfd.comO1 - Hosts: 123.251.143.110 www.asdfffasdfd.comO1 - Hosts: 123.251.143.110 www.asdfavvvsdfd.comO1 - Hosts: 123.251.143.110 www.asnnndfasdfd.comO1 - Hosts: 123.251.143.110 www.asdmmmfasdfd.comO1 - Hosts: 123.251.143.110 www.asdfaffsdfd.comO1 - Hosts: 123.251.143.110 www.asdhhfasdfd.comO2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 9\SnagItBHO.dllO2 - BHO: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre0.dllO2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllO2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dllO2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllO2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dllO3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 9\SnagItIEAddin.dllO3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dllO3 - Toolbar: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre0.dllO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exeO4 - HKLM\..\Run: [TpShocks] TpShocks.exeO4 - HKLM\..\Run: [NDPS] C:\WINDOWS\system32\dpmw32.exeO4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXEO4 - HKLM\..\Run: [ZENRC Tray Icon] C:\WINDOWS\system32\zentray.exeO4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"O4 - HKLM\..\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exeO4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exeO4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] "C:\Program Files\Google\Gmail Notifier\gnotify.exe"O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osbootO4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimizedO4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /backgroundO4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\BrianR\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /cO4 - Startup: Winamp.lnk = C:\Program Files\Winamp\winamp.exeO8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.htmlO8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.htmlO8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.htmlO8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.htmlO8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.htmlO8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.htmlO8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.htmlO8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.htmlO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htmO8 - Extra context menu item: Send To Bluetooth - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htmO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dllO9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dllO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLLO9 - Extra button: Novell delivered applications - {C1994287-422F-47aa-8E5E-6323E210A125} - C:\Program Files\Novell\ZENworks\AxNalServer.dllO9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htmO9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htmO9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://www.pandasecurity.com/activescan/cabs/as2stubie.cabO16 - DPF: {50647AB5-18FD-4142-82B0-5852478DD0D5} (Keynote Connector Launcher 2) - http://webeffective.keynote.com/applicatio...torLauncher.cabO16 - DPF: {A5A76EA0-7B92-4707-9DBF-6F6FE56A6800} (Pure Networks Security Scan) - http://scan.networkmagic.com/nmscan/downlo...-ship-WD.V1.cabO16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://plugin.driveragent.com/files/driveragent.cabO16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = kidney.orgO17 - HKLM\Software\..\Telephony: DomainName = kidney.orgO17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = kidney.orgO17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = kidney.orgO17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = kidney.orgO18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLLO23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exeO23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exeO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeO23 - Service: Client Update Service for Novell (cusrvc) - Novell, Inc. - C:\WINDOWS\system32\cusrvc.exeO23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exeO23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exeO23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: ThinkPad PM Service (IBMPMSVC) - Lenovo - C:\WINDOWS\system32\ibmpmsvc.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exeO23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXEO23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exeO23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exeO23 - Service: Maxtor Service (Maxtor Sync Service) - Seagate Technology LLC - C:\Program Files\Maxtor\Sync\SyncServices.exeO23 - Service: Novell Application Launcher (NALNTSERVICE) - Novell, Inc. - C:\Program Files\Novell\ZENworks\nalntsrv.exeO23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exeO23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exeO23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm12.exeO23 - Service: Novell ZENworks Remote Management Agent (Remote Management Agent) - Novell, Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exeO23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeO23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exeO23 - Service: System Update (SUService) - Lenovo Group Limited - C:\Program Files\Lenovo\System Update\SUService.exeO23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exeO23 - Service: ThinkVantage Registry Monitor Service - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exeO23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.exeO23 - Service: TVT Backup Protection Service - Unknown owner - C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exeO23 - Service: TVT Backup Service - Lenovo Group Limited - C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exeO23 - Service: TVT Scheduler - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exeO23 - Service: TVT Windows Update Monitor (TVT_UpdateMonitor) - Lenovo Group Limited - C:\Program Files\Lenovo\Rescue and Recovery\UpdateMonitor.exeO23 - Service: WebDrive Service (WebDriveService) - Unknown owner - C:\Program Files\NetDrive\wdService.exeO23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exeO23 - Service: Novell XTier Agent Services (XTAgent) - Novell, Inc. - C:\WINDOWS\System32\Novell\XTAgent.exeO23 - Service: Workstation Manager (ZFDWM) - Novell, Inc. - C:\Program Files\Novell\ZENworks\wm.exe--End of file - 19197 bytes------------------------------------END LOG #3 - Hijack This Scan------------------------------------------------------ Link to post Share on other sites More sharing options...
Raid Posted December 2, 2008 ID:37522 Share Posted December 2, 2008 Hello.Open Hijackthis, select all of the following:R3 - URLSearchHook: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre0.dllO1 - Hosts: 61.157.217.210 www.yahoo.comO1 - Hosts: 61.157.217.210 www.google.comO1 - Hosts: 61.157.217.210 www.google.co.ukO1 - Hosts: 61.157.217.210 www.myspace.comO1 - Hosts: 61.157.217.210 www.youtube.comO1 - Hosts: 61.157.217.210 www.facebook.comO1 - Hosts: 61.157.217.210 www.antispy.comO1 - Hosts: 61.157.217.210 www.yahoo.comO1 - Hosts: 61.157.217.210 www.yahoo.co.ukO1 - Hosts: 61.157.217.210 www.antispyware.comO1 - Hosts: 61.157.217.210 antispyware.comO1 - Hosts: 61.157.217.210 antispy.comO1 - Hosts: 61.157.217.210 www.msn.comO1 - Hosts: 123.251.143.110 www.asdfasdfd.comO1 - Hosts: 123.251.143.110 www.gg.comO1 - Hosts: 123.251.143.110 www.ghfhj.comO1 - Hosts: 123.251.143.110 www.cvnbcvnb.comO1 - Hosts: 123.251.143.110 www.1.comO1 - Hosts: 123.251.143.110 www.3.comO1 - Hosts: 123.251.143.110 www.asdf4asdfd.comO1 - Hosts: 123.251.143.110 www.asdfawsdfd.comO1 - Hosts: 123.251.143.110 www.asdfatsdfd.comO1 - Hosts: 123.251.143.110 www.asdfasdfd.comO1 - Hosts: 123.251.143.110 www.asdfadsdfd.comO1 - Hosts: 123.251.143.110 www.asdfasdfd.comO1 - Hosts: 123.251.143.110 www.asdfafsdfd.comO1 - Hosts: 123.251.143.110 www.asdfasdfd.comO1 - Hosts: 123.251.143.110 www.asdfagsdfd.comO1 - Hosts: 123.251.143.110 www.asdfasgdfd.comO1 - Hosts: 123.251.143.110 www.asdfasdhfd.comO1 - Hosts: 123.251.143.110 www.asdfasdfjd.comO1 - Hosts: 123.251.143.110 www.asdfasdfkd.comO1 - Hosts: 123.251.143.110 www.asdfasdfld.comO1 - Hosts: 123.251.143.110 www.asdfasdf,d.comO1 - Hosts: 123.251.143.110 www.asxdfasdfd.comO1 - Hosts: 123.251.143.110 www.asdzfasdfd.comO1 - Hosts: 123.251.143.110 www.asdcfasdfd.comO1 - Hosts: 123.251.143.110 www.asdfvasdfd.comO1 - Hosts: 123.251.143.110 www.asdfabsdfd.comO1 - Hosts: 123.251.143.110 www.asdfasndfd.comO1 - Hosts: 123.251.143.110 www.asdfasdmfd.comO1 - Hosts: 123.251.143.110 www.asdfasdfd.comO1 - Hosts: 123.251.143.110 www.11asdfasdfd.comO1 - Hosts: 123.251.143.110 www.as222dfasdfd.comO1 - Hosts: 123.251.143.110 www.asdfa33sdfd.comO1 - Hosts: 123.251.143.110 www.asdfasd44fd.comO1 - Hosts: 123.251.143.110 www.asdfasdfd5.comO1 - Hosts: 123.251.143.110 www.as66dfasdfd.comO1 - Hosts: 123.251.143.110 www.asdf77asdfd.comO1 - Hosts: 123.251.143.110 www.asdf8asdfd.comO1 - Hosts: 123.251.143.110 www.asdf9asdfd.comO1 - Hosts: 123.251.143.110 www.asdf0asdfd.comO1 - Hosts: 123.251.143.110 www.asdf-asdfd.comO1 - Hosts: 123.251.143.110 www.aqqsdfasdfd.comO1 - Hosts: 123.251.143.110 www.aswwdfasdfd.comO1 - Hosts: 123.16.197.121 www.asdhhfasdfdyy.comO1 - Hosts: 61.157.217.210 www.live.comO1 - Hosts: 123.251.143.110 www.asdwwwfasdfd.comO1 - Hosts: 123.251.143.110 www.asdfeasdfd.comO1 - Hosts: 123.251.143.110 www.asdfrrasdfd.comO1 - Hosts: 123.251.143.110 www.asdfttasdfd.comO1 - Hosts: 123.251.143.110 www.asdfyyasdfd.comO1 - Hosts: 123.251.143.110 www.asdfuuuasdfd.comO1 - Hosts: 123.251.143.110 www.asdfaiisdfd.comO1 - Hosts: 123.251.143.110 www.asdfaoosdfd.comO1 - Hosts: 123.251.143.110 www.asdfappsdfd.comO1 - Hosts: 123.251.143.110 www.asdfasssdfd.comO1 - Hosts: 123.251.143.110 www.aswwdfasdfd.comO1 - Hosts: 123.251.143.110 www.asdeefasdfd.comO1 - Hosts: 123.251.143.110 www.asdfffasdfd.comO1 - Hosts: 123.251.143.110 www.asdfavvvsdfd.comO1 - Hosts: 123.251.143.110 www.asnnndfasdfd.comO1 - Hosts: 123.251.143.110 www.asdmmmfasdfd.comO1 - Hosts: 123.251.143.110 www.asdfaffsdfd.comO1 - Hosts: 123.251.143.110 www.asdhhfasdfd.comO2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)Hit Fix. Restart your PC, post a fresh hijackthis log. How is your computer doing now? Link to post Share on other sites More sharing options...
brorobo Posted December 2, 2008 Author ID:37529 Share Posted December 2, 2008 That appeared to work. Thank you so much. Can I ask, should I not use that version of winRar, or was it something in the setup file, or even the download process?Thanks again. Here is the newest HijackThis log:------------------------------------BEGIN LOG #3 - Hijack This Scan------------------------------------------------Logfile of Trend Micro HijackThis v2.0.2Scan saved at 5:38:49 PM, on 12/2/2008Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\System32\Novell\XTAgent.exeC:\WINDOWS\system32\ibmpmsvc.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeC:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeC:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exeC:\WINDOWS\system32\spoolsv.exeC:\Program Files\Bonjour\mDNSResponder.exeC:\Program Files\Symantec AntiVirus\DefWatch.exeC:\Program Files\LogMeIn\x86\RaMaint.exeC:\Program Files\LogMeIn\x86\LogMeIn.exeC:\WINDOWS\Explorer.EXEC:\Program Files\Common Files\Symantec Shared\ccApp.exeC:\PROGRA~1\SYMANT~1\VPTray.exeC:\WINDOWS\system32\TpShocks.exeC:\WINDOWS\system32\dpmw32.exeC:\WINDOWS\system32\NWTRAY.EXEC:\Program Files\LogMeIn\x86\LogMeInSystray.exeC:\Program Files\Synaptics\SynTP\SynTPLpr.exeC:\Program Files\Synaptics\SynTP\SynTPEnh.exeC:\Program Files\LogMeIn\x86\LMIGuardian.exeC:\Program Files\Java\jre1.6.0_07\bin\jusched.exeC:\Program Files\Winamp\Winampa.exeC:\Program Files\Google\Gmail Notifier\gnotify.exeC:\Program Files\Common Files\Real\Update_OB\realsched.exeC:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Skype\Phone\Skype.exeC:\Program Files\Windows Live\Messenger\MsnMsgr.ExeC:\Documents and Settings\BrianR\Local Settings\Application Data\Google\Update\GoogleUpdate.exeC:\Program Files\LogMeIn\x86\LMIGuardian.exeC:\Program Files\Maxtor\Sync\SyncServices.exeC:\Program Files\Winamp\winamp.exeC:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXEC:\Program Files\Novell\ZENworks\nalntsrv.exeC:\WINDOWS\system32\nvsvc32.exeC:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm12.exeC:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exeC:\WINDOWS\system32\svchost.exeC:\Program Files\Symantec AntiVirus\Rtvscan.exeC:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exeC:\WINDOWS\System32\TPHDEXLG.exeC:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exeC:\Program Files\Lenovo\Rescue and Recovery\rrservice.exeC:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exeC:\Program Files\Lenovo\Rescue and Recovery\UpdateMonitor.exeC:\Program Files\NetDrive\wdService.exeC:\Program Files\Webroot\Spy Sweeper\SpySweeper.exeC:\Program Files\Common Files\Lenovo\Logger\logmon.exeC:\Program Files\Novell\ZENworks\wm.exeC:\Program Files\Lenovo\System Update\SUService.exeC:\Program Files\Novell\ZENworks\WMRUNDLL.EXEC:\Novell\GroupWise\grpwise.exeC:\Program Files\Windows Live\Messenger\usnsvc.exeC:\Novell\GroupWise\Notify.exeC:\WINDOWS\system32\wuauclt.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\Documents and Settings\BrianR\My Documents\unzipped\WorkPrograms\HiJackThis.exeR1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.localR3 - URLSearchHook: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre0.dllO2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files\TechSmith\SnagIt 9\SnagItBHO.dllO2 - BHO: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre0.dllO2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dllO2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dllO2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dllO2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dllO3 - Toolbar: SnagIt - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files\TechSmith\SnagIt 9\SnagItIEAddin.dllO3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dllO3 - Toolbar: Freecorder Toolbar - {1392b8d2-5c05-419f-a8f6-b9f15a596612} - C:\Program Files\Freecorder\tbFre0.dllO4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exeO4 - HKLM\..\Run: [TpShocks] TpShocks.exeO4 - HKLM\..\Run: [NDPS] C:\WINDOWS\system32\dpmw32.exeO4 - HKLM\..\Run: [NWTRAY] NWTRAY.EXEO4 - HKLM\..\Run: [ZENRC Tray Icon] C:\WINDOWS\system32\zentray.exeO4 - HKLM\..\Run: [LogMeIn GUI] "C:\Program Files\LogMeIn\x86\LogMeInSystray.exe"O4 - HKLM\..\Run: [synTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exeO4 - HKLM\..\Run: [synTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exeO4 - HKLM\..\Run: [NvCplDaemon] "RUNDLL32.EXE" C:\WINDOWS\system32\NvCpl.dll,NvStartupO4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\Winampa.exe"O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] "C:\Program Files\Google\Gmail Notifier\gnotify.exe"O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osbootO4 - HKLM\..\Run: [mxomssmenu] "C:\Program Files\Maxtor\OneTouch Status\maxmenumgr.exe"O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimizedO4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /backgroundO4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\BrianR\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /cO4 - Startup: Winamp.lnk = C:\Program Files\Winamp\winamp.exeO8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\WINDOWS\system32\GPhotos.scr/200O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.htmlO8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.htmlO8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.htmlO8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.htmlO8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.htmlO8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.htmlO8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.htmlO8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.htmlO8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000O8 - Extra context menu item: Send to &Bluetooth Device... - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htmO8 - Extra context menu item: Send To Bluetooth - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htmO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dllO9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dllO9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - C:\Program Files\Bonjour\ExplorerPlugin.dllO9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLLO9 - Extra button: Novell delivered applications - {C1994287-422F-47aa-8E5E-6323E210A125} - C:\Program Files\Novell\ZENworks\AxNalServer.dllO9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htmO9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\ThinkPad\Bluetooth Software\btsendto_ie.htmO9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dllO9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=58813O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://www.pandasecurity.com/activescan/cabs/as2stubie.cabO16 - DPF: {50647AB5-18FD-4142-82B0-5852478DD0D5} (Keynote Connector Launcher 2) - http://webeffective.keynote.com/applicatio...torLauncher.cabO16 - DPF: {A5A76EA0-7B92-4707-9DBF-6F6FE56A6800} (Pure Networks Security Scan) - http://scan.networkmagic.com/nmscan/downlo...-ship-WD.V1.cabO16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://plugin.driveragent.com/files/driveragent.cabO16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = kidney.orgO17 - HKLM\Software\..\Telephony: DomainName = kidney.orgO17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = kidney.orgO17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = kidney.orgO17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = kidney.orgO18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLLO23 - Service: Adobe Version Cue CS3 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exeO23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exeO23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exeO23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exeO23 - Service: Client Update Service for Novell (cusrvc) - Novell, Inc. - C:\WINDOWS\system32\cusrvc.exeO23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exeO23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exeO23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: ThinkPad PM Service (IBMPMSVC) - Lenovo - C:\WINDOWS\system32\ibmpmsvc.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exeO23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXEO23 - Service: LogMeIn Maintenance Service (LMIMaint) - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\RaMaint.exeO23 - Service: LogMeIn - LogMeIn, Inc. - C:\Program Files\LogMeIn\x86\LogMeIn.exeO23 - Service: Maxtor Service (Maxtor Sync Service) - Seagate Technology LLC - C:\Program Files\Maxtor\Sync\SyncServices.exeO23 - Service: Novell Application Launcher (NALNTSERVICE) - Novell, Inc. - C:\Program Files\Novell\ZENworks\nalntsrv.exeO23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exeO23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exeO23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exeO23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\SYSTEM32\SPOOL\DRIVERS\W32X86\3\HPZipm12.exeO23 - Service: Novell ZENworks Remote Management Agent (Remote Management Agent) - Novell, Inc. - C:\Program Files\Novell\ZENworks\RemoteManagement\RMAgent\ZenRem32.exeO23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exeO23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exeO23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exeO23 - Service: System Update (SUService) - Lenovo Group Limited - C:\Program Files\Lenovo\System Update\SUService.exeO23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exeO23 - Service: ThinkVantage Registry Monitor Service - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\tvt_reg_monitor_svc.exeO23 - Service: ThinkPad HDD APS Logging Service (TPHDEXLGSVC) - Lenovo. - C:\WINDOWS\System32\TPHDEXLG.exeO23 - Service: TVT Backup Protection Service - Unknown owner - C:\Program Files\Lenovo\Rescue and Recovery\rrpservice.exeO23 - Service: TVT Backup Service - Lenovo Group Limited - C:\Program Files\Lenovo\Rescue and Recovery\rrservice.exeO23 - Service: TVT Scheduler - Lenovo Group Limited - C:\Program Files\Common Files\Lenovo\Scheduler\tvtsched.exeO23 - Service: TVT Windows Update Monitor (TVT_UpdateMonitor) - Lenovo Group Limited - C:\Program Files\Lenovo\Rescue and Recovery\UpdateMonitor.exeO23 - Service: WebDrive Service (WebDriveService) - Unknown owner - C:\Program Files\NetDrive\wdService.exeO23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exeO23 - Service: Novell XTier Agent Services (XTAgent) - Novell, Inc. - C:\WINDOWS\System32\Novell\XTAgent.exeO23 - Service: Workstation Manager (ZFDWM) - Novell, Inc. - C:\Program Files\Novell\ZENworks\wm.exe--End of file - 15398 bytes------------------------------------END LOG #3 - Hijack This Scan------------------------------------------------------ Link to post Share on other sites More sharing options...
Raid Posted December 3, 2008 ID:37576 Share Posted December 3, 2008 That appeared to work. Thank you so much. Can I ask, should I not use that version of winRar, or was it something in the setup file, or even the download process?The winrar file I recieved as a sample today is a trojan.dropper. It includes the winrar v3.80 shareware installation program, but it also installs a few friends; and makes unwanted changes to your hosts file; blocking you from a variety of websites.I would only obtain winrar and other software from the authors pages whenever possible.I will close the thread to prevent others from posting into it. If you need assistance please start your own topic and someone will be happy to assist you.The fixes and advice in this thread are for this machine only. Do not apply to your machine unless you Fully Understand how these programs work and what you're doing. Please start a thread of your own and someone will be happy to help you, just follow the Pre-Hijackthis instructions found here before posting Pre- HJT Post Instructionshttp://www.malwarebytes.org/forums/index.php?showtopic=2936' rel="external nofollow"> Link to post Share on other sites More sharing options...
Recommended Posts