Little Posted December 22, 2008 ID:41449 Share Posted December 22, 2008 Hello,I was wondering if someone could take a look at my logs and determine if I have a clean bill of health for my computer? Last night, I started experiencing uncontrollable popups on my browser. My system began to run rather sluggish, and even after rebooting it seemed as if the response time was not normal. I would open firefox, but would notice in the taskmanager that firefox got practically no cpu time. I tried to update my spybot s&d definitions, but I would get an error saying that I wasn't connected to the internet. Yet, I was able to use the internet just fine. Anyhow, after a rather long struggle I think my system is clean, but I'm not entirely sure. So, I was wondering if someone could take a look at the logs.I finished updating, running spybot search and destroy, and immunizing my machine. So that's all done. I did a malwarebytes anti-malware scan, a pandascan, and a hijackthis scan. I'll post them in separate replies.Here is the malwarebytes anti-malware log:Malwarebytes' Anti-Malware 1.31Database version: 1531Windows 5.1.2600 Service Pack 312/22/2008 9:17:57 AMmbam-log-2008-12-22 (09-17-57).txtScan type: Quick ScanObjects scanned: 60107Time elapsed: 11 minute(s), 21 second(s)Memory Processes Infected: 0Memory Modules Infected: 0Registry Keys Infected: 0Registry Values Infected: 0Registry Data Items Infected: 0Folders Infected: 0Files Infected: 0Memory Processes Infected:(No malicious items detected)Memory Modules Infected:(No malicious items detected)Registry Keys Infected:(No malicious items detected)Registry Values Infected:(No malicious items detected)Registry Data Items Infected:(No malicious items detected)Folders Infected:(No malicious items detected)Files Infected:(No malicious items detected) Link to post Share on other sites More sharing options...
Little Posted December 22, 2008 Author ID:41450 Share Posted December 22, 2008 After the malwarebytes anti-malware scan and fix, I did a pandascan. Here is the log. Sorry about the bad formatting, I just copied and pasted. :\;***********************************************************************************************************************************************************************************ANALYSIS: 2008-12-22 11:39:46PROTECTIONS: 1MALWARE: 8SUSPECTS: 27;***********************************************************************************************************************************************************************************PROTECTIONSDescription Version Active Updated;===================================================================================================================================================================================McAfee VirusScan Enterprise 8.5.0.781 No Yes;===================================================================================================================================================================================MALWAREId Description Type Active Severity Disinfectable Disinfected Location;===================================================================================================================================================================================00003428 adware/memorywatcher Adware No 0 Yes No hkey_local_machine\software\microsoft\windows\currentversion\app management\arpcache\memorywatcher00020937 adware/statblaster Adware No 0 Yes No hkey_local_machine\software\minigolf00020942 adware/exact.bargainbuddy Adware No 0 Yes No hkey_local_machine\software\microsoft\windows\currentversion\app management\arpcache\bargain buddy00147824 Cookie/Clickbank TrackingCookie No 0 Yes No C:\Documents and Settings\Admin 2\Cookies\admin_2@clickbank[1].txt00447834 Adware/Lop Adware No 0 Yes No C:\Program Files\Norton AntiVirus\Quarantine\3B9B23F000456116 Adware/Antivirus2009 Adware No 0 Yes No C:\Documents and Settings\Admin 2\Local Settings\Temporary Internet Files\Content.IE5\CYV06KJH\freescan[2].htm00456116 Adware/Antivirus2009 Adware No 0 Yes No C:\Documents and Settings\Admin 2\Local Settings\Temporary Internet Files\Content.IE5\CYV06KJH\freescan[1].htm00527204 Application/PRScheduler HackTools No 0 Yes No C:\Documents and Settings\Admin 2\Start Menu\Programs\Startup\PowerReg Scheduler V3.exe04384357 Adware/VirusRemover2008 Adware No 0 Yes No C:\Documents and Settings\Admin 2\Local Settings\Temporary Internet Files\Content.IE5\PC2W7L0J\winsinstall[1].exe;===================================================================================================================================================================================SUSPECTSSent Location ҋ;===================================================================================================================================================================================No C:\Documents and Settings\Admin 2\Desktop\backups\backup-20081221-153127-975.dll ҋNo C:\Documents and Settings\Admin 2\Desktop\backups\backup-20081221-170733-668.dll ҋNo C:\Documents and Settings\Admin 2\Desktop\backups\backup-20081221-170751-726.dll ҋNo C:\Documents and Settings\Admin 2\Desktop\backups\backup-20081221-170801-230.dll ҋNo C:\Documents and Settings\Admin 2\Desktop\backups\backup-20081221-170812-133.dll ҋNo C:\Documents and Settings\Admin 2\Desktop\backups\backup-20081221-170820-663.dll ҋNo C:\Documents and Settings\Admin 2\Desktop\backups\backup-20081221-170853-850.dll ҋNo C:\Documents and Settings\Admin 2\Desktop\backups\backup-20081221-171605-617.dll ҋNo C:\Documents and Settings\Admin 2\Desktop\backups\backup-20081221-171614-508.dll ҋNo C:\Documents and Settings\Admin 2\Desktop\backups\backup-20081221-171928-558.dll ҋNo C:\Documents and Settings\Admin 2\Desktop\backups\backup-20081221-172023-601.dll ҋNo C:\Documents and Settings\Admin 2\Desktop\backups\backup-20081221-172750-391.dll ҋNo C:\Documents and Settings\Admin 2\Desktop\backups\backup-20081221-221352-489.dll ҋNo C:\Documents and Settings\Admin 2\Desktop\backups\backup-20081221-221510-807.dll ҋNo C:\Documents and Settings\Admin 2\Desktop\backups\backup-20081221-221524-847.dll ҋNo C:\Documents and Settings\Admin 2\Desktop\backups\backup-20081221-224108-537.dll ҋNo C:\Documents and Settings\Admin 2\Desktop\backups\backup-20081221-225355-934.dll ҋNo C:\Documents and Settings\Admin 2\Desktop\backups\backup-20081221-225624-873.dll ҋNo C:\Documents and Settings\Admin 2\Desktop\backups\backup-20081221-225755-351.dll ҋNo C:\Documents and Settings\Admin 2\Desktop\backups\backup-20081222-023126-980.dll ҋNo C:\Documents and Settings\Admin 2\Desktop\backups\backup-20081222-024147-552.dll ҋNo C:\Documents and Settings\Admin 2\Desktop\backups\backup-20081222-024211-959.dll ҋNo C:\Documents and Settings\Admin 2\Desktop\backups\backup-20081222-024646-176.dll ҋNo C:\WINDOWS\SYSTEM32\awtsPFxy.dll ҋNo C:\WINDOWS\SYSTEM32\jjtfggno.dll ҋNo C:\WINDOWS\SYSTEM32\jlcmjz.dll ҋNo C:\WINDOWS\SYSTEM32\xxyawxxv.dll ҋ;===================================================================================================================================================================================VULNERABILITIESId Severity Description ҋ;===================================================================================================================================================================================;=================================================================================================================================================================================== Link to post Share on other sites More sharing options...
Little Posted December 22, 2008 Author ID:41453 Share Posted December 22, 2008 Finally, here is the hijackthis log. Any help is appreciated, thanks!Logfile of Trend Micro HijackThis v2.0.2Scan saved at 11:51:50 AM, on 12/22/2008Platform: Windows XP SP3 (WinNT 5.01.2600)MSIE: Internet Explorer v7.00 (7.00.6000.16762)Boot mode: NormalRunning processes:C:\WINDOWS\System32\smss.exeC:\WINDOWS\system32\winlogon.exeC:\WINDOWS\system32\services.exeC:\WINDOWS\system32\lsass.exeC:\WINDOWS\system32\Ati2evxx.exeC:\WINDOWS\system32\svchost.exeC:\WINDOWS\System32\svchost.exeC:\WINDOWS\system32\Ati2evxx.exeC:\Program Files\Lavasoft\Ad-Aware\aawservice.exeC:\WINDOWS\Explorer.EXEC:\WINDOWS\system32\spoolsv.exeC:\WINDOWS\BCMSMMSG.exeC:\WINDOWS\System32\DSentry.exeC:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exeC:\Program Files\Common Files\Dell\EUSW\Support.exeC:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exeC:\Program Files\Microsoft Hardware\Mouse\point32.exeC:\Program Files\iTunes\iTunesHelper.exeC:\Program Files\McAfee\Common Framework\UdaterUI.exeC:\WINDOWS\vVX1000.exeC:\Program Files\Java\jre6\bin\jusched.exeC:\Program Files\McAfee\Common Framework\McTray.exeC:\Program Files\PeerGuardian2\pg2.exeC:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exeC:\Program Files\Messenger\msmsgs.exeC:\Program Files\Apache Software Foundation\Apache2.2\bin\httpd.exeC:\WINDOWS\System32\CTsvcCDA.EXEC:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeC:\Program Files\Java\jre6\bin\jqs.exeC:\Program Files\McAfee\Common Framework\FrameworkService.exeC:\WINDOWS\system32\ctfmon.exeC:\Program Files\Apache Software Foundation\Apache2.2\bin\httpd.exeC:\Program Files\McAfee\VirusScan Enterprise\mcshield.exeC:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exeC:\Program Files\Microsoft LifeCam\MSCamS32.exeC:\WINDOWS\System32\svchost.exeC:\Program Files\Viewpoint\Common\ViewpointService.exeC:\WINDOWS\System32\MsPMSPSv.exeC:\Program Files\iPod\bin\iPodService.exeC:\WINDOWS\system32\wscntfy.exeC:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exeC:\Program Files\ATI Technologies\ATI.ACE\Core-Static\ccc.exeC:\WINDOWS\system32\rundll32.exeC:\Program Files\Mozilla Firefox\firefox.exeC:\Documents and Settings\Admin 2\Desktop\HiJackThis.exeR1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dellnet.comR1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = http://localhostO2 - BHO: (no name) - {950D9F77-1276-4BBA-AE1D-8CAA36DA343E} - C:\WINDOWS\system32\tuvTKaXO.dll (file missing)O4 - HKLM\..\Run: [bCMSMMSG] BCMSMMSG.exeO4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exeO4 - HKLM\..\Run: [AdaptecDirectCD] "C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\DirectCD.exe"O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exeO4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exeO4 - HKLM\..\Run: [POINTER] point32.exeO4 - HKLM\..\Run: [sureshotpopupkiller] "C:\Program Files\Sureshot PopUp Killer Demo\popupkiller.exe" -minimizedO4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUNO4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottimeO4 - HKLM\..\Run: [shStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONEO4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKeyO4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe"O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exeO4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"O4 - HKLM\..\Run: [startCCC] "C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRunO4 - HKCU\..\Run: [PeerGuardian] C:\Program Files\PeerGuardian2\pg2.exeO4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /backgroundO4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exeO4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_0O4 - HKCU\..\Run: [DAEMON Tools Pro Agent] "C:\Program Files\DAEMON Tools Pro\DTProAgent.exe"O4 - Startup: OpenOffice.org 2.3.lnk = C:\Program Files\OpenOffice.org 2.3\program\quickstart.exeO4 - Startup: PowerReg Scheduler V3.exeO4 - Global Startup: Microtek Scanner Finder.lnk = C:\Program Files\Microtek\ScanWizard 5\ScannerFinder.exeO9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exeO16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cabO16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cabO16 - DPF: {65E7DB1D-0101-4100-BD66-C5C78C917F93} - http://install.wildtangent.com/bgn/partner...lim/install.cabO23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exeO23 - Service: Apache2.2 - Apache Software Foundation - C:\Program Files\Apache Software Foundation\Apache2.2\bin\httpd.exeO23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exeO23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exeO23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\System32\CTsvcCDA.EXEO23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exeO23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exeO23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exeO23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exeO23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exeO23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\mcshield.exeO23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\vstskmgr.exeO23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exeO23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exeO23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe--End of file - 7463 bytes Link to post Share on other sites More sharing options...
Root Admin AdvancedSetup Posted January 4, 2009 Root Admin ID:44742 Share Posted January 4, 2009 Sorry for the delay. If you still need help please post and let us know and we'll help you out. Link to post Share on other sites More sharing options...
Recommended Posts