Can't Find the Nasty Bugger(s) Bugging Up My System [RESOLVED

Welcome Guest ( Log In | Join )

Discover the best free computer help!
Learn more about Geeks to Go by taking the tour. Want to ask a question, reply to a topic, or remove all advertising? It's easy, fast and free. Join today!
Spyware, virus, trojan, fake security or privacy alerts? Please start with our malware cleaning guide.

> Geeks to Go! » Security » Malware Removal - HijackThis� Logs Go Here

2 Pages

1 2 >

Can't Find the Nasty Bugger(s) Bugging Up My System [RESOLVED, Malware preventing scans/internet connections

Options

melmanmark View Member Profile	Jul 20 2006, 11:22 AM Post #1
Member Posts: 10 OS: xp home	I've done all the required steps with the exception of downloading windows updates. I can't get onto the internet because my network connections are being messed with & I can't solve it. The malware has messed with Norton's liveupdate, and it also is blocking me from manually updating the virus definitions. When I try to install another virus program, the malware corrupts the windows installer and prevents me from installing. It also puts me into the forced shutdown cycle (I know how to interrupt it) but everything I try, it's like the malware is one step ahead of me. I ran the HijackThis, but am not sure which of these processes is the culprit. I appreciate your help! HijackThis Log: Logfile of HijackThis v1.99.1 Scan saved at 1:18:15 AM, on 7/18/2006 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\Iomega\System32\AppServices.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wdfmgr.exe C:\WINDOWS\system32\cmd.exe C:\Program Files\Iomega\AutoDisk\ADService.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe C:\Program Files\Multimedia Card Reader\shwicon2k.exe C:\WINDOWS\system32\ps2.exe C:\windows\system\hpsysdrv.exe C:\WINDOWS\System32\hphmon05.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\WINDOWS\System32\rundll32.exe C:\Program Files\HP DVD\Umbrella\DVDTray.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\D-Link\AirPlus G\AirGCFG.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe C:\Program Files\interMute\SpamSubtract\SpamSub.exe C:\Documents and Settings\Owner.DAD-OFFICE\Desktop\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie...ton/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://start.earthlink.net/AL/Search R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.earthlink.net/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R3 - URLSearchHook: SrchHook Class - {44F9B173-041C-4825-A9B9-D914BD9DCBB3} - C:\Program Files\EarthLink TotalAccess\ElnIE.dll R3 - URLSearchHook: (no name) - ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: InfoDocReader Object - {295BA105-3506-4D25-B0DD-54346320BDC5} - C:\WINDOWS\System32\pmkjk.dll O2 - BHO: EarthLink Popup Blocker - {4B5F2E08-6F39-479a-B547-B2026E4C7EDF} - C:\Program Files\EarthLink TotalAccess\PnEL.dll O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O2 - BHO: (no name) - {F2FA09FB-EE7A-46d8-9145-A1EEF7850052} - C:\WINDOWS\system32\vtuts.dll O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll O3 - Toolbar: EarthLink Toolbar - {D7F30B62-8269-41AF-9539-B2697FA7D77E} - C:\Program Files\EarthLink TotalAccess\PnEL.dll O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [DVDTray] "C:\Program Files\HP DVD\Umbrella\DVDTray.exe" O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.5\THGuard.exe" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [URLLSTCK.exe] "C:\Program Files\Norton Internet Security\UrlLstCk.exe" O4 - HKLM\..\Run: [SSC_UserPrompt] "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe" O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe O4 - Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSub.exe O4 - Global Startup: Creating Keepsakes Scrapbook Designer Event Reminder.lnk = C:\Program Files\Scrapbook Designer\scrapremind.exe O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe O4 - Global Startup: Multi-channel Sound Manager.lnk = C:\WINDOWS\System32\ALSNDMGR.CPL O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1142027564421 O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab O16 - DPF: {E9348280-2D74-4933-BE25-73D946926795} (DeviceEnum Class) - http://h20270.www2.hp.com/ediags/gmn/insta...cdetection3.cab O20 - Winlogon Notify: artm_newreg - C:\Documents and Settings\All Users\Documents\Settings\artm_new.dll O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: pmkjk - C:\WINDOWS\System32\pmkjk.dll O20 - Winlogon Notify: polymorphreg - C:\Documents and Settings\All Users\Documents\Settings\polymorph.dll O20 - Winlogon Notify: vtuts - C:\WINDOWS\SYSTEM32\vtuts.dll O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe O23 - Service: COM+ System Application (COMSysApp) - Unknown owner - C:\WINDOWS\System32\dllhost.exe (file missing) O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Microsoft Time server - Unknown owner - C:\WINDOWS\System32\timesrv.exe O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: MS Software Shadow Copy Provider (SwPrv) - Unknown owner - C:\WINDOWS\System32\dllhost.exe (file missing) O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - C:\Program Files\Iomega\AutoDisk\ADService.exe

Daemon View Member Profile	Jul 20 2006, 12:46 PM Post #2
Security Expert Posts: 4,356 OS: XP	Please download VundoFix.exe to your desktop. Double-click VundoFix.exe to run it. Click the Scan for Vundo button. Once it's done scanning, click the Remove Vundo button. You will receive a prompt asking if you want to remove the files, click YES Once you click yes, your desktop will go blank as it starts removing Vundo. When completed, it will prompt that it will shutdown your computer, click OK. Turn your computer back on. Please post the contents of C:\vundofix.txt and a new HiJackThis log.

melmanmark View Member Profile	Jul 20 2006, 10:31 PM Post #3
Member Posts: 10 OS: xp home	I ran VundoFix.exe. It found & deleted several files successfully, but I still have the forced shutdown & other problems. Here's the Vundofix.exe log file: VundoFix V5.1.4 Checking Java version... Java version is 1.4.2.3 Scan started at 8:06:09 PM 7/20/2006 Listing files found while scanning.... C:\windows\system32\pmkjk.dll C:\windows\system32\kjkmp.ini C:\windows\system32\kjkmp.bak1 C:\windows\system32\kjkmp.bak2 C:\windows\system32\kjkmp.ini2 C:\windows\system32\kjkmp.tmp Beginning removal... The process smss.exe was successfully stopped The process winlogon.exe was successfully stopped The process explorer.exe was successfully stopped The process iexplore.exe was successfully stopped The process rundll32.exe was successfully stopped Attempting to delete C:\windows\system32\pmkjk.dll C:\windows\system32\pmkjk.dll Has been deleted! Attempting to delete C:\windows\system32\kjkmp.ini C:\windows\system32\kjkmp.ini Has been deleted! Attempting to delete C:\windows\system32\kjkmp.bak1 C:\windows\system32\kjkmp.bak1 Has been deleted! Attempting to delete C:\windows\system32\kjkmp.bak2 C:\windows\system32\kjkmp.bak2 Has been deleted! Attempting to delete C:\windows\system32\kjkmp.ini2 C:\windows\system32\kjkmp.ini2 Has been deleted! Attempting to delete C:\windows\system32\kjkmp.tmp C:\windows\system32\kjkmp.tmp Has been deleted! Performing Repairs to the registry. Done! And here's the latest HijackThis log: Logfile of HijackThis v1.99.1 Scan saved at 9:03:09 PM, on 7/20/2006 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\PROGRA~1\Iomega\System32\AppServices.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wdfmgr.exe C:\Program Files\Iomega\AutoDisk\ADService.exe C:\WINDOWS\system32\cmd.exe C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe C:\Program Files\Multimedia Card Reader\shwicon2k.exe C:\WINDOWS\system32\ps2.exe C:\windows\system\hpsysdrv.exe C:\WINDOWS\System32\rundll32.exe C:\WINDOWS\System32\hphmon05.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\Program Files\HP DVD\Umbrella\DVDTray.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\D-Link\AirPlus G\AirGCFG.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe C:\Program Files\interMute\SpamSubtract\SpamSub.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Documents and Settings\Owner.DAD-OFFICE\Desktop\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie...ton/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://start.earthlink.net/AL/Search R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.earthlink.net/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R3 - URLSearchHook: SrchHook Class - {44F9B173-041C-4825-A9B9-D914BD9DCBB3} - C:\Program Files\EarthLink TotalAccess\ElnIE.dll R3 - URLSearchHook: (no name) - ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: InfoDocReader Object - {295BA105-3506-4D25-B0DD-54346320BDC5} - C:\WINDOWS\System32\pmkjk.dll (file missing) O2 - BHO: EarthLink Popup Blocker - {4B5F2E08-6F39-479a-B547-B2026E4C7EDF} - C:\Program Files\EarthLink TotalAccess\PnEL.dll O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O2 - BHO: (no name) - {F2FA09FB-EE7A-46d8-9145-A1EEF7850052} - C:\WINDOWS\system32\vtuts.dll O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll O3 - Toolbar: EarthLink Toolbar - {D7F30B62-8269-41AF-9539-B2697FA7D77E} - C:\Program Files\EarthLink TotalAccess\PnEL.dll O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [DVDTray] "C:\Program Files\HP DVD\Umbrella\DVDTray.exe" O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.5\THGuard.exe" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [URLLSTCK.exe] "C:\Program Files\Norton Internet Security\UrlLstCk.exe" O4 - HKLM\..\Run: [SSC_UserPrompt] "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe" O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe O4 - Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSub.exe O4 - Global Startup: Creating Keepsakes Scrapbook Designer Event Reminder.lnk = C:\Program Files\Scrapbook Designer\scrapremind.exe O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe O4 - Global Startup: Multi-channel Sound Manager.lnk = C:\WINDOWS\System32\ALSNDMGR.CPL O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1142027564421 O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab O16 - DPF: {E9348280-2D74-4933-BE25-73D946926795} (DeviceEnum Class) - http://h20270.www2.hp.com/ediags/gmn/insta...cdetection3.cab O20 - Winlogon Notify: artm_newreg - C:\Documents and Settings\All Users\Documents\Settings\artm_new.dll O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: polymorphreg - C:\Documents and Settings\All Users\Documents\Settings\polymorph.dll O20 - Winlogon Notify: vtuts - C:\WINDOWS\SYSTEM32\vtuts.dll O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe O23 - Service: COM+ System Application (COMSysApp) - Unknown owner - C:\WINDOWS\System32\dllhost.exe (file missing) O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe (file missing) O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Microsoft Time server - Unknown owner - C:\WINDOWS\System32\timesrv.exe O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: MS Software Shadow Copy Provider (SwPrv) - Unknown owner - C:\WINDOWS\System32\dllhost.exe (file missing) O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - C:\Program Files\Iomega\AutoDisk\ADService.exe I'm chillin' as I await your next eval & instructions. Thanks a MILLION!

Daemon View Member Profile	Jul 21 2006, 12:14 AM Post #4
Security Expert Posts: 4,356 OS: XP	Update Java to stop you getting reinfected. Go to Start > Control Panel double-click on the Java Icon (coffee cup) in the Control Panel. It will say "Java Plug-in" under the icon. Please find the update button or tab in the Java Control Panel. Update your Java then reboot. If you are unable to update you can manually update by going here: http://www.java.com/en/download/manual.jsp After the reboot, go back into the Control Panel and double-click the Java Icon. Under Temporary Internet Files, click the Delete Files button. There are three options in the window to clear the cache - Leave ALL 3 Checked Downloaded Applets Downloaded Applications Other Files Click OK on Delete Temporary Files Window Note: This deletes ALL the Downloaded Applications and Applets from the CACHE. Click OK to leave the Java Control Panel. Next we will do a scan then remove any remnants manually. Download ewido anti-spyware from HERE and save that file to your desktop. This is a 30 day trial of the program Once you have downloaded ewido anti-spyware, locate the icon on the desktop and double-click it to launch the set up program. Once the setup is complete you will need run ewido and update the definition files. On the main screen select the icon "Update" then select the "Update now" link. Next select the "Start Update" button, the update will start and a progress bar will show the updates being installed. Once the update has completed select the "Scanner" icon at the top of the screen, then select the "Settings" tab. Once in the Settings screen click on "Recommended actions" and then select "Quarantine". Under "Reports" Select "Automatically generate report after every scan" Un-Select "Only if threats were found" Close ewido anti-spyware, Do Not run a scan just yet, we will shortly. Reboot your computer into SafeMode. You can do this by restarting your computer and continually tapping the F8 key until a menu appears. Use your up arrow key to highlight SafeMode then hit enter. IMPORTANT: Do not open any other windows or programs while ewido is scanning, it may interfere with the scanning proccess: Lauch ewido-anti-spyware by double-clicking the icon on your desktop. Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan". ewido will now begin the scanning process, be patient this may take a little time. Once the scan is complete do the following: If you have any infections you will prompted, then select "Apply all actions" Next select the "Reports" icon at the top. Select the "Save report as" button in the lower left hand of the screen and save it to a text file on your system (make sure to remember where you saved that file, this is important). Close ewido and reboot your system back into Normal Mode and post the results of the ewido report scan and a new HijackThis log.

melmanmark View Member Profile	Jul 21 2006, 10:02 PM Post #5
Member Posts: 10 OS: xp home	WOW. ewido found 125 instances of infection! I also found & manually removed 3 malware .exe files from the root directory of c:\ (I recognized the names from previous searches). It looks like the forced shutdown problem has been resolved, but it also looks like the system isn't totally clean yet. Here are the logs: --------------------------------------------------------- ewido anti-spyware - Scan Report --------------------------------------------------------- + Created at: 8:23:02 PM 7/21/2006 + Scan result: HKLM\SOFTWARE\180solutions -> Adware.180Solutions : No action taken. HKLM\SOFTWARE\Classes\Jao.jao -> Adware.BlazeFind : No action taken. HKLM\SOFTWARE\Classes\Jao.jao.1 -> Adware.BlazeFind : No action taken. HKLM\SOFTWARE\Classes\Jao.jao\CLSID -> Adware.BlazeFind : No action taken. HKLM\SOFTWARE\Classes\Jao.jao\CurVer -> Adware.BlazeFind : No action taken. HKLM\SOFTWARE\WildMedia -> Adware.MidAddle : No action taken. HKLM\SOFTWARE\WildMedia\LicenseStores -> Adware.MidAddle : No action taken. C:\Documents and Settings\Owner.DAD-OFFICE\Desktop\HijackThis\backups\backup-20060718-010443-750.dll -> Adware.Virtumonde : No action taken. C:\WINDOWS\system32\vtuts.dll -> Adware.Virtumonde : No action taken. C:\WINDOWS\system32\vtutu.dll -> Adware.Virtumonde : No action taken. HKLM\SOFTWARE\Classes\MediaAccess.Installer -> Adware.WinAd : No action taken. HKLM\SOFTWARE\Classes\MediaAccess.Installer\CLSID -> Adware.WinAd : No action taken. HKLM\SOFTWARE\Classes\MediaAccess.Installer\CurVer -> Adware.WinAd : No action taken. C:\Documents and Settings\Alice (MOM)\Local Settings\Temp\qvxt2.game -> Downloader.Agent.afl : No action taken. C:\Documents and Settings\Alice (MOM)\Local Settings\Temp\vxt1.game -> Downloader.Agent.hy : No action taken. C:\Documents and Settings\Coley\Local Settings\Temp\iinstall.exe.tcf -> Downloader.IstBar.or : No action taken. C:\Documents and Settings\Alice (MOM)\Local Settings\Temp\1.dlb -> Downloader.Small : No action taken. C:\Documents and Settings\Alice (MOM)\Local Settings\Temp\5.dlb -> Downloader.Small : No action taken. C:\Documents and Settings\Alice (MOM)\Local Settings\Temp\vx4.game -> Downloader.Small.ctk : No action taken. C:\Documents and Settings\Alice (MOM)\Local Settings\Temp\vx3.game -> Downloader.Small.cxx : No action taken. C:\Documents and Settings\Alice (MOM)\Local Settings\Temp\vxt3.game -> Downloader.Small.cya : No action taken. C:\Documents and Settings\Alice (MOM)\Local Settings\Temp\vxt2.game -> Downloader.Small.dak : No action taken. C:\Documents and Settings\Alice (MOM)\Local Settings\Temp\10A.tmp -> Downloader.Small.dal : No action taken. C:\Documents and Settings\Alice (MOM)\Local Settings\Temp\10B.tmp -> Downloader.Small.dal : No action taken. C:\Documents and Settings\Alice (MOM)\Local Settings\Temp\117.tmp -> Downloader.Small.dal : No action taken. C:\Documents and Settings\Owner.DAD-OFFICE\Local Settings\Temp\spoolsvv.exe -> Downloader.Small.dbx : No action taken. C:\Documents and Settings\Alice (MOM)\Local Settings\Temp\10B.tmp3072.exe -> Downloader.Small.dcj : No action taken. C:\Documents and Settings\Alice (MOM)\Local Settings\Temp\2.dlb -> Downloader.Tibs.ew : No action taken. C:\Documents and Settings\Alice (MOM)\Local Settings\Temp\6.dlb -> Downloader.Tibs.ew : No action taken. C:\Documents and Settings\Alice (MOM)\Local Settings\Temp\7.dlb -> Downloader.Tibs.ew : No action taken. C:\Documents and Settings\Alice (MOM)\Local Settings\Temp\10D.tmp -> Dropper.Small.aoh : No action taken. C:\Documents and Settings\Alice (MOM)\Local Settings\Temp\10E.tmp -> Dropper.Small.aoh : No action taken. C:\Documents and Settings\Alice (MOM)\Local Settings\Temp\119.tmp -> Dropper.Small.aoh : No action taken. C:\Documents and Settings\Alice (MOM)\Local Settings\Temp\vx1.game -> Dropper.Small.aoh : No action taken. C:\Program Files\DIGStream\digstream.exe -> Not-A-Virus.Downloader.Win32.DigStream.a : No action taken. C:\Documents and Settings\Alice (MOM)\Local Settings\Temp\10B.tmp7680.exe.tcf -> Proxy.Agent.eu : No action taken. C:\Documents and Settings\Alice (MOM)\Local Settings\Temp\vxt4.game -> Proxy.Agent.ji : No action taken. C:\Documents and Settings\Alice (MOM)\Local Settings\Temp\spoolsvv.exe -> Proxy.Agent.kn : No action taken. C:\Documents and Settings\Alice (MOM)\Local Settings\Temp\vx2.game -> Proxy.Small.bo : No action taken. C:\Documents and Settings\Alice (MOM)\Local Settings\Temp\artFA97.tmp -> Proxy.Xorpix.z : No action taken. [196] C:\Documents and Settings\All Users\Documents\Settings\artm_new.dll -> Proxy.Xorpix.z : No action taken. C:\Documents and Settings\Administrator\Cookies\owner@2o7[1].txt -> TrackingCookie.2o7 : No action taken. C:\Documents and Settings\Bubbley Boy\Cookies\bubbley boy@2o7[2].txt -> TrackingCookie.2o7 : No action taken. C:\Documents and Settings\Bubbley Boy\Cookies\bubbley boy@msnportal.112.2o7[2].txt -> TrackingCookie.2o7 : No action taken. C:\Documents and Settings\Bubbley Boy\Cookies\owner@2o7[1].txt -> TrackingCookie.2o7 : No action taken. C:\Documents and Settings\Default User\Cookies\owner@2o7[1].txt -> TrackingCookie.2o7 : No action taken. C:\Documents and Settings\Owner.DAD-OFFICE\Local Settings\Temp\Cookies\owner@2o7[2].txt -> TrackingCookie.2o7 : No action taken. C:\Documents and Settings\Sweet Pea\Cookies\owner@2o7[1].txt -> TrackingCookie.2o7 : No action taken. C:\Documents and Settings\Sweet Pea\Cookies\sweet pea@2o7[1].txt -> TrackingCookie.2o7 : No action taken. C:\Documents and Settings\Sweet Pea\Cookies\sweet pea@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : No action taken. C:\WINDOWS\system32\config\systemprofile\Cookies\owner@2o7[1].txt -> TrackingCookie.2o7 : No action taken. C:\Documents and Settings\Bubbley Boy\Cookies\bubbley boy@aavalue[1].txt -> TrackingCookie.Aavalue : No action taken. C:\Documents and Settings\Bubbley Boy\Cookies\bubbley boy@lovefreegames.aavalue[1].txt -> TrackingCookie.Aavalue : No action taken. C:\Documents and Settings\Bubbley Boy\Cookies\bubbley boy@ads.addynamix[1].txt -> TrackingCookie.Addynamix : No action taken. C:\Documents and Settings\Bubbley Boy\Cookies\bubbley boy@adrevolver[3].txt -> TrackingCookie.Adrevolver : No action taken. C:\Documents and Settings\Bubbley Boy\Cookies\bubbley boy@z1.adserver[1].txt -> TrackingCookie.Adserver : No action taken. C:\Documents and Settings\Owner.DAD-OFFICE\Local Settings\Temp\Cookies\owner@advertising[1].txt -> TrackingCookie.Advertising : No action taken. C:\Documents and Settings\Administrator\Cookies\owner@atdmt[1].txt -> TrackingCookie.Atdmt : No action taken. C:\Documents and Settings\Bubbley Boy\Cookies\bubbley boy@atdmt[2].txt -> TrackingCookie.Atdmt : No action taken. C:\Documents and Settings\Bubbley Boy\Cookies\owner@atdmt[1].txt -> TrackingCookie.Atdmt : No action taken. C:\Documents and Settings\Default User\Cookies\owner@atdmt[1].txt -> TrackingCookie.Atdmt : No action taken. C:\Documents and Settings\Owner.DAD-OFFICE\Local Settings\Temp\Cookies\owner@atdmt[2].txt -> TrackingCookie.Atdmt : No action taken. C:\Documents and Settings\Sweet Pea\Cookies\owner@atdmt[1].txt -> TrackingCookie.Atdmt : No action taken. C:\Documents and Settings\Sweet Pea\Cookies\sweet pea@atdmt[1].txt -> TrackingCookie.Atdmt : No action taken. C:\Documents and Settings\Bubbley Boy\Cookies\bubbley boy@citi.bridgetrack[2].txt -> TrackingCookie.Bridgetrack : No action taken. C:\Documents and Settings\Bubbley Boy\Cookies\bubbley boy@casalemedia[1].txt -> TrackingCookie.Casalemedia : No action taken. C:\Documents and Settings\Bubbley Boy\Cookies\bubbley boy@centrport[1].txt -> TrackingCookie.Centrport : No action taken. C:\Documents and Settings\Owner.DAD-OFFICE\Local Settings\Temp\Cookies\owner@com[1].txt -> TrackingCookie.Com : No action taken. C:\Documents and Settings\Bubbley Boy\Cookies\bubbley boy@doubleclick[1].txt -> TrackingCookie.Doubleclick : No action taken. C:\Documents and Settings\Sweet Pea\Cookies\sweet pea@doubleclick[1].txt -> TrackingCookie.Doubleclick : No action taken. C:\Documents and Settings\Bubbley Boy\Cookies\bubbley boy@as-us.falkag[1].txt -> TrackingCookie.Falkag : No action taken. C:\Documents and Settings\Owner.DAD-OFFICE\Local Settings\Temp\Cookies\owner@as-us.falkag[1].txt -> TrackingCookie.Falkag : No action taken. C:\Documents and Settings\Bubbley Boy\Cookies\bubbley boy@fastclick[1].txt -> TrackingCookie.Fastclick : No action taken. C:\Documents and Settings\Bubbley Boy\Cookies\bubbley boy@media.fastclick[1].txt -> TrackingCookie.Fastclick : No action taken. C:\Documents and Settings\Owner.DAD-OFFICE\Local Settings\Temp\Cookies\owner@fastclick[2].txt -> TrackingCookie.Fastclick : No action taken. C:\Documents and Settings\Owner.DAD-OFFICE\Local Settings\Temp\Cookies\owner@media.fastclick[2].txt -> TrackingCookie.Fastclick : No action taken. C:\Documents and Settings\Administrator\Cookies\owner@ehg-dig.hitbox[2].txt -> TrackingCookie.Hitbox : No action taken. C:\Documents and Settings\Administrator\Cookies\owner@hitbox[2].txt -> TrackingCookie.Hitbox : No action taken. C:\Documents and Settings\Bubbley Boy\Cookies\bubbley boy@ehg-dig.hitbox[2].txt -> TrackingCookie.Hitbox : No action taken. C:\Documents and Settings\Bubbley Boy\Cookies\bubbley boy@hitbox[2].txt -> TrackingCookie.Hitbox : No action taken. C:\Documents and Settings\Bubbley Boy\Cookies\owner@ehg-dig.hitbox[2].txt -> TrackingCookie.Hitbox : No action taken. C:\Documents and Settings\Bubbley Boy\Cookies\owner@hitbox[2].txt -> TrackingCookie.Hitbox : No action taken. C:\Documents and Settings\Default User\Cookies\owner@ehg-dig.hitbox[2].txt -> TrackingCookie.Hitbox : No action taken. C:\Documents and Settings\Default User\Cookies\owner@hitbox[2].txt -> TrackingCookie.Hitbox : No action taken. C:\Documents and Settings\Sweet Pea\Cookies\owner@ehg-dig.hitbox[2].txt -> TrackingCookie.Hitbox : No action taken. C:\Documents and Settings\Sweet Pea\Cookies\owner@hitbox[2].txt -> TrackingCookie.Hitbox : No action taken. C:\Documents and Settings\Sweet Pea\Cookies\sweet pea@ehg-dig.hitbox[2].txt -> TrackingCookie.Hitbox : No action taken. C:\Documents and Settings\Sweet Pea\Cookies\sweet pea@hitbox[2].txt -> TrackingCookie.Hitbox : No action taken. C:\Documents and Settings\Owner.DAD-OFFICE\Local Settings\Temp\Cookies\owner@sales.liveperson[1].txt -> TrackingCookie.Liveperson : No action taken. C:\Documents and Settings\Bubbley Boy\Cookies\bubbley boy@mediaplex[1].txt -> TrackingCookie.Mediaplex : No action taken. C:\Documents and Settings\Owner.DAD-OFFICE\Local Settings\Temp\Cookies\owner@mediaplex[2].txt -> TrackingCookie.Mediaplex : No action taken. C:\Documents and Settings\Sweet Pea\Cookies\sweet pea@mediaplex[1].txt -> TrackingCookie.Mediaplex : No action taken. C:\Documents and Settings\Bubbley Boy\Cookies\bubbley boy@overture[1].txt -> TrackingCookie.Overture : No action taken. C:\Documents and Settings\Bubbley Boy\Cookies\bubbley boy@perf.overture[1].txt -> TrackingCookie.Overture : No action taken. C:\Documents and Settings\Bubbley Boy\Cookies\bubbley boy@ads.pointroll[2].txt -> TrackingCookie.Pointroll : No action taken. C:\Documents and Settings\Owner.DAD-OFFICE\Local Settings\Temp\Cookies\owner@ads.pointroll[2].txt -> TrackingCookie.Pointroll : No action taken. C:\Documents and Settings\Administrator\Cookies\owner@questionmarket[2].txt -> TrackingCookie.Questionmarket : No action taken. C:\Documents and Settings\Bubbley Boy\Cookies\bubbley boy@questionmarket[1].txt -> TrackingCookie.Questionmarket : No action taken. C:\Documents and Settings\Bubbley Boy\Cookies\owner@questionmarket[2].txt -> TrackingCookie.Questionmarket : No action taken. C:\Documents and Settings\Default User\Cookies\owner@questionmarket[2].txt -> TrackingCookie.Questionmarket : No action taken. C:\Documents and Settings\Sweet Pea\Cookies\owner@questionmarket[2].txt -> TrackingCookie.Questionmarket : No action taken. C:\WINDOWS\system32\config\systemprofile\Cookies\owner@questionmarket[2].txt -> TrackingCookie.Questionmarket : No action taken. C:\Documents and Settings\Bubbley Boy\Cookies\bubbley boy@stats1.reliablestats[1].txt -> TrackingCookie.Reliablestats : No action taken. C:\Documents and Settings\Owner.DAD-OFFICE\Local Settings\Temp\Cookies\owner@stats1.reliablestats[2].txt -> TrackingCookie.Reliablestats : No action taken. C:\Documents and Settings\Sweet Pea\Cookies\sweet pea@stats1.reliablestats[2].txt -> TrackingCookie.Reliablestats : No action taken. C:\Documents and Settings\Bubbley Boy\Cookies\bubbley boy@revenue[1].txt -> TrackingCookie.Revenue : No action taken. C:\Documents and Settings\Bubbley Boy\Cookies\bubbley boy@edge.ru4[2].txt -> TrackingCookie.Ru4 : No action taken. C:\Documents and Settings\Owner.DAD-OFFICE\Local Settings\Temp\Cookies\owner@edge.ru4[1].txt -> TrackingCookie.Ru4 : No action taken. C:\Documents and Settings\Bubbley Boy\Cookies\bubbley boy@serving-sys[2].txt -> TrackingCookie.Serving-sys : No action taken. C:\Documents and Settings\Sweet Pea\Cookies\sweet pea@bs.serving-sys[1].txt -> TrackingCookie.Serving-sys : No action taken. C:\Documents and Settings\Sweet Pea\Cookies\sweet pea@serving-sys[2].txt -> TrackingCookie.Serving-sys : No action taken. C:\Documents and Settings\Bubbley Boy\Cookies\bubbley boy@statcounter[1].txt -> TrackingCookie.Statcounter : No action taken. C:\Documents and Settings\Bubbley Boy\Cookies\bubbley boy@login.tracking101[2].txt -> TrackingCookie.Tracking101 : No action taken. C:\Documents and Settings\Bubbley Boy\Cookies\bubbley boy@trafficmp[2].txt -> TrackingCookie.Trafficmp : No action taken. C:\Documents and Settings\Bubbley Boy\Cookies\bubbley boy@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : No action taken. C:\Documents and Settings\Owner.DAD-OFFICE\Local Settings\Temp\Cookies\owner@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : No action taken. C:\Documents and Settings\Bubbley Boy\Cookies\bubbley boy@valueclick[2].txt -> TrackingCookie.Valueclick : No action taken. C:\Documents and Settings\Bubbley Boy\Cookies\bubbley boy@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : No action taken. C:\Documents and Settings\Bubbley Boy\Cookies\bubbley boy@zedo[1].txt -> TrackingCookie.Zedo : No action taken. C:\FTP Downloads\ReplicantDVD\Replicant_DVD_v6.1 Patch\patch.exe -> Trojan.Proxcrak.A : No action taken. C:\Documents and Settings\All Users\Application Data\SecTaskMan\ibm00007.dll.q_3B0DF400_q -> Trojan.Sinowal.aa : No action taken. C:\WINDOWS\Temp\$_3472452.EXE -> Trojan.Sinowal.aa : No action taken. C:\Documents and Settings\Alice (MOM)\Local Settings\Temp\111.tmp -> Trojan.Small : No action taken. C:\Documents and Settings\Alice (MOM)\Local Settings\Temp\112.tmp -> Trojan.Small : No action taken. C:\Documents and Settings\Alice (MOM)\Local Settings\Temp\11B.tmp -> Trojan.Small : No action taken. ::Report end ...and HijaceThis: Logfile of HijackThis v1.99.1 Scan saved at 8:49:31 PM, on 7/21/2006 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\csrss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Internet Explorer\iexplore.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe C:\Program Files\Common Files\Symantec Shared\ccProxy.exe C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe C:\Program Files\ewido anti-spyware 4.0\guard.exe C:\PROGRA~1\Iomega\System32\AppServices.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\wdfmgr.exe C:\Program Files\Iomega\AutoDisk\ADService.exe C:\WINDOWS\Explorer.EXE C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe C:\Program Files\Multimedia Card Reader\shwicon2k.exe C:\WINDOWS\system32\ps2.exe C:\WINDOWS\System32\rundll32.exe C:\windows\system\hpsysdrv.exe C:\WINDOWS\System32\hphmon05.exe C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe C:\Program Files\HP DVD\Umbrella\DVDTray.exe C:\WINDOWS\SOUNDMAN.EXE C:\Program Files\D-Link\AirPlus G\AirGCFG.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Common Files\Symantec Shared\ccApp.exe C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe C:\Program Files\ewido anti-spyware 4.0\ewido.exe C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe C:\Program Files\interMute\SpamSubtract\SpamSub.exe C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE C:\Documents and Settings\Owner.DAD-OFFICE\Desktop\HijackThis\HijackThis.exe C:\Program Files\Messenger\msmsgs.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.earthlink.net/partner/more/msie...ton/search.html R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://start.earthlink.net/AL/Search R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.earthlink.net/ R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = c:\secure32.html R3 - URLSearchHook: SrchHook Class - {44F9B173-041C-4825-A9B9-D914BD9DCBB3} - C:\Program Files\EarthLink TotalAccess\ElnIE.dll R3 - URLSearchHook: (no name) - ~CFBFAE00-17A6-11D0-99CB-00C04FD64497} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: InfoDocReader Object - {295BA105-3506-4D25-B0DD-54346320BDC5} - C:\WINDOWS\System32\pmkjk.dll (file missing) O2 - BHO: EarthLink Popup Blocker - {4B5F2E08-6F39-479a-B547-B2026E4C7EDF} - C:\Program Files\EarthLink TotalAccess\PnEL.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll O2 - BHO: Norton Internet Security 2006 - {9ECB9560-04F9-4bbc-943D-298DDF1699E1} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O2 - BHO: (no name) - {F2FA09FB-EE7A-46d8-9145-A1EEF7850052} - C:\WINDOWS\system32\vtuts.dll O3 - Toolbar: HP View - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\hpdtlk02.dll O3 - Toolbar: EarthLink Toolbar - {D7F30B62-8269-41AF-9539-B2697FA7D77E} - C:\Program Files\EarthLink TotalAccess\PnEL.dll O3 - Toolbar: Norton Internet Security 2006 - {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} - C:\Program Files\Common Files\Symantec Shared\AdBlocking\NISShExt.dll O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton Internet Security\Norton AntiVirus\NavShExt.dll O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r O4 - HKLM\..\Run: [Sunkist2k] C:\Program Files\Multimedia Card Reader\shwicon2k.exe O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE O4 - HKLM\..\Run: [PS2] C:\WINDOWS\system32\ps2.exe O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [hpsysdrv] c:\windows\system\hpsysdrv.exe O4 - HKLM\..\Run: [HPHUPD05] c:\Program Files\HP\{45B6180B-DCAB-4093-8EE8-6164457517F0}\hphupd05.exe O4 - HKLM\..\Run: [HPHmon05] C:\WINDOWS\System32\hphmon05.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_07\bin\jusched.exe O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe O4 - HKLM\..\Run: [DVDTray] "C:\Program Files\HP DVD\Umbrella\DVDTray.exe" O4 - HKLM\..\Run: [AlcxMonitor] ALCXMNTR.EXE O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Program Files\D-Link\AirPlus G\AirGCFG.exe O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.5\THGuard.exe" O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe" O4 - HKLM\..\Run: [URLLSTCK.exe] "C:\Program Files\Norton Internet Security\UrlLstCk.exe" O4 - HKLM\..\Run: [SSC_UserPrompt] "C:\Program Files\Common Files\Symantec Shared\Security Center\UsrPrmpt.exe" O4 - HKLM\..\Run: [!ewido] "C:\Program Files\ewido anti-spyware 4.0\ewido.exe" /minimized O4 - HKCU\..\Run: [BackupNotify] c:\Program Files\HP\Digital Imaging\bin\backupnotify.exe O4 - Startup: spamsubtract.lnk = C:\Program Files\interMute\SpamSubtract\SpamSub.exe O4 - Global Startup: Creating Keepsakes Scrapbook Designer Event Reminder.lnk = C:\Program Files\Scrapbook Designer\scrapremind.exe O4 - Global Startup: InterVideo WinCinema Manager.lnk = C:\Program Files\InterVideo\Common\Bin\WinCinemaMgr.exe O4 - Global Startup: Multi-channel Sound Manager.lnk = C:\WINDOWS\System32\ALSNDMGR.CPL O4 - Global Startup: Updates from HP.lnk = C:\Program Files\Updates from HP\137903\Program\BackWeb-137903.exe O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\npjpi150_07.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_07\bin\npjpi150_07.dll O16 - DPF: {1F2F4C9E-6F09-47BC-970D-3C54734667FE} (LSSupCtl Class) - http://www.symantec.com/techsupp/asa/ctrl/LSSupCtl.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://spaces.msn.com//PhotoUpload/MsnPUpld.cab O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1142027564421 O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab O16 - DPF: {E9348280-2D74-4933-BE25-73D946926795} (DeviceEnum Class) - http://h20270.www2.hp.com/ediags/gmn/insta...cdetection3.cab O20 - Winlogon Notify: artm_newreg - C:\Documents and Settings\All Users\Documents\Settings\artm_new.dll O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll O20 - Winlogon Notify: polymorphreg - C:\Documents and Settings\All Users\Documents\Settings\polymorph.dll O20 - Winlogon Notify: vtuts - C:\WINDOWS\SYSTEM32\vtuts.dll O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Program Files\ANI\ANIWZCS2 Service\ANIWZCSdS.exe O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe O23 - Service: Symantec Internet Security Password Validation (ccISPwdSvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPwdSvc.exe O23 - Service: Symantec Network Proxy (ccProxy) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccProxy.exe O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Norton Internet Security\comHost.exe O23 - Service: COM+ System Application (COMSysApp) - Unknown owner - C:\WINDOWS\System32\dllhost.exe (file missing) O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - Unknown owner - C:\WINDOWS\System32\dmadmin.exe (file missing) O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: Iomega App Services - Iomega Corporation - C:\PROGRA~1\Iomega\System32\AppServices.exe O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE O23 - Service: Microsoft Time server - Unknown owner - C:\WINDOWS\System32\timesrv.exe (file missing) O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\navapsvc.exe O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton Internet Security\Norton AntiVirus\SAVScan.exe O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe O23 - Service: MS Software Shadow Copy Provider (SwPrv) - Unknown owner - C:\WINDOWS\System32\dllhost.exe (file missing) O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Iomega Corporation - C:\Program Files\Iomega\AutoDisk\ADService.exe Please let me know. Thanks a MILLION!!!!!!!!

Daemon View Member Profile	Jul 22 2006, 01:26 AM Post #6
Security Expert Posts: 4,356 OS: XP	Did you quarantine the items with ewido? For some reason it says 'No action taken' Could you rerun it and make sure it removes the pests - post a new log from it when done. Also do this: Go to Jotti's malware scan Copy and paste the following file path into the "File to upload & scan" box on the top of the page: C:\Documents and Settings\All Users\Documents\Settings\polymorph.dll Click on the submit button. Please post the results in your next reply. Repeat for this: C:\Documents and Settings\All Users\Documents\Settings\artm_new.dll This post has been edited by Daemon: Jul 22 2006, 01:27 AM

melmanmark