need help with log, one more malware to clean up

Welcome Guest ( Log In | Join )

Discover the best free computer help!
Learn more about Geeks to Go by taking the tour. Spyware, virus, trojan, fake security or privacy alerts? Read the malware cleaning guide. Want to reply to a topic, start a new one, or remove the advertising? Join today (always free).

> Geeks to Go! » Security » Malware Removal - HijackThis� Logs Go Here

2 Pages

1 2 >

need help with log, one more malware to clean up

Options

dementievafan View Member Profile	Jan 21 2008, 07:41 PM Post #1
Member Posts: 11 OS: xp	ok ive been getting rid of malware all day but can't seem to finish one off, i think it may be line 20 but whats happeneing is that windows installer keeps popping up every 1 min or so saying it wants to install microsoft office xp frontpage, and a IE popup will follow immediately after, please help thanks in advance Logfile of HijackThis v1.99.1 Scan saved at 6:44:54 PM, on 01/21/2008 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: E:\WINDOWS\System32\smss.exe E:\WINDOWS\system32\csrss.exe E:\WINDOWS\system32\winlogon.exe E:\WINDOWS\system32\services.exe E:\WINDOWS\system32\lsass.exe E:\WINDOWS\system32\svchost.exe E:\WINDOWS\System32\svchost.exe E:\WINDOWS\System32\svchost.exe E:\WINDOWS\System32\svchost.exe E:\WINDOWS\system32\spoolsv.exe E:\WINDOWS\System32\alg.exe E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe E:\WINDOWS\System32\nvsvc32.exe E:\WINDOWS\system32\pctspk.exe E:\WINDOWS\System32\svchost.exe E:\WINDOWS\system32\msiexec.exe E:\WINDOWS\explorer.exe E:\Program Files\Winamp\winamp.exe E:\PROGRA~1\AIM\aim.exe E:\Program Files\Mozilla Firefox\firefox.exe E:\Documents and Settings\Philip\Desktop\HijackThis1991.exe R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = E:\WINDOWS\about.htm R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8100 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [DeadAIM] rundll32.exe "E:\Program Files\AIM\\DeadAIM.ocm",ExportedCheckODLs O4 - HKLM\..\Run: [PaperPort PTD] E:\Program Files\ScanSoft\PaperPort\pptd40nt.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE E:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [!AVG Anti-Spyware] "E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [AIM] E:\PROGRA~1\AIM\aim.exe -cnetwait.odl O4 - Startup: Adobe Gamma.lnk = E:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &Google Search - res://e:\program files\google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: Backward Links - res://e:\program files\google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://e:\program files\google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://e:\program files\google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://e:\program files\google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\WINDOWS\System32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\WINDOWS\System32\msjava.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - E:\PROGRA~1\AIM\aim.exe O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - E:\Program Files\Bodog Poker\BPGame.exe (file missing) O15 - Trusted Zone: .kabum.pl O15 - Trusted Zone: .kabum.pl (HKLM) O20 - Winlogon Notify: wvuvvtq - wvuvvtq.dll (file missing) O23 - Service: Adobe LM Service - Adobe Systems - E:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: Machine Debug Manager (MDM) - Unknown owner - E:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\System32\nvsvc32.exe O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - E:\WINDOWS\system32\pctspk.exe

dementievafan View Member Profile	Jan 22 2008, 03:14 PM Post #2
Member Posts: 11 OS: xp	help!

kahdah View Member Profile	Jan 22 2008, 04:35 PM Post #3
GeekU Teacher Posts: 9,420 From: Somewhere OS: Windows xp home	Hello dementievafan Welcome to G2Go. =================== The first thing I will need you to do is to Download this anti-virus program and install it. This is free. Avast Because I do not see any antivirus installed on your computer. After that please download Deckard's System Scanner (DSS) and save it to your Desktop. Close all other windows before proceeding. Double-click on dss.exe and follow the prompts. When it has finished, dss will open two Notepads main.txt and extra.txt -- please copy (CTRL+A and then CTRL+C) and paste (CTRL+V) the contents of main.txt and extra.txt in your next reply.

kahdah View Member Profile	Jan 22 2008, 05:53 PM Post #5
GeekU Teacher Posts: 9,420 From: Somewhere OS: Windows xp home	Please download ComboFix from Here to your Desktop. Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop Close any open browsers. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix. ----------------------------------------------------------- Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results". Click on this link* to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.* ----------------------------------------------------------- Double click on combofix.exe & follow the prompts. When finished, it will produce a report for you. Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review. Note: Do not mouseclick combofix's window while it's running. That may cause it to stall

dementievafan View Member Profile	Jan 22 2008, 08:30 PM Post #6
Member Posts: 11 OS: xp	i attached the combofix log and here is the HJT log Logfile of HijackThis v1.99.1 Scan saved at 8:29:03 PM, on 01/22/2008 Platform: Windows XP SP1 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106) Running processes: E:\WINDOWS\System32\smss.exe E:\WINDOWS\system32\winlogon.exe E:\WINDOWS\system32\services.exe E:\WINDOWS\system32\lsass.exe E:\WINDOWS\system32\svchost.exe E:\WINDOWS\System32\svchost.exe E:\WINDOWS\system32\spoolsv.exe E:\WINDOWS\Explorer.EXE E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe E:\WINDOWS\System32\nvsvc32.exe E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe E:\WINDOWS\system32\pctspk.exe E:\WINDOWS\System32\svchost.exe E:\WINDOWS\system32\msiexec.exe E:\WINDOWS\System32\wuauclt.exe E:\WINDOWS\System32\wuauclt.exe E:\Documents and Settings\Philip\Desktop\HijackThis1991.exe R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = E:\WINDOWS\about.htm R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8100 R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = R3 - URLSearchHook: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [nwiz] nwiz.exe /install O4 - HKLM\..\Run: [DeadAIM] rundll32.exe "E:\Program Files\AIM\\DeadAIM.ocm",ExportedCheckODLs O4 - HKLM\..\Run: [PaperPort PTD] E:\Program Files\ScanSoft\PaperPort\pptd40nt.exe O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE E:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit O4 - HKLM\..\Run: [!AVG Anti-Spyware] "E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [AIM] E:\Program Files\AIM\aim.exe -cnetwait.odl O4 - Startup: Adobe Gamma.lnk = E:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &Google Search - res://e:\program files\google\GoogleToolbar1.dll/cmsearch.html O8 - Extra context menu item: Backward Links - res://e:\program files\google\GoogleToolbar1.dll/cmbacklinks.html O8 - Extra context menu item: Cached Snapshot of Page - res://e:\program files\google\GoogleToolbar1.dll/cmcache.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://E:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Similar Pages - res://e:\program files\google\GoogleToolbar1.dll/cmsimilar.html O8 - Extra context menu item: Translate into English - res://e:\program files\google\GoogleToolbar1.dll/cmtrans.html O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\WINDOWS\System32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - E:\WINDOWS\System32\msjava.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - E:\Program Files\AIM\aim.exe O9 - Extra button: Bodog Poker - {F47C1DB5-ED21-4dc1-853E-D1495792D4C5} - E:\Program Files\Bodog Poker\BPGame.exe (file missing) O15 - Trusted Zone: .kabum.pl O15 - Trusted Zone: .kabum.pl (HKLM) O20 - Winlogon Notify: wvuvvtq - wvuvvtq.dll (file missing) O23 - Service: Adobe LM Service - Adobe Systems - E:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - E:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: Machine Debug Manager (MDM) - Unknown owner - E:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe (file missing) O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - E:\WINDOWS\System32\nvsvc32.exe O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - E:\WINDOWS\system32\pctspk.exe This post has been edited by dementievafan: Jan 22 2008, 08:31 PM Attached File(s) log.txt ( 11.7K ) Number of downloads: 1

kahdah View Member Profile	Jan 22 2008, 08:57 PM Post #7
GeekU Teacher Posts: 9,420 From: Somewhere OS: Windows xp home	PLease post the next logs instead of attaching them thanks ======================================= 1. Please open Notepad Click Start , then Run Type notepad .exe in the Run Box. 2. Now copy/paste the entire content of the codebox below into the Notepad window: CODE File:: E:\WINDOWS\system32\drivers\core.cache.dsk E:\WINDOWS\system32\hjjtgyg.exe E:\WINDOWS\system32\drivers\ftdiskk.sys Folder:: E:\VundoFix Backups E:\WINDOWS\system32\usmvt3 E:\WINDOWS\system32\siwp E:\WINDOWS\system32\drivez4 E:\WINDOWS\system32\comp2 E:\WINDOWS\system32\cache3 E:\WINDOWS\system32\ardCo01 Registry:: [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system] "DisableRegistryTools"=- [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\wvuvvtq] Driver:: ftdiskk 3. Save the above as CFScript.txt 4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again. 5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply: Combofix.txt A new HijackThis log.

dementievafan View Member Profile	Jan 22 2008, 11:35 PM Post #8
Member Posts: 11 OS: xp	as you requested ComboFix 08-01-23.1 - Philip 2008-01-22 23:28:35.4 - NTFSx86 Microsoft Windows XP Professional 5.1.2600.1.1252.1.1033.18.736 [GMT -6:00] Running from: E:\Documents and Settings\Philip\Desktop\ComboFix(2).exe Command switches used :: E:\Documents and Settings\Philip\Desktop\CFScript.txt * Created a new restore point WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !! FILE E:\WINDOWS\system32\drivers\core.cache.dsk E:\WINDOWS\system32\drivers\ftdiskk.sys E:\WINDOWS\system32\hjjtgyg.exe . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . E:\VundoFix Backups E:\VundoFix Backups\cccdd.ini.bad E:\VundoFix Backups\cccdd.ini2.bad E:\VundoFix Backups\ddccc.dll.bad E:\WINDOWS\system32\ardCo01 E:\WINDOWS\system32\cache3 E:\WINDOWS\system32\cache3\vumpedll23.exe E:\WINDOWS\system32\comp2 E:\WINDOWS\system32\drivers\core.cache.dsk E:\WINDOWS\system32\drivers\ftdiskk.sys E:\WINDOWS\system32\drivez4 E:\WINDOWS\system32\hjjtgyg.exe E:\WINDOWS\system32\siwp E:\WINDOWS\system32\usmvt3 . ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) . -------\LEGACY_FTDISKK -------\ftdiskk ((((((((((((((((((((((((( Files Created from 2007-12-23 to 2008-01-23 ))))))))))))))))))))))))))))))) . 2008-01-22 17:08 . 2008-01-22 17:08 <DIR> d-------- E:\Deckard 2008-01-21 19:01 . 2007-07-30 19:19 549,720 --a------ E:\WINDOWS\system32\wuapi.dll 2008-01-21 19:01 . 2007-07-30 19:19 325,976 --a------ E:\WINDOWS\system32\wucltui.dll 2008-01-21 19:01 . 2007-07-30 19:19 216,408 --a------ E:\WINDOWS\system32\wuaucpl.cpl 2008-01-21 19:01 . 2007-07-30 19:19 203,096 --a------ E:\WINDOWS\system32\wuweb.dll 2008-01-21 19:01 . 2004-08-03 14:03 186,136 --a------ E:\WINDOWS\system32\wuaueng1.dll 2008-01-21 19:01 . 2004-08-03 14:01 167,704 --a------ E:\WINDOWS\system32\wuauclt1.exe 2008-01-21 19:01 . 2007-07-30 19:18 33,624 --a------ E:\WINDOWS\system32\wups.dll 2008-01-21 18:39 . 2008-01-21 18:39 <DIR> d-------- E:\Program Files\AOD 2008-01-21 15:58 . 2008-01-21 15:57 1,238,674 --a------ E:\MGtools.exe 2008-01-21 15:53 . 2005-01-13 21:41 11,254 --a------ E:\WINDOWS\system32\locate.com 2008-01-21 15:52 . 2008-01-21 16:03 <DIR> d-------- E:\MGtools 2008-01-21 15:52 . 2008-01-21 16:03 29,554 --a------ E:\MGlogs.zip 2008-01-21 15:29 . 2007-05-30 06:10 10,872 --a------ E:\WINDOWS\system32\drivers\AvgAsCln.sys 2008-01-21 14:31 . 2000-08-31 08:00 51,200 --a------ E:\WINDOWS\NirCmd.exe 2008-01-21 14:30 . 2008-01-21 15:58 24,295 --a------ E:\WINDOWS\attachment.php 2008-01-21 14:15 . 2008-01-21 14:15 <DIR> d-------- E:\Program Files\CCleaner 2008-01-16 00:51 . 2008-01-18 14:51 328,192 --a------ E:\WINDOWS\system32\ddccc.exe 2008-01-15 23:08 . 2008-01-15 23:08 489,984 --a------ E:\installer.exe 2008-01-15 14:31 . 2008-01-15 14:31 20,480 --a------ E:\WINDOWS\quit.exe 2008-01-15 13:21 . 2008-01-15 23:36 <DIR> d-------- E:\Program Files\Dot1XCfg 2008-01-15 13:05 . 2008-01-21 15:49 <DIR> d-------- E:\WINDOWS\system32\edcA01 2008-01-14 00:22 . 2008-01-14 00:22 22,528 --ahs---- E:\WINDOWS\Thumbs.db 2008-01-13 22:24 . 2008-01-13 22:27 131,072 --a------ E:\WINDOWS\system32\datestamp.dll 2008-01-13 22:21 . 2008-01-13 22:40 <DIR> d-------- E:\Program Files\FBM Software 2008-01-07 17:32 . 2008-01-21 15:51 8,192 --ahs---- E:\WINDOWS\system32\Thumbs.db 2008-01-07 16:09 . 2008-01-21 00:53 484,864 --a------ E:\WINDOWS\system32\NeroCheck .exe 2008-01-07 15:11 . 2008-01-21 00:53 13,312 --a------ E:\WINDOWS\system32\ctfmon .exe 2008-01-07 14:57 . 2008-01-21 15:49 <DIR> d--hs---- E:\WINDOWS\UFk 2007-12-28 18:07 . 2008-01-16 00:39 <DIR> d-------- E:\Program Files\Absolute Poker 2007-12-28 18:07 . 2007-12-28 18:07 <DIR> d-------- E:\Program Files\_uninstallation_info . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-01-22 00:41 --------- d-----w E:\Program Files\RegScrubXP 2008-01-22 00:40 --------- d-----w E:\Program Files\AIM 2008-01-21 20:34 --------- d-----w E:\Program Files\DAEMON Tools 2008-01-15 18:51 --------- d-----w E:\Program Files\PowerISO 2008-01-15 18:49 --------- d-----w E:\Program Files\SRN Micro 2008-01-14 04:40 --------- d--h--w E:\Program Files\InstallShield Installation Information 2008-01-03 04:10 --------- d-----w E:\Program Files\Radical Games 2007-12-26 01:09 --------- d-----w E:\Program Files\Starcraft 2007-12-20 19:00 --------- d-----w E:\Program Files\VideoLAN 2007-12-17 18:18 --------- d-----w E:\Program Files\DivX 2007-12-11 22:39 --------- d-----w E:\Program Files\HP DeskJet 710C Series 2007-12-11 22:34 9,464 ------w E:\WINDOWS\system32\drivers\cdralw2k.sys 2007-12-11 22:34 9,336 ------w E:\WINDOWS\system32\drivers\cdr4_xp.sys 2007-12-11 22:34 43,528 ------w E:\WINDOWS\system32\drivers\pxhelp20.sys 2007-12-11 22:34 3,596,288 ----a-w E:\WINDOWS\system32\qt-dx331.dll 2007-12-11 22:34 200,704 ----a-w E:\WINDOWS\system32\ssldivx.dll 2007-12-11 22:34 129,784 ----a-w E:\WINDOWS\system32\pxafs.dll 2007-12-11 22:34 120,056 ----a-w E:\WINDOWS\system32\pxcpyi64.exe 2007-12-11 22:34 118,520 ----a-w E:\WINDOWS\system32\pxinsi64.exe 2007-12-11 22:34 1,044,480 ----a-w E:\WINDOWS\system32\libdivx.dll 2007-12-11 22:33 81,920 ----a-w E:\WINDOWS\system32\dpl100.dll 2007-12-11 22:33 593,920 ----a-w E:\WINDOWS\system32\dpuGUI11.dll 2007-12-11 22:33 57,344 ----a-w E:\WINDOWS\system32\dpv11.dll 2007-12-11 22:33 53,248 ----a-w E:\WINDOWS\system32\dpuGUI10.dll 2007-12-11 22:33 344,064 ----a-w E:\WINDOWS\system32\dpus11.dll 2007-12-11 22:33 294,912 ----a-w E:\WINDOWS\system32\dpu11.dll 2007-12-11 22:33 294,912 ----a-w E:\WINDOWS\system32\dpu10.dll 2007-12-11 22:33 196,608 ----a-w E:\WINDOWS\system32\dtu100.dll 2007-12-11 22:32 156,992 ----a-w E:\WINDOWS\system32\DivXCodecVersionChecker.exe 2007-12-08 21:21 --------- d-----w E:\Program Files\ACE Mega CoDecS Pack 2007-11-08 18:21 43,520 ----a-w E:\WINDOWS\system32\CmdLineExt03.dll 2007-11-03 05:00 21,840 ----atw E:\WINDOWS\system32\SIntfNT.dll 2007-11-03 05:00 17,212 ----atw E:\WINDOWS\system32\SIntf32.dll 2007-11-03 05:00 12,067 ----atw E:\WINDOWS\system32\SIntf16.dll 2004-06-23 18:55 20,480 ----a-w E:\Program Files\ProcManager.exe 2005-05-13 23:12 217,073 --sha-r E:\WINDOWS\meta4.exe 2005-10-24 17:13 66,560 --sha-r E:\WINDOWS\MOTA113.exe 2005-10-14 03:27 422,400 --sha-r E:\WINDOWS\x2.64.exe 2005-10-08 01:14 308,224 --sha-r E:\WINDOWS\system32\avisynth.dll 2005-07-14 18:31 27,648 --sha-r E:\WINDOWS\system32\AVSredirect.dll 2005-06-26 21:32 616,448 --sha-r E:\WINDOWS\system32\cygwin1.dll 2005-06-22 04:37 45,568 --sha-r E:\WINDOWS\system32\cygz.dll 2004-01-25 06:00 70,656 --sha-r E:\WINDOWS\system32\i420vfw.dll 2005-12-23 02:23 816,640 --sha-r E:\WINDOWS\system32\smab.dll 2005-02-28 19:16 240,128 --sha-r E:\WINDOWS\system32\x.264.exe . CODE <pre> ----a-w 155,648 2008-01-19 23:04:42 E:\Program Files\Common Files\ScanSoft Shared\SSBkgdUpdate\SSBkgdupdate .exe ----a-w 200,704 2008-01-15 18:50:28 E:\Program Files\PowerISO\PWRISOVM .EXE ----a-w 13,312 2008-01-21 06:53:33 E:\WINDOWS\system32\ctfmon .exe ----a-w 484,864 2008-01-21 06:53:28 E:\WINDOWS\system32\NeroCheck .exe </pre> ((((((((((((((((((((((((((((( snapshot_2008-01-21_23.51.28.54 ))))))))))))))))))))))))))))))))))))))))) . - 2008-01-21 20:31:29 229,376 ----a-w E:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT + 2008-01-23 05:28:32 229,376 ----a-w E:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT - 2008-01-21 20:31:29 8,192 ----a-w E:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat + 2008-01-23 05:28:32 8,192 ----a-w E:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat - 2008-01-21 20:31:29 5,206,016 ----a-w E:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT + 2008-01-23 05:28:32 229,376 ----a-w E:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT - 2008-01-21 20:31:29 16,384 ----a-w E:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat + 2008-01-23 05:28:32 8,192 ----a-w E:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat - 2008-01-21 20:31:29 229,376 ----a-w E:\WINDOWS\erdnt\Hiv-backup\Users\00000005\NTUSER.DAT + 2008-01-23 05:28:32 5,206,016 ----a-w E:\WINDOWS\erdnt\Hiv-backup\Users\00000005\NTUSER.DAT - 2008-01-21 20:31:29 8,192 ----a-w E:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat + 2008-01-23 05:28:32 16,384 ----a-w E:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat + 2008-01-23 05:30:05 5,848 ----a-w E:\WINDOWS\SoftwareDistribution\EventCache\{6EC6499F-613C-482B-8F80-311FEFC6FBEC}.bin . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . Note empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "AIM"="E:\Program Files\AIM\aim.exe" [2004-04-27 16:18 61440] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "NvCplDaemon"="E:\WINDOWS\System32\NvCpl.dll" [2007-04-19 12:26 7700480] "nwiz"="nwiz.exe" [2007-04-19 12:26 1626112 E:\WINDOWS\system32\nwiz.exe] "DeadAIM"="E:\Program Files\AIM\\DeadAIM.ocm" [2003-02-24 16:11 266313] "PaperPort PTD"="E:\Program Files\ScanSoft\PaperPort\pptd40nt.exe" [2008-01-21 14:13 1042944] "NvMediaCenter"="E:\WINDOWS\System32\NvMcTray.dll" [2007-04-19 12:26 86016] E:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Microsoft Office.lnk - E:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-12 19:01:04 83360] R2 HPFECP13;HPFECP13;E:\WINDOWS\System32\drivers\HPFECP13.SYS [1998-07-30 15:40] R2 Pctspk;PCTEL Speaker Phone;E:\WINDOWS\system32\pctspk.exe [2001-08-17 21:36] R2 SVKP;SVKP;E:\WINDOWS\System32\SVKP.sys [2004-11-06 03:18] R3 HCWBT8XX;Hauppauge WinTV 848/9 WDM Video Driver;E:\WINDOWS\System32\drivers\HCWBT8XX.sys [2006-01-25 15:14] S3 AN983;ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet Adapter;E:\WINDOWS\System32\DRIVERS\AN983.sys [2002-08-28 21:59] S3 BrScnUsb;Brother USB Still Image driver;E:\WINDOWS\System32\Drivers\BrScnUsb.sys [2004-10-15 11:50] S3 BrSerIf;Brother MFC Serial Port Interface WDM Driver;E:\WINDOWS\System32\Drivers\BrSerIf.sys [2004-09-29 02:24] S3 BrUsbSer;Brother MFC USB Serial WDM Driver;E:\WINDOWS\System32\Drivers\BrUsbSer.sys [2004-01-10 03:28] S3 cdspacex;cdspacex;E:\WINDOWS\System32\DRIVERS\CDSPACEX.sys [] S3 PCnetHL;AMD PCnet-Home Adapter Driver;E:\WINDOWS\System32\DRIVERS\pcntn5hl.sys [2001-08-17 11:11] S3 Ptserlp;PCTEL Serial Device Driver for PCI;E:\WINDOWS\System32\DRIVERS\ptserlp.sys [2001-08-17 12:28] S3 TwoRabts;Two Rabbits Live Bus;E:\WINDOWS\System32\DRIVERS\TwoRabts.sys [] . ************************************************************************ catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-01-22 23:31:50 Windows 5.1.2600 Service Pack 1 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ . Completion time: 2008-01-22 23:34:58 - machine was rebooted ComboFix-quarantined-files.txt 2008-01-23 05:34:44 ComboFix2.txt 2008-01-23 02:28:34 ComboFix3.txt 2008-01-22 05:51:55 ComboFix4.txt 2008-01-21 20:39:15

dementievafan

Jan 22 2008, 11:36 PM

Post #9

Member

Posts: 11
OS: xp

Logfile of HijackThis v1.99.1
Scan saved at 11:35:13 PM, on 01/22/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
E:\WINDOWS\System32\smss.exe
E:\WINDOWS\system32\winlogon.exe
E:\WINDOWS\system32\services.exe
E:\WINDOWS\system32\lsass.exe
E:\WINDOWS\system32\svchost.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\system32\spoolsv.exe
E:\WINDOWS\Explorer.EXE
E:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
E:\Program Files\AIM\aim.exe
E:\WINDOWS\System32\nvsvc32.exe
E:\WINDOWS\system32\pctspk.exe
E:\WINDOWS\System32\svchost.exe
E:\WINDOWS\System32\wuauclt.exe
E:\WINDOWS\system32\msiexec.exe
E:\WINDOWS\system32\MsiExec.exe
E:\WINDOWS\system32\MsiExec.exe
E:\WINDOWS\system32\notepad.exe
E:\Documents and Settings\Philip\Desktop\HijackThis1991.exe

R1 - HKCU\Software\Microsoft\Internet Explorer,(Default) = www.google.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = E:\WINDOWS\about.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 127.0.0.1:8100
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
R3 - URLSearchHook: &Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE E:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [DeadAIM] rundll32.exe "E:\Program Files\AIM\\DeadAIM.ocm",ExportedCheckODLs
O4 - HKLM\..\Run: [PaperPort PTD] E:\Program Files\ScanSoft\PaperPort\pptd40nt.exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE E:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [AIM] E:\Program Files\AIM\aim.exe -cnetwait.odl
O4 - Startup: Adobe Gamma.lnk = E:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Microsoft Office.lnk = E:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Google Search - res://e:\program files\google\GoogleToolbar1.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://e:\program files\google\GoogleToolbar1.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://e:\program files\google\Googl