Need Help with Permanent Removal of Virtum-Gen Virus [RESOLVED]

Need a geek? Geeks to Go offers free, quality tech support -- in terms anyone can understand. Volunteers are waiting to help, friendly, technology experts who have knowledge to share, and enjoy helping others. Feel free to browse the site as a guest. However, you must log in to reply to existing topics, or to start a new topic of your own. Other benefits of joining include richer forum features, and removal of all advertising. Learn more in our Welcome Guide Infected? Malware and Spyware Cleaning Guide. What are you waiting for? Click here to join for free today!

> Geeks to Go! » Security » Virus, Spyware and Trojan Removal

2 Pages

1 2 >

Need Help with Permanent Removal of Virtum-Gen Virus [RESOLVED]

Options

WezVillag View Member Profile	Nov 3 2007, 04:40 PM Post #1
Member Posts: 15 OS: Xp	Hi, I have read ur articles on how to remove Virtum-Gen Virus and have followed your instructions to a tee. I ran my Anti Virus/Spyware program (Webroot) it found this virus but couldn't quarantine it or remove it. I went to the file and tried to manually delete it and was unable to do so. I downloaded AFT-Cleaner ran it. Downloaded VundoFix ran it, the virus showed, but VundoFix was unable to delete the file. I downloaded KillBox. Was able to kill the file thru that program. Rebooted, ran my Webroot again. There were two new files infected by this Virtum-Gen Virus and for some reason my Webroot program can't clean the files. So, I go to them manually and remove the files. They are always in my System 32 folder, empty recycle bin, reboot, run Webroot again and two more new files are infected. Yet, when I run VundoFix it comes out clean, doesn't show any type of infection at all. Please tell me what to do here, it's running me ragged. I have sent a log to Webroot and they haven't answered my cry for help. Thanks, Louise Here is my Hijackthis log Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 4:29:40 PM, on 11/3/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Insider\Insider.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\svchost.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\Program Files\MSN Messenger\usnsvc.exe C:\Program Files\MSN Messenger\msnmsgr.exe C:\Program Files\MSN Messenger\livecall.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Webroot\Spy Sweeper\SSU.EXE C:\Program Files\Internet Explorer\iexplore.exe C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Documents and Settings\HP_Owner\My Documents\Mystic Island\MLobby.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://accountservices.passport.net/reg.sr...egXPWizCredOnly R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Comcast R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0 R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll O2 - BHO: (no name) - {00009E9F-DDD7-AA59-AA7D-AA4B7D6BE000} - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll O2 - BHO: (no name) - {3f31df27-8ecc-4ad0-a8f0-9b25ceec685a} - C:\WINDOWS\system32\chkvol.dll (file missing) O2 - BHO: Watch for Browser Events - {42A7CE31-CEE7-4CCE-A060-A44A7E52E062} - C:\PROGRA~1\KEYBOA~1\kie.dll O2 - BHO: Watch for Browser Events - {516E2306-7ADF-47EC-AEA8-ACB6B51899F1} - C:\PROGRA~1\MACROE~1\iCapture.dll O2 - BHO: (no name) - {60C5BB97-19DC-412F-B716-895341C0CA47} - C:\WINDOWS\system32\mljjh.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: (no name) - {820A2C8D-DFC0-4A9F-B3CA-4410CA4F7C04} - C:\WINDOWS\system32\opnommk.dll (file missing) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: (no name) - {FD9446FB-1FE2-4B4E-98CF-E2E3EF7C5774} - C:\WINDOWS\system32\pmnlk.dll (file missing) O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll O4 - HKLM\..\Run: [SiSPower] "Rundll32.exe" SiSPower.dll,ModeAgent O4 - HKLM\..\Run: [SpySweeper] C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe /startintray O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [Insider] "C:\Program Files\Insider\Insider.exe" O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\program files\spyware doctor\filterlsp.dll O15 - Trusted Zone: .sbcglobal.net O15 - Trusted Zone: http://.sbcglobal.net O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/pcpitstop/PCPitStop.CAB O16 - DPF: {10093E98-C073-4C75-8D0E-FB5CD3A71D33} (ZoneUpwords Object) - http://messenger.zone.msn.com/binary/Upwords.cab57176.cab O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games – Buddy Invite) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://messenger.zone.msn.com/EN-US/a-LUXR/mjolauncher.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab55762.cab O16 - DPF: {9BDF4724-10AA-43D5-BD15-AEA0D2287303} (MSN Games – Texas Holdem Poker) - http://zone.msn.com/bingame/zpagames/zpa_txhe.cab60231.cab O16 - DPF: {A031D222-B496-11D2-9CC8-00105A10AAF6} (WONWebLauncher Class) - http://hoylegames.sierra.com/cab/WONWebLauncherControl.cab O16 - DPF: {A4110378-789B-455F-AE86-3A1BFC402853} (ZPA_SHVL Object) - http://zone.msn.com/bingame/zpagames/zpa_shvl.cab55579.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab O16 - DPF: {CAC181B0-4D70-402D-B571-C596A47D0CE0} (CBankshotZoneCtrl Class) - http://zone.msn.com/bingame/zpagames/zpa_pool.cab56649.cab O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games – Game Communicator) - http://zone.msn.com/binframework/v10/StProxy.cab55579.cab O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab57176.cab O16 - DPF: {EF148DBB-5B6D-4130-B2A1-661571E86260} (Playtime Games Launcher) - http://download-games.pogo.com/online2/pog...ameLauncher.cab O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by112fd.bay112.hotmail.msn.com/activex/HMAtchmt.ocx O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab O16 - DPF: {FA945BB6-9D37-43FC-9B2A-AF09F56CBBF0} (moDiagCollectionActiveX Object) - http://www.musicmatch.com/form/support/tec...tionControl.cab O20 - AppInit_DLLs: C:\WINDOWS\system32\win_8lh.dll O20 - Winlogon Notify: chkvol - chkvol.dll (file missing) O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe O24 - Desktop Component 0: (no name) - C:\Program Files\microsoft frontpage\vilohdo.html -- End of file - 10856 bytes This post has been edited by WezVillag: Nov 3 2007, 05:32 PM

Stamper19 View Member Profile	Nov 4 2007, 08:30 AM Post #2
Trusted Helper Posts: 1,991 OS: Windows XP	Hi WezVillag, Welcome to Geeks to Go! My name is Stamper19 and I will be helping you with your Malware problem. During the course of our interactions please be sure to follow all instructions carefully, and ask questions if you are unsure of how to proceed at any point. ---------------------------------------------------------------- Please download Deckard's System Scanner (DSS) to your Desktop. Close all applications and windows. Double-click on DSS.exe to run it, and follow the prompts. The scan may take a minute. When the scan is complete, two text files will open - Main.txt and Extra.txt Extra Note: When running DSS, some firewalls may warn that sigcheck.exe is trying to access the internet - please ensure that you allow sigcheck.exe permission to do so. Also, it may happen that your Antivirus flags DSS as suspicious. Please allow the Deckard's System Scanner to run and don't let your Antivirus delete it. (In this case, it may be better to temporary disable your Antivirus) Post the main.txt and extra.txt from the C:\Deckard\System Scanner folder into your next reply. ---------------------------------------------------------------- Information to include in your next post: main.txt and extra.txt from DSS

Stamper19 View Member Profile	Nov 4 2007, 08:56 PM Post #4
Trusted Helper Posts: 1,991 OS: Windows XP	Hi WezVillag, I see a few things we need to get rid of, so lets get that taken care of. ---------------------------------------------------------------- Please download the OTMoveIt by OldTimer. Save it to your desktop We will run the program later. ---------------------------------------------------------------- Please submit the following files for analysis. Jotti File Submission: Please go to Jotti's malware scan Copy and paste the following file path into the "File to upload & scan"box on the top of the page: C:\WINDOWS\system32\win_8lh.dll Click on the submit button Please post the results in your next reply. Please note that if you are submitting more than one file they will have to be entered one at a time. ---------------------------------------------------------------- Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below. O2 - BHO: (no name) - {3f31df27-8ecc-4ad0-a8f0-9b25ceec685a} - C:\WINDOWS\system32\chkvol.dll (file missing) O2 - BHO: (no name) - {FD9446FB-1FE2-4B4E-98CF-E2E3EF7C5774} - C:\WINDOWS\system32\pmnlk.dll (file missing) O20 - Winlogon Notify: chkvol - chkvol.dll (file missing) Now close all windows other than HiJackThis, then click Fix Checked. Close HiJackThis. Reboot into safe mode. Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode. ---------------------------------------------------------------- Please go to Start > Control Panel > Add/Remove Programs and remove the following (if present): Ares <<Optional - see below LimeWire PRO 4.12.11 <<Optional - see below Optionals: Although Ares and LimeWire are not malware themselves, the files downloaded with them are often a major source of infection, and they are likely the source of your current ailments. Hence, I strongly advise that they be removed. The choice to do so is yours, but keeping them will greatly increase your likelihood of being infected again in the future. Please note any other programs that you dont recognize in that list in your next response ---------------------------------------------------------------- Using Windows Explorer (to get there right-click your Start button and go to "Explore"), please delete these FOLDERS (if present): C:\Program Files\Ares P2P <<If removed in previous step C:\Program Files\LimeWire <<If removed in previous step ---------------------------------------------------------------- Lets delete some ill mannered files. Please double-click OTMoveIt.exe to run it. Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy): C:\WINDOWS\system32\rlph.dll Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste. Click the red Moveit! button. Close OTMoveIt If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. Please "Copy" the results from the "Results" window (to the right) and then "Paste" them into your next reply on the forum. Reboot into Normal Mode. ---------------------------------------------------------------- Please do an online scan with Kaspersky WebScanner Click on Kaspersky Online Scanner You will be promted to install an ActiveX component from Kaspersky, Click Yes. The program will launch and then begin downloading the latest definition files: Once the files have been downloaded click on NEXT Now click on Scan Settings In the scan settings make that the following are selected: Scan using the following Anti-Virus database: Extended (if available otherwise Standard) Scan Options: Scan Archives Scan Mail Bases Click OK Now under select a target to scan: Select My Computer This will program will start and scan your system. The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected. Now click on the Save as Text button: Save the file to your desktop. Copy and paste that information in your next post. ---------------------------------------------------------------- Please re-run Deckard's System Scanner (DSS). Close all applications and windows. Double-click on DSS.exe to run it, and follow the prompts. The scan may take a minute. When the scan is complete, two text files will open - Main.txt and Extra.txt Extra Note: When running DSS, some firewalls may warn that sigcheck.exe is trying to access the internet - please ensure that you allow sigcheck.exe permission to do so. Also, it may happen that your Antivirus flags DSS as suspicious. Please allow the Deckard's System Scanner to run and don't let your Antivirus delete it. (In this case, it may be better to temporary disable your Antivirus) Post the main.txt from the C:\Deckard\System Scanner folder into your next reply. ---------------------------------------------------------------- Information to include in your next post: Jotti File Scan report OTMoveIt Report Kapersky Scan Log main.txt from DSS Let me know how the computer is running.

WezVillag View Member Profile	Nov 5 2007, 08:05 AM Post #5
Member Posts: 15 OS: Xp	Hiyas Stamper, Good Morning! ok I tried the scan @ Jotti's I get this message: The file you uploaded is 0 bytes. It is very likely a firewall or a piece of malware is prohibiting you from uploading this file After this, I disabled Webroot and my windows firewall, tried the scan again and got same message. Did you want me to continue with the rest of the steps? My computer performance is fine. There were some strange happenings before I installed Webroot. Lot of pop ups, could hear pages from the web in the background when IE wasn't open. Web pages setting themselves as my desktop background. They have all stopped. Basically I dont realize I have the malware until I run scans. I didnt have an antivirus program on here and windows firewalls was disabled. My son got on my computer while I was at work and went to myspace, my puter was wide open. Big Big Mistake!!! Please let me know what you want me to do. Louise

Stamper19 View Member Profile	Nov 5 2007, 08:21 AM Post #6
Trusted Helper Posts: 1,991 OS: Windows XP	'mornin Louise, Go ahead and continue with the rest of the steps. We will have a good idea of where we stand once you get through them

WezVillag View Member Profile	Nov 5 2007, 07:30 PM Post #7
Member Posts: 15 OS: Xp	This post has been edited by WezVillag: Nov 5 2007, 07:42 PM Attached File(s) OTM.txt ( 256bytes ) Number of downloads: 37

WezVillag View Member Profile	Nov 5 2007, 07:43 PM Post #8
Member Posts: 15 OS: Xp	Stamper are you there?

Stamper19 View Member Profile	Nov 5 2007, 07:50 PM Post #9
Trusted Helper Posts: 1,991 OS: Windows XP	Hi Louise, There is a bug on the boards that sometimes causes your posts not to show. When this happens just wrap your entire post in a quote box and that will fix it. To do that simply type your post, highlight the entire post, and then press the "wrap in quotes" button (it is the second button from the right under the "Fonts" droplist box. Sorry about that. Stamper

WezVillag View Member Profile	Nov 5 2007, 07:53 PM Post #10
Member Posts: 15 OS: Xp	it won't let me send the kaspersky log it's a huge log when i try to send it my whole computer freezes up This post has been edited by WezVillag: Nov 5 2007, 08:17 PM

WezVillag View Member Profile	Nov 5 2007, 08:20 PM Post #11
Member Posts: 15 OS: Xp	stamper I can't send the kaspersky log I think it's too big my puter freezes up ....... here's some of it tho.... I'm in trouble tho lol Total number of scanned objects: 117869 Number of viruses found: 13 Number of infected objects: 53

Stamper19 View Member Profile	Nov 5 2007, 08:42 PM Post #12
Trusted Helper Posts: 1,991 OS: Windows XP	Are you able to paste the log directly into the post, or add it as an attachment?

WezVillag View Member Profile	Nov 5 2007, 08:46 PM Post #13
Member Posts: 15 OS: Xp	when i post it my computer freezes....... then when it stops freezing i see it but when i hit the post button it's when the post comes out blank......... I have tried to upload it but it says the file is too big

Stamper19 View Member Profile	Nov 5 2007, 08:59 PM Post #14
Trusted Helper Posts: 1,991 OS: Windows XP	Hi Louise, Lets skip Kapersky for now. We need to get rid of another file and we'll run a different scanner to see if it works better for us. Also, please try to paste the logs directly into your post when possible (as opposed to adding as an attachment). It makes it much easier for me to keep track of whats going on ---------------------------------------------------------------- Lets delete some ill mannered files. Please double-click OTMoveIt.exe to run it. Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy): C:\WINDOWS\system32\win_8lh.dll Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste. Click the red Moveit! button. Close OTMoveIt If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. Please "Copy" the results from the "Results" window (to the right) and then "Paste" them into your next reply on the forum. ---------------------------------------------------------------- Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below. O20 - AppInit_DLLs: C:\WINDOWS\system32\win_8lh.dll Now close all windows other than HiJackThis, then click Fix Checked. Close HiJackThis. ---------------------------------------------------------------- Please clean out your temp files. Please download ATF Cleaner by Atribune. This program is for XP and Windows 2000 only Double-click ATF-Cleaner.exe to run the program. Under Main choose: Select All Click the Empty Selected button. If you use Firefox browser Click Firefox at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. If you use Opera browser Click Opera at the top and choose: Select All Click the Empty Selected button. NOTE: If you would like to keep your saved passwords, please click No at the prompt. Click Exit on the Main menu to close the program. For Technical Support, double-click the e-mail address located at the bottom of each menu. ---------------------------------------------------------------- Please go HERE to run Panda's ActiveScan Once you are on the Panda site click the Scan your PC button A new window will open...click the Check Now button Enter your Country Enter your State/Province Enter your e-mail address and click send Select either Home User or Company Click the big Scan Now button If it wants to install an ActiveX component allow it It will start downloading the files it requires for the scan (Note: It may take a couple of minutes) When download is complete, click on My Computer to start the scan When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location. Post the contents of the ActiveScan report ---------------------------------------------------------------- Please re-run Deckard's System Scanner (DSS). Close all applications and windows. Double-click on DSS.exe to run it, and follow the prompts. The scan may take a minute. When the scan is complete, two text files will open - Main.txt and Extra.txt Extra Note: When running DSS, some firewalls may warn that sigcheck.exe is trying to access the internet - please ensure that you allow sigcheck.exe permission to do so. Also, it may happen that your Antivirus flags DSS as suspicious. Please allow the Deckard's System Scanner to run and don't let your Antivirus delete it. (In this case, it may be better to temporary disable your Antivirus) Post the main.txt from the C:\Deckard\System Scanner folder into your next reply. ---------------------------------------------------------------- Information to include in your next post: OTMoveIt Report ActiveScan log main.txt from DSS Let me know how the computer is running.

WezVillag View Member Profile	Nov 6 2007, 08:09 AM Post #15
Member Posts: 15 OS: Xp	Ok here we are again Good morning to ya! Here are the logs you asked for......... OTM File/Folder C:\WINDOWS\system32\win_8lh.dll not found. File/Folder not found. File/Folder not found. Created on 11/05/2007 19:05:15 Incident Status Location Adware:Adware/SweetBar Not disinfected C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll Potentially unwanted tool:Application/iWon Not disinfected C:\Deckard\System Scanner\20071105171530\backup\WINDOWS\Downloaded Program Files\WONWebLauncherControl.ocx Spyware:Cookie/AdDynamix Not disinfected C:\Documents and Settings\HP_Owner\Cookies\hp_owner@ads.addynamix[1].txt Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\HP_Owner\Cookies\hp_owner@atdmt[2].txt Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\HP_Owner\Cookies\hp_owner@bs.serving-sys[1].txt Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\HP_Owner\Cookies\hp_owner@serving-sys[2].txt Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\HP_Owner\Desktop\ComboFix.exe[nircmd.exe] Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\Documents and Settings\HP_Owner\Desktop\ComboFix.exe[nircmd.cfexe] Potentially unwanted tool:Application/KillApp.B Not disinfected C:\hp\bin\KillIt.exe Adware:Adware/SweetBar Not disinfected C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll Virus:Generic Trojan Disinfected C:\Program Files\MP3 Stream Editor\Plugins\SoniquePlugins\Cosmic Nebulae\CosmicNebulae.svp Virus:Generic Malware Disinfected C:\Program Files\Online Services\PeoplePC\Utilities\AtlBrowser.exe Spyware:Spyware/New.net Not disinfected C:\qoobox\Quarantine\C\WINDOWS\NDNuninstall7_22.exe.vir Spyware:Spyware/MarketScore Not disinfected C:\qoobox\Quarantine\C\WINDOWS\system32\rlvknlg.exe.vir Spyware:Cookie/2o7 Not disinfected C:\USERDATA\Cookies\hp_owner@2o7[1].txt Spyware:Cookie/Hbmediapro Not disinfected C:\USERDATA\Cookies\hp_owner@adopt.hbmediapro[2].txt Spyware:Cookie/AdDynamix Not disinfected C:\USERDATA\Cookies\hp_owner@ads.addynamix[1].txt Spyware:Cookie/PointRoll Not disinfected C:\USERDATA\Cookies\hp_owner@ads.pointroll[2].txt Spyware:Cookie/Advertising Not disinfected C:\USERDATA\Cookies\hp_owner@advertising[2].txt Spyware:Cookie/Falkag Not disinfected C:\USERDATA\Cookies\hp_owner@as-eu.falkag[1].txt Spyware:Cookie/Falkag Not disinfected C:\USERDATA\Cookies\hp_owner@as-us.falkag[1].txt Spyware:Cookie/Atlas DMT Not disinfected C:\USERDATA\Cookies\hp_owner@atdmt[2].txt Spyware:Cookie/Atwola Not disinfected C:\USERDATA\Cookies\hp_owner@atwola[2].txt Spyware:Cookie/Belnk Not disinfected C:\USERDATA\Cookies\hp_owner@belnk[1].txt Spyware:Cookie/bravenetA Not disinfected C:\USERDATA\Cookies\hp_owner@bravenet[2].txt Spyware:Cookie/Serving-sys Not disinfected C:\USERDATA\Cookies\hp_owner@bs.serving-sys[2].txt Spyware:Cookie/BurstNet Not disinfected C:\USERDATA\Cookies\hp_owner@burstnet[1].txt Spyware:Cookie/Cgi-bin Not disinfected C:\USERDATA\Cookies\hp_owner@cgi-bin[1].txt Spyware:Cookie/Cgi-bin Not disinfected C:\USERDATA\Cookies\hp_owner@cgi-bin[5].txt Spyware:Cookie/Bridgetrack Not disinfected C:\USERDATA\Cookies\hp_owner@citi.bridgetrack[1].txt Spyware:Cookie/Com.com Not disinfected C:\USERDATA\Cookies\hp_owner@com[1].txt Spyware:Cookie/did-it Not disinfected C:\USERDATA\Cookies\hp_owner@did-it[1].txt Spyware:Cookie/Belnk Not disinfected C:\USERDATA\Cookies\hp_owner@dist.belnk[2].txt Spyware:Cookie/Doubleclick Not disinfected C:\USERDATA\Cookies\hp_owner@doubleclick[2].txt Spyware:Cookie/FortuneCity Not disinfected C:\USERDATA\Cookies\hp_owner@fortunecity[2].txt Spyware:Cookie/Maxserving Not disinfected C:\USERDATA\Cookies\hp_owner@maxserving[2].txt Spyware:Cookie/Mediaplex Not disinfected C:\USERDATA\Cookies\hp_owner@mediaplex[1].txt Spyware:Cookie/Overture Not disinfected C:\USERDATA\Cookies\hp_owner@overture[2].txt Spyware:Cookie/Overture Not disinfected C:\USERDATA\Cookies\hp_owner@perf.overture[1].txt Spyware:Cookie/QuestionMarket Not disinfected C:\USERDATA\Cookies\hp_owner@questionmarket[1].txt Spyware:Cookie/RealMedia Not disinfected C:\USERDATA\Cookies\hp_owner@realmedia[2].txt Spyware:Cookie/WUpd Not disinfected C:\USERDATA\Cookies\hp_owner@revenue[1].txt Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\USERDATA\Cookies\hp_owner@server.iad.liveperson[1].txt Spyware:Cookie/Serving-sys Not disinfected C:\USERDATA\Cookies\hp_owner@serving-sys[1].txt Spyware:Cookie/DriveCleaner Not disinfected C:\USERDATA\Cookies\hp_owner@stats.drivecleaner[2].txt Spyware:Cookie/Reliablestats Not disinfected C:\USERDATA\Cookies\hp_owner@stats1.reliablestats[1].txt Spyware:Cookie/Mammamediasolutions Not disinfected C:\USERDATA\Cookies\hp_owner@targetnet[1].txt Spyware:Cookie/Traffic Marketplace Not disinfected C:\USERDATA\Cookies\hp_owner@trafficmp[1].txt Spyware:Cookie/Tribalfusion Not disinfected C:\USERDATA\Cookies\hp_owner@tribalfusion[2].txt Spyware:Cookie/WebPower Not disinfected C:\USERDATA\Cookies\hp_owner@webpower[1].txt Spyware:Cookie/BurstBeacon Not disinfected C:\USERDATA\Cookies\hp_owner@www.burstbeacon[1].txt Spyware:Cookie/DriveCleaner Not disinfected C:\USERDATA\Cookies\hp_owner@www.drivecleaner[2].txt Spyware:Cookie/Zedo Not disinfected C:\USERDATA\Cookies\hp_owner@zedo[2].txt Potentially unwanted tool:Application/NirCmd.A Not disinfected C:\WINDOWS\NirCmd.exe Deckard's System Scanner v20071014.68 Run by HP_Owner on 2007-11-06 05:57:20 Computer is in Normal Mode. -------------------------------------------------------------------------------- -- HijackThis (run as HP_Owner.exe) -------------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 5:57:23 AM, on 11/6/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\WINDOWS\system32\CTsvcCDA.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\WINDOWS\system32\svchost.exe C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe C:\Program Files\MSN Messenger\usnsvc.exe C:\Documents and Settings\HP_Owner\Desktop\dss.exe C:\PROGRA~1\TRENDM~1\HIJACK~1\HP_Owner.exe R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://ie.redirect.hp.com/svs/rdr?TYPE=3&a...&pf=desktop R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = https://accountservices.passport.net/reg.sr...egXPWizCredOnly R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0 R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) R3 - URLSearchHook: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll O2 - BHO: SWEETIE - {1A0AADCD-3A72-4b5f-900F-E3BB5A838E2A} - C:\PROGRA~1\MACROG~1\SWEETI~1\toolbar.dll O2 - BHO: Watch for Browser Events - {42A7CE31-CEE7-4CCE-A060-A44A7E52E062} - C:\PROGRA~1\KEYBOA~1\kie.dll O2 - BHO: Watch for Browser Events - {516E2306-7ADF-47EC-AEA8-ACB6B51899F1} - C:\PROGRA~1\MACROE~1\iCapture.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O3 - Toolbar: HP view - {B2847E28-5D7D-4DEB-8B67-05D28BCF79F5} - c:\Program Files\HP\Digital Imaging\bin\HPDTLK02.dll O3 - Toolbar: SweetIM For Internet Explorer - {BC4FFE41-DE9F-46fa-B455-AAD49B9F9938} - C:\Program Files\Macrogaming\SweetIMBarForIE\toolbar.dll O4 - HKLM\..\Run: [SiSPower] "Rundll32.exe" SiSPower.dll,ModeAgent O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MI1933~1\OFFICE11\REFIEBAR.DLL O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O10 - Unknown file in Winsock LSP: c:\program files\spyware doctor\filterlsp.dll O15 - Trusted Zone: .sbcglobal.net O15 - Trusted Zone: http://.sbcglobal.net O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (StagingUI Object) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://pcpitstop.com/pcpitstop/PCPitStop.CAB O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab O16 - DPF: {10093E98-C073-4C75-8D0E-FB5CD3A71D33} (ZoneUpwords Object) - http://messenger.zone.msn.com/binary/Upwords.cab57176.cab O16 - DPF: {2250C29C-C5E9-4F55-BE4E-01E45A40FCF1} (CMediaMix Object) - http://musicmix.messenger.msn.com/Medialogic.CAB O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab31267.cab O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games – Buddy Invite) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (ZonePAChat Object) - http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab O16 - DPF: {7E980B9B-8AE5-466A-B6D6-DA8CF814E78A} (MJLauncherCtrl Class) - http://messenger.zone.msn.com/EN-US/a-LUXR/mjolauncher.cab O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab31267.cab O16 - DPF: {97E71027-0BA2-44F2-97DB-F84D808ED0B6} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab55762.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {9BDF4724-10AA-43D5-BD15-AEA0D2287303} (MSN Games – Texas Holdem Poker) - http://zone.msn.com/bingame/zpagames/zpa_txhe.cab60231.cab O16 - DPF: {A031D222-B496-11D2-9CC8-00105A10AAF6} (WONWebLauncher Class) - http://hoylegames.sierra.com/cab/WONWebLauncherControl.cab O16 - DPF: {A4110378-789B-455F-AE86-3A1BFC402853} (ZPA_SHVL Object) - http://zone.msn.com/bingame/zpagames/zpa_shvl.cab55579.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab O16 - DPF: {BD393C14-72AD-4790-A095-76522973D6B8} (CBreakshotControl Class) - http://messenger.zone.msn.com/binary/Bankshot.cab57213.cab O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...nt.cab56907.cab O16 - DPF: {CAC181B0-4D70-402D-B571-C596A47D0CE0} (CBankshotZoneCtrl Class) - http://zone.msn.com/bingame/zpagames/zpa_pool.cab56649.cab O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games – Game Communicator) - http://zone.msn.com/binframework/v10/StProxy.cab55579.cab O16 - DPF: {DA758BB1-5F89-4465-975F-8D7179A4BCF3} (WheelofFortune Object) - http://messenger.zone.msn.com/binary/WoF.cab57176.cab O16 - DPF: {EF148DBB-5B6D-4130-B2A1-661571E86260} (Playtime Games Launcher) - http://download-games.pogo.com/online2/pog...ameLauncher.cab O16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) - http://by112fd.bay112.hotmail.msn.com/activex/HMAtchmt.ocx O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineS...er.cab56986.cab O16 - DPF: {FA945BB6-9D37-43FC-9B2A-AF09F56CBBF0} (moDiagCollectionActiveX Object) - http://www.musicmatch.com/form/support/tec...tionControl.cab O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: Spyware Doctor Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\svcntaux.exe O23 - Service: Spyware Doctor Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\swdsvc.exe O23 - Service: Webroot Spy Sweeper Engine (WebrootSpySweeperService) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe -- End of file - 9132 bytes -- Files created between 2007-10-06 and 2007-11-06 ----------------------------- 2007-11-05 19:17:51 0 d-------- C:\WINDOWS\system32\ActiveScan 2007-11-05 19:17:48 0 d-------- C:\WINDOWS\LastGood 2007-11-05 12:33:36 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab 2007-11-05 12:33:35 0 d-------- C:\WINDOWS\system32\Kaspersky Lab 2007-11-05 12:24:01 0 d-------- C:\Documents and Settings\NetworkService\Application Data\Webroot 2007-11-03 16:29:26 0 d-------- C:\Program Files\Trend Micro 2007-11-01 18:45:16 0 d-------- C:\VundoFix Backups 2007-10-31 01:36:05 0 d--h----- C:\Documents and Settings\LocalService\SendTo 2007-10-31 01:35:33 0 dr-h----- C:\Documents and Settings\LocalService\Recent 2007-10-31 01:35:30 0 d-------- C:\Documents and Settings\LocalService\Start Menu 2007-10-31 01:35:30 0 d-------- C:\Documents and Settings\LocalService\Desktop 2007-10-30 22:06:17 49152 --a------ C:\WINDOWS\system32\SiSPower.dll <Not Verified; Silicon Integrated Systems Corporation; SiS Power Scheme Library> 2007-10-30 22:06:17 7168 --a------ C:\WINDOWS\InstFunc.dll <Not Verified; Silicon Integrated Systems Corporation; SiS ® Compatible Super VGA InstFunc Dynamic Link Library> 2007-10-30 20:31:51 0 d--h----- C:\Documents and Settings\LocalService\NetHood 2007-10-30 20:31:51 0 dr------- C:\Documents and Settings\LocalService\My Documents 2007-10-30 18:47:43 0 d-------- C:\Documents and Settings\LocalService\Application Data\Webroot 2007-10-30 18:47:13 0 d-------- C:\Program Files\Webroot 2007-10-30 18:47:13 0 d-------- C:\Documents and Settings\HP_Owner\Application Data\Webroot 2007-10-30 18:47:13 0 d-------- C:\Documents and Settings\All Users\Application Data\Webroot 2007-10-30 18:43:50 164 --a------ C:\install.dat 2007-10-30 12:30:33 0 dr------- C:\Documents and Settings\LocalService\Favorites 2007-10-30 09:42:08 4648960 --a------ C:\Documents and Settings\HP_Owner\ntuser.dat 2007-10-30 09:36:29 0 d-------- C:\WINDOWS\system32\Mz02r 2007-10-15 23:42:30 0 d-------- C:\Program Files\Macrogaming 2007-10-15 20:11:36 0 d-------- C:\Program Files\iPod 2007-10-15 20:11:22 0 d-------- C:\Program Files\iTunes 2007-10-15 20:07:46 0 d-------- C:\Program Files\Apple Software Update 2007-10-15 20:07:18 0 d-------- C:\Program Files\Common Files\Apple 2007-10-15 20:07:17 0 d-------- C:\Documents and Settings\All Users\Application Data\Apple -- Find3M Report --------------------------------------------------------------- 2007-11-05 20:58:29 0 d-------- C:\Program Files\MSN Messenger 2007-11-05 20:53:50 0 d-------- C:\Program Files\Messenger Plus! Live 2007-11-05 20:53:32 0 d-------- C:\Program Files\Macro Express3 2007-11-05 20:52:56 0 d-------- C:\Program Files\Keyboard Express 3 2007-11-05 17:35:29 384 --a------ C:\WINDOWS\system32\DVCStateBkp-{00000000-00000000-00000008-00001102-00000004-20021102}.dat 2007-11-05 17:35:29 384 --a------ C:\WINDOWS\system32\DVCState-{00000000-00000000-00000008-00001102-00000004-20021102}.dat 2007-11-03 23:34:04 0 d-------- C:\Program Files\microsoft frontpage 2007-10-31 01:26:01 0 d-------- C:\Program Files\Common Files 2007-10-27 07:09:44 0 d-------- C:\Program Files\MSN Games 2007-10-15 20:09:39 0 d-------- C:\Program Files\QuickTime 2007-10-05 16:10:47 0 d-------- C:\Program Files\Ares P2P 2007-10-05 13:56:54 0 d-------- C:\Program Files\Ares 2007-09-24 07:36:28 0 d-------- C:\Program Files\MP3 Stream Editor -- Registry Dump --------------------------------------------------------------- Note empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "SiSPower"="Rundll32.exe" [08/04/2004 03:00 AM C:\WINDOWS\system32\rundll32.exe] "SpySweeper"="C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" [10/01/2007 04:40 PM] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 03:00 AM] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice" [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WebrootSpySweeperService] @="Service" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Digital Imaging Monitor.lnk backup=C:\WINDOWS\pss\HP Digital Imaging Monitor.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Updates from HP.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Updates from HP.lnk backup=C:\WINDOWS\pss\Updates from HP.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AGRSMMSG] AGRSMMSG.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcxMonitor] ALCXMNTR.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares] "C:\Program Files\Ares\bak\Ares.exe" -h [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTDVDDET] C:\Program Files\Creative\SBAudigy2ZS\DVDAudio\CTDVDDet.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTHelper] CTHELPER.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CTSysVol] C:\Program Files\Creative\SBAudigy2ZS\Surround Mixer\CTSysVol.exe /r [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DC6_Check] "C:\Program Files\Common Files\WinAntiSpyware 2007 Free\uwasdc.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ERS_Check] "C:\Program Files\Common Files\WinAntiSpyware 2007 Free\uwasers.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ERTcw] "C:\Program Files\Common Files\ErrorProtector\ERTcw.exe" -c [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHUPD06] c:\Program Files\HP\{AAC4FC36-8F89-4587-8DD3-EBC57C83374D}\hphupd06.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpsysdrv] c:\windows\system\hpsysdrv.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\I&F Viewer toolbar] "C:\Program Files\Photo Toolkit\ivbar\phototoolkitmem.exe" -start [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IESet] IExplorer.dll .dbt [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\KBD] C:\HP\KBD\KBD.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LSBWatcher] c:\hp\drivers\hplsbwatcher\lsburnwatcher.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MessengerPlus3] "C:\Program Files\MessengerPlus! 3\MsgPlus.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~2\mimboot.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PS2] C:\WINDOWS\system32\ps2.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SBDrvDet] C:\Program Files\Creative\SB Drive Det\SBDrvDet.exe /r [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundService] rundll32.exe "C:\WINDOWS\efcaxu.dll",setvm [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeperUI.exe" /startintray [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tgcmd] C:\Program Files\Support.com\bin\tgcmd.exe /server /startmonitor /deaf [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\type32] "C:\Program Files\Microsoft IntelliType Pro\type32.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{946850c5-1e27-11d9-baf0-806d6172696f}] AutoRun\command- D:\setup.exe -- End of Deckard's System Scanner: finished at 2007-11-06 05:57:41 ------------

« Next Oldest · Virus, Spyware and Trojan Removal · Next Newest »

2 Pages

1 2 >

1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)

0 Members:

Topic Title	Replies / Views	Topic Information
Virus, Spyware and Trojan Removal Need help with getting rid of trojan horses![RESOLVED] 123» 10	138 / 13,987	21st April 2005 - 09:15 PM Kristy started - last by admin
Virus, Spyware and Trojan Removal Need Help with Malware Removal [RESOLVED] 123	30 / 3,677	19th June 2006 - 04:57 PM Markus D started - last by RiP
Virus, Spyware and Trojan Removal Need help removing Troj/Virtum-Gen virus [RESOLVED]	12 / 1,592	9th December 2008 - 05:05 PM klay44 started - last by Essexboy
Virus, Spyware and Trojan Removal Need help removing Troj/Virtum-Gen Virus [RESOLVED]	3 / 406	9th December 2008 - 10:38 PM bwelty started - last by fenzodahl512