Problem with trojans/malware, etc (winpop...winantispyware) [RESOLVED]

Need a geek? You've come to the right place! Geeks to Go offers free, quality technical support, in a non-technical way. Volunteers are waiting to help. Friendly, technology experts who have knowledge to share, and find reward in helping others. Feel free to browse the site as a guest. However, to reply to a topic, or start a new one, you'll need to register (also removes advertising). New here? Visit our Welcome Guide. Infected with a Virus, Spyware, or Trojan? Read our Malware and Spyware Cleaning Guide.

> Geeks to Go! » Security » Virus, Spyware and Trojan Removal

Problem with trojans/malware, etc (winpop...winantispyware) [RESOLVED]

Options

Mooka View Member Profile	Jul 25 2007, 11:13 PM Post #1
Member Posts: 12 OS: Windows XP	*Superantispyware freezes every time it gets to a certain file in it's scan. Hijack this log: Logfile of HijackThis v1.99.1 Scan saved at 9:52:50 PM, on 7/25/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\ehome\ehtray.exe C:\Program Files\Apoint\Apoint.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe C:\PROGRA~1\MUSICM~1\MUSICM~3\MMDiag.exe C:\WINDOWS\svhost.exe C:\WINDOWS\retadpu77.exe C:\WINDOWS\g4356cbvy63.exe C:\Program Files\Messenger\msmsgs.exe C:\PROGRA~1\COMMON~1\ASEMBL~1\winspool.exe C:\Program Files\?icrosoft.NET\c?rss.exe C:\Program Files\WinPop\winpop.exe C:\Program Files\Apoint\Apntex.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\Program Files\Digital Line Detect\DLG.exe C:\WINDOWS\eHome\ehRecvr.exe C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\eHome\ehmsas.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\rundll32.exe C:\Program Files\Hijackthis\HijackThis.exe O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe O4 - HKLM\..\Run: [bgxyeqjA] C:\WINDOWS\bgxyeqjA.exe O4 - HKLM\..\Run: [poolsv] "C:\WINDOWS\poolsv.exe" O4 - HKLM\..\Run: [svhost] "C:\WINDOWS\svhost.exe" O4 - HKLM\..\Run: [runner1] C:\WINDOWS\retadpu77.exe 61A847B5BBF72815358B2B27128065E9C084320161C4661227A755E9C2933154389A28452DA545E9 1894E754BE54C29159A7DA197C7734672DE3F516CAC59B6 O4 - HKLM\..\Run: [g4356cbvy63] C:\WINDOWS\g4356cbvy63 O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [Uaol] "C:\PROGRA~1\COMMON~1\ASEMBL~1\winspool.exe" -vt yazb O4 - HKCU\..\Run: [Ffddifh] "C:\Program Files\?icrosoft.NET\c?rss.exe" O4 - HKCU\..\Run: [WinPop] C:\Program Files\WinPop\winpop.exe O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Documents and Settings\Michael\Desktop\AIM95\aim.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\PROGRA~1\Yahoo!\MESSEN~1\YPager.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O20 - AppInit_DLLs: c:\windows\system32\ldcore.dll O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: Net Agent - Unknown owner - C:\WINDOWS\dls0523pmw.exe (file missing) O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

JSntgRvr View Member Profile	Jul 29 2007, 06:22 PM Post #2
Global Moderator Posts: 6,087 From: Puerto Rico OS: Windows XP, VISTA Home Premium	Hi, Mooka Welcome to Geeks to Go. Look in your control panel add/remove programs for the following: outerinfo AskTBar ClickSpring Cowabanga by OIN ipwindows / ipwins MediaTickets MediaTickets by OIN OIN Outer Info Network PurityScan PurityScan by OIN Snowball Wars by OIN TizzleTalk TizzleTalk by OIN Yazzle by OIN Yazzle ActiveX by OIN Yazzle Cowabanga by OIN Yazzle Kobe :filtered:! By OIN Yazzle Picster by OIN Yazzle Snowball Wars by OIN Yazzle Sudoku by OIN Zolero Translator If present, click on the entry and click remove. Download and run the Purityscan uninstaller from Here Download ComboFix from Here or Here. to your Desktop. Note: In the event you already have Combofix, this is a new version that I need you to download. Double click combofix.exe and follow the prompts. When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply Note: Do not mouseclick combofix's window while its running. That may cause it to stall

Mooka View Member Profile	Jul 30 2007, 01:33 AM Post #3
Member Posts: 12 OS: Windows XP	Hello JSntgRvr, thank you so much for your reply. I found OIN in the add/remove programs list and removed it. Computer seems to be running better right now; don't see any popups and it doesn't seem to be running slow. combofix log: ComboFix 07-07-30.2 - "Michael" 2007-07-30 0:08:56.1 [GMT -7:00] - NTFS Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.True * Created a new restore point (((((((((((((((((((((((((((((((((((((((((((( V Log ))))))))))))))))))))))))))))))))))))))))))))))))))))))) C:\WINDOWS\system32\cqtjswjn.dll C:\WINDOWS\system32\fhvyntxs.dll C:\WINDOWS\system32\jkkhhec.dll C:\WINDOWS\system32\qomljhi.dll C:\WINDOWS\system32\bmdagfar.exe C:\WINDOWS\system32\ptwrtuvw.exe C:\WINDOWS\system32\qomljhi.dll C:\WINDOWS\system32\ttutv.bak1 C:\WINDOWS\system32\ttutv.bak2 C:\WINDOWS\system32\ttutv.ini C:\WINDOWS\system32\sxtnyvhf.ini C:\WINDOWS\system32\vtutt.dll C:\WINDOWS\system32\hggghif.dll C:\WINDOWS\system32\hggghif.dll * * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\DOCUME~1\ALLUSE~1\APPLIC~1.\salesmonitor C:\DOCUME~1\Michael\APPLIC~1.\.rdr.ini C:\DOCUME~1\Michael\APPLIC~1.\macromedia\Flash Player\#SharedObjects\YQWWUKXB\www.broadcaster.com C:\DOCUME~1\Michael\APPLIC~1.\macromedia\Flash Player\#SharedObjects\YQWWUKXB\www.broadcaster.com\played_list.sol C:\DOCUME~1\Michael\APPLIC~1.\macromedia\Flash Player\#SharedObjects\YQWWUKXB\www.broadcaster.com\video_queue.sol C:\DOCUME~1\Michael\APPLIC~1.\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com C:\DOCUME~1\Michael\APPLIC~1.\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol C:\DOCUME~1\Michael\APPLIC~1\WinTouch\wintouch.cfg C:\DOCUME~1\Michael\APPLIC~1\WinTouch\WinTouch.exe C:\DOCUME~1\Michael\APPLIC~1\WinTouch\WTUninstaller.exe C:\DOCUME~1\Michael\MYDOCU~1.\dobe~1 C:\Documents and Settings\Michael.\err.log C:\Program Files\Common Files\asembl~1 C:\Program Files\Common Files\Yazzle1549OinAdmin.exe C:\Program Files\Common Files\Yazzle1549OinUninstaller.exe C:\Program Files\icroso~1.net C:\Program Files\inetget2 C:\Program Files\network monitor C:\Program Files\network monitor\netmon.exe C:\Program Files\poolsv C:\Program Files\poolsv\k11u72.exe C:\Program Files\poolsv\svhost.exe C:\Program Files\poolsv\wr-1-0000077.exe C:\Program Files\poolsv\YazzleBundle-1549.exe C:\Program Files\svhost C:\Program Files\svhost\wr-1-0000077.exe C:\Program Files\web buying C:\Program Files\web buying\v1.8.0\wbuninst.exe C:\Program Files\web buying\v1.8.0\webbuying.exe C:\Program Files\Windows NT\mevoxu4.dll C:\Program Files\Windows NT\mevoxu83122.dll C:\Program Files\winpop C:\Program Files\winpop\UnInstall.exe C:\Program Files\winpop\winpop.exe C:\tempb9 C:\tempb9\tmpTF.log C:\temp\tn3 C:\WINDOWS\b103.exe C:\WINDOWS\b104.exe C:\WINDOWS\b122.exe C:\WINDOWS\b128.exe C:\WINDOWS\b136.exe C:\WINDOWS\b138.exe C:\WINDOWS\cs_cache.ini C:\WINDOWS\poolsv.exe C:\WINDOWS\rau001978.exe C:\WINDOWS\retadpu1000106.exe C:\WINDOWS\retadpu77.exe C:\WINDOWS\svhost.exe C:\WINDOWS\system32\atmtd.dll C:\WINDOWS\system32\atmtd.dll._ C:\WINDOWS\system32\b06FdUe C:\WINDOWS\system32\b06FdUe\b06FdUe1083.exe C:\WINDOWS\system32\b10FdUe C:\WINDOWS\system32\b10FdUe\b10FdUe1099.exe C:\WINDOWS\system32\bwrnbkqp.exe C:\WINDOWS\system32\drivers\core.cache.dsk C:\WINDOWS\system32\drivers\core.sys C:\WINDOWS\system32\ldinfo.ldr C:\WINDOWS\system32\T1 C:\WINDOWS\system32\T1\kmhp83122.exe C:\WINDOWS\system32\T11 C:\WINDOWS\system32\T3 C:\WINDOWS\system32\T3\wr725.exe C:\WINDOWS\system32\T5 C:\WINDOWS\system32\T5\tns2.exe C:\WINDOWS\system32\T7 C:\WINDOWS\system32\T9 C:\WINDOWS\system32\tsuninst.exe C:\WINDOWS\system32\win C:\WINDOWS\TWljaGFlbA\asappsrv.dll C:\WINDOWS\TWljaGFlbA\command.exe C:\WINDOWS\uninst2.htm C:\WINDOWS\uninstall_nmon.vbs C:\WINDOWS\unist1.htm C:\WINDOWS\wr.txt ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\LEGACY_CMDSERVICE -------\LEGACY_CORE -------\LEGACY_NETWORK_MONITOR -------\LEGACY_NET_AGENT -------\LEGACY_WINDOWS_OVERLAY_COMPONENTS -------\cmdService -------\core -------\Net Agent -------\Network Monitor ((((((((((((((((((((((((( Files Created from 2007-06-28 to 2007-07-30 ))))))))))))))))))))))))))))))) 2007-07-30 00:08 126,016 --a------ C:\WINDOWS\system32\mgyqdgqs.dll 2007-07-30 00:06 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-29 23:57 <DIR> d-------- C:\WINDOWS\wuqq 2007-07-29 23:57 <DIR> d-------- C:\Program Files\Common Files\wuqq 2007-07-28 17:21 6,467 --ahs---- C:\WINDOWS\system32\bbadd.bak1 2007-07-28 14:01 6,466 --ahs---- C:\WINDOWS\system32\xycdd.bak1 2007-07-28 07:04 6,467 --ahs---- C:\WINDOWS\system32\jlnmp.bak1 2007-07-27 23:47 6,467 --ahs---- C:\WINDOWS\system32\kjjlm.bak1 2007-07-27 13:53 6,467 --ahs---- C:\WINDOWS\system32\ghkmp.bak1 2007-07-27 12:09 <DIR> d--hs---- C:\WINDOWS\TWljaGFlbA 2007-07-27 12:09 <DIR> d-------- C:\DOCUME~1\LOCALS~1\APPLIC~1\NetMon 2007-07-27 11:58 6,466 --ahs---- C:\WINDOWS\system32\rqstv.bak1 2007-07-27 10:33 6,467 --ahs---- C:\WINDOWS\system32\cbeeg.bak1 2007-07-26 23:08 6,467 --ahs---- C:\WINDOWS\system32\abeeg.bak1 2007-07-26 16:12 6,467 --ahs---- C:\WINDOWS\system32\rtvwa.bak1 2007-07-26 11:58 6,467 --ahs---- C:\WINDOWS\system32\gjkkj.bak1 2007-07-25 18:43 <DIR> d-------- C:\Program Files\SUPERAntiSpyware 2007-07-25 15:25 6,467 --ahs---- C:\WINDOWS\system32\ijllm.bak1 2007-07-25 12:11 6,507 --ahs---- C:\WINDOWS\system32\qqtss.bak1 2007-07-25 03:38 6,467 --ahs---- C:\WINDOWS\system32\bdeeg.bak1 2007-07-25 03:32 <DIR> d-------- C:\Temp\brr 2007-07-25 03:32 <DIR> d-------- C:\Tempc2 2007-07-21 18:26 <DIR> d-------- C:\Program Files\MSBuild 2007-07-21 18:21 <DIR> d-------- C:\WINDOWS\system32\XPSViewer 2007-07-21 18:20 <DIR> d-------- C:\Program Files\Reference Assemblies 2007-07-21 18:19 14,048 --a------ C:\WINDOWS\system32\spmsg2.dll 2007-07-06 12:40 192,512 --a------ C:\WINDOWS\g4356cbvy63.exe 2007-06-25 06:54 53,248 --a------ C:\WINDOWS\uni_eh44.exe 2007-06-25 06:53 53,248 --a------ C:\WINDOWS\uninst1014.exe (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-30 00:19 --------- d-------- C:\Program Files\Windows NT 2007-07-25 18:42 --------- d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-07-25 18:34 --------- d-------- C:\Program Files\GemMaster 2007-07-25 17:17 3610 --a------ C:\WINDOWS\system32\tmp.reg 2007-07-25 03:33 --------- d-------- C:\Program Files\Online Services 2007-07-19 11:44 56 -r-hs---- C:\WINDOWS\system32\82530E5B98.sys 2007-07-19 11:44 3766 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys 2007-05-29 20:31 1606725 --ahs---- C:\WINDOWS\system32\qstwa.ini2 2007-05-29 19:08 0 --a------ C:\WINDOWS\system32\CMMGR32.EXE 2007-05-29 19:08 --------- d-------- C:\Program Files\NetWaiting 2007-05-29 18:30 --------- d-------- C:\DOCUME~1\Michael\APPLIC~1\SUPERAntiSpyware.com 2007-05-29 15:36 1570816 --ahs---- C:\WINDOWS\system32\qstwa.bak1 2007-05-16 08:12 683520 --a------ C:\WINDOWS\system32\inetcomm.dll 2007-05-08 21:16 3082 --a------ C:\WINDOWS\mozver.dat 2006-05-26 17:19 38800 --a------ C:\DOCUME~1\Michael\APPLIC~1\GDIPFONTCACHEV1.DAT 2005-07-29 23:24:26 472 --sha-r C:\WINDOWS\TWljaGFlbA\nq53u3I5vE.vbs ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) Note empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Apoint"="C:\Program Files\Apoint\Apoint.exe" [2004-09-13 15:33] "SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 16:48] "IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 13:59] "DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 15:19] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 19:58] "ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 09:44] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 09:44] "MimBoot"="C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe" [2005-09-08 18:20] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 09:24] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-01-03 15:33:50] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 02:01:04] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-02-27 11:39 282624 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awtst] C:\WINDOWS\system32\awtst.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless] C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-09-07 15:08 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ljjhgge] ljjhgge.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winjjq32] winjjq32.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel Photo Downloader] C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla] C:\WINDOWS\system32\dla\tfswctrl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OE_OEM] "C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "tmproxy"=2 (0x2) "TmPfw"=2 (0x2) "Tmntsrv"=2 (0x2) "PcCtlCom"=2 (0x2) R1 APPDRV;APPDRV;C:\WINDOWS\system32\DRIVERS\APPDRV.SYS R1 SASDIFSV;SASDIFSV;\??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS R1 SASKUTIL;SASKUTIL;\??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys R1 sscdbhk5;sscdbhk5;C:\WINDOWS\system32\drivers\sscdbhk5.sys R1 ssrtln;ssrtln;C:\WINDOWS\system32\drivers\ssrtln.sys R2 ASCTRM;ASCTRM;C:\WINDOWS\system32\drivers\ASCTRM.sys R2 drvnddm;drvnddm;C:\WINDOWS\system32\drivers\drvnddm.sys R2 ehRecvr;Media Center Receiver Service;C:\WINDOWS\eHome\ehRecvr.exe R2 ehSched;Media Center Scheduler Service;C:\WINDOWS\eHome\ehSched.exe R2 McrdSvc;Media Center Extender Service;C:\WINDOWS\ehome\mcrdsvc.exe R2 s24trans;WLAN Transport;C:\WINDOWS\system32\DRIVERS\s24trans.sys R2 tfsnboio;tfsnboio;C:\WINDOWS\system32\dla\tfsnboio.sys R2 tfsncofs;tfsncofs;C:\WINDOWS\system32\dla\tfsncofs.sys R2 tfsndrct;tfsndrct;C:\WINDOWS\system32\dla\tfsndrct.sys R2 tfsndres;tfsndres;C:\WINDOWS\system32\dla\tfsndres.sys R2 tfsnifs;tfsnifs;C:\WINDOWS\system32\dla\tfsnifs.sys R2 tfsnopio;tfsnopio;C:\WINDOWS\system32\dla\tfsnopio.sys R2 tfsnpool;tfsnpool;C:\WINDOWS\system32\dla\tfsnpool.sys R2 tfsnudf;tfsnudf;C:\WINDOWS\system32\dla\tfsnudf.sys R2 tfsnudfa;tfsnudfa;C:\WINDOWS\system32\dla\tfsnudfa.sys R3 bcm4sbxp;Broadcom 440x 10/100 Integrated Controller XP Driver;C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys R3 HSFHWICH;HSFHWICH;C:\WINDOWS\system32\DRIVERS\HSFHWICH.sys R3 IWCA;Intel Wireless Connection Agent Miniport for Win XP;C:\WINDOWS\system32\DRIVERS\iwca.sys R3 sdbus;sdbus;C:\WINDOWS\system32\DRIVERS\sdbus.sys R3 w29n51;Intel® PRO/Wireless 2200BG Network Connection Driver for Windows XP;C:\WINDOWS\system32\DRIVERS\w29n51.sys S3 ApiMon;ApiMon;\??\C:\WINDOWS\system32\drivers\ApiMon.sys S3 E100B;Intel® PRO Adapter Driver;C:\WINDOWS\system32\DRIVERS\e100b325.sys S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0;C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe S3 idsvc;Windows CardSpace;"C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe" S3 MHN;MHN;C:\WINDOWS\System32\svchost.exe -k netsvcs S3 MHNDRV;MHN driver;C:\WINDOWS\system32\DRIVERS\mhndrv.sys S3 SASENUM;SASENUM;\??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS S3 wanatw;WAN Miniport (ATW);C:\WINDOWS\system32\DRIVERS\wanatw4.sys S4 agpCPQ;Compaq AGP Bus Filter;C:\WINDOWS\system32\DRIVERS\agpCPQ.sys S4 NetTcpPortSharing;Net.Tcp Port Sharing Service;"C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}] AutoRun\command- E:\setup.exe ************************************************************************ catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-30 00:25:31 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ Completion time: 2007-07-30 0:26:29 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-07-30 00:26 --- E O F --- Hijackthis log: Logfile of HijackThis v1.99.1 Scan saved at 12:27:24 AM, on 7/30/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Intel\Wireless\Bin\EvtEng.exe C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\wscntfy.exe C:\WINDOWS\system32\cmd.exe C:\Program Files\Apoint\Apoint.exe C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\Program Files\Apoint\Apntex.exe C:\PROGRA~1\MUSICM~1\MUSICM~3\MMDiag.exe C:\Program Files\Messenger\msmsgs.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\MUSICMATCH\Musicmatch Jukebox\mim.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\wuauclt.exe C:\WINDOWS\system32\notepad.exe C:\Program Files\Mozilla Firefox\firefox.exe C:\Program Files\Hijackthis\HijackThis.exe O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [MimBoot] C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office10\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Documents and Settings\Michael\Desktop\AIM95\aim.exe O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O20 - Winlogon Notify: awtst - C:\WINDOWS\system32\awtst.dll (file missing) O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll O20 - Winlogon Notify: IntelWireless - C:\Program Files\Intel\Wireless\Bin\LgNotify.dll O20 - Winlogon Notify: ljjhgge - ljjhgge.dll (file missing) O20 - Winlogon Notify: winjjq32 - winjjq32.dll (file missing) O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

JSntgRvr View Member Profile	Jul 30 2007, 02:46 PM Post #4
Global Moderator Posts: 6,087 From: Puerto Rico OS: Windows XP, VISTA Home Premium	Hi, Mooka Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below. O20 - Winlogon Notify: awtst - C:\WINDOWS\system32\awtst.dll (file missing) O20 - Winlogon Notify: ljjhgge - ljjhgge.dll (file missing) O20 - Winlogon Notify: winjjq32 - winjjq32.dll (file missing) Now close all windows and browsers, other than HiJackThis, then click Fix Checked. Close Hijackthis. Copy the entire contents of the Quote Box below to Notepad. Name the file as ComboFix-Do.txt Change the Save as Type to All Files and Save it on the desktop QUOTE File:: C:\WINDOWS\system32\mgyqdgqs.dll C:\WINDOWS\system32\bbadd.bak1 C:\WINDOWS\system32\xycdd.bak1 C:\WINDOWS\system32\jlnmp.bak1 C:\WINDOWS\system32\kjjlm.bak1 C:\WINDOWS\system32\ghkmp.bak1 C:\WINDOWS\system32\rqstv.bak1 C:\WINDOWS\system32\cbeeg.bak1 C:\WINDOWS\system32\abeeg.bak1 C:\WINDOWS\system32\rtvwa.bak1 C:\WINDOWS\system32\gjkkj.bak1 C:\WINDOWS\system32\ijllm.bak1 C:\WINDOWS\system32\qqtss.bak1 C:\WINDOWS\system32\bdeeg.bak1 C:\WINDOWS\uni_eh44.exe C:\WINDOWS\uninst1014.exe C:\WINDOWS\system32\82530E5B98.sys C:\WINDOWS\system32\qstwa.ini2 C:\WINDOWS\system32\qstwa.bak1 C:\WINDOWS\TWljaGFlbA\nq53u3I5vE.vbs Folder:: C:\WINDOWS\TWljaGFlbA C:\Temp\brr ADS:: Driver:: ApiMon Registry:: Once saved, refering to the picture above, drag ComboFix-Do.txt into ComboFix.exe, and post back the resulting report. How is the computer doing?

Mooka View Member Profile	Jul 30 2007, 03:49 PM Post #5
Member Posts: 12 OS: Windows XP	Hello JSntgRvr, Fixed the three in HiJackThis and ran ComboFix with the wordpad text. Computer is running great atm, havn't seen a single pop-up and no problems using the internet. Though, all my firefox bookmarks have disappeared. Will have to hunt them all down again! ComboFix log: ComboFix 07-07-30.2 - "Michael" 2007-07-30 14:09:55.2 [GMT -7:00] - NTFS Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.True Command switches used :: C:\Documents and Settings\Michael\Desktop\ComboFix-Do.txt * Created a new restore point ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) C:\Temp\brr C:\Temp\brr\tmpZTF.log C:\WINDOWS\system32\82530E5B98.sys C:\WINDOWS\system32\abeeg.bak1 C:\WINDOWS\system32\bbadd.bak1 C:\WINDOWS\system32\bdeeg.bak1 C:\WINDOWS\system32\cbeeg.bak1 C:\WINDOWS\system32\ghkmp.bak1 C:\WINDOWS\system32\gjkkj.bak1 C:\WINDOWS\system32\ijllm.bak1 C:\WINDOWS\system32\jlnmp.bak1 C:\WINDOWS\system32\kjjlm.bak1 C:\WINDOWS\system32\mgyqdgqs.dll C:\WINDOWS\system32\qqtss.bak1 C:\WINDOWS\system32\qstwa.bak1 C:\WINDOWS\system32\qstwa.ini2 C:\WINDOWS\system32\rqstv.bak1 C:\WINDOWS\system32\rtvwa.bak1 C:\WINDOWS\system32\xycdd.bak1 C:\WINDOWS\TWljaGFlbA C:\WINDOWS\TWljaGFlbA\nq53u3I5vE.vbs C:\WINDOWS\uni_eh44.exe C:\WINDOWS\uninst1014.exe ((((((((((((((((((((((((((((((((((((((( Drivers/Services ))))))))))))))))))))))))))))))))))))))))))))))))) -------\ApiMon ((((((((((((((((((((((((( Files Created from 2007-06-28 to 2007-07-30 ))))))))))))))))))))))))))))))) 2007-07-30 00:06 51,200 --a------ C:\WINDOWS\nircmd.exe 2007-07-29 23:57 <DIR> d-------- C:\WINDOWS\wuqq 2007-07-29 23:57 <DIR> d-------- C:\Program Files\Common Files\wuqq 2007-07-27 12:09 <DIR> d-------- C:\DOCUME~1\LOCALS~1\APPLIC~1\NetMon 2007-07-25 18:43 <DIR> d-------- C:\Program Files\SUPERAntiSpyware 2007-07-25 03:32 <DIR> d-------- C:\Tempc2 2007-07-21 18:26 <DIR> d-------- C:\Program Files\MSBuild 2007-07-21 18:21 <DIR> d-------- C:\WINDOWS\system32\XPSViewer 2007-07-21 18:20 <DIR> d-------- C:\Program Files\Reference Assemblies 2007-07-21 18:19 14,048 --a------ C:\WINDOWS\system32\spmsg2.dll 2007-07-06 12:40 192,512 --a------ C:\WINDOWS\g4356cbvy63.exe (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) 2007-07-30 00:19 --------- d-------- C:\Program Files\Windows NT 2007-07-25 18:42 --------- d-------- C:\Program Files\Common Files\Wise Installation Wizard 2007-07-25 18:34 --------- d-------- C:\Program Files\GemMaster 2007-07-25 17:17 3610 --a------ C:\WINDOWS\system32\tmp.reg 2007-07-25 03:33 --------- d-------- C:\Program Files\Online Services 2007-07-19 11:44 3766 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys 2007-05-29 19:08 0 --a------ C:\WINDOWS\system32\CMMGR32.EXE 2007-05-29 19:08 --------- d-------- C:\Program Files\NetWaiting 2007-05-29 18:30 --------- d-------- C:\DOCUME~1\Michael\APPLIC~1\SUPERAntiSpyware.com 2007-05-16 08:12 683520 --a------ C:\WINDOWS\system32\inetcomm.dll 2007-05-08 21:16 3082 --a------ C:\WINDOWS\mozver.dat 2006-05-26 17:19 38800 --a------ C:\DOCUME~1\Michael\APPLIC~1\GDIPFONTCACHEV1.DAT ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) Note empty entries & legit default entries are not shown [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Apoint"="C:\Program Files\Apoint\Apoint.exe" [2004-09-13 15:33] "SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 16:48] "IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2004-10-30 13:59] "DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-02-23 15:19] "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-10-25 19:58] "ISUSPM Startup"="C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 09:44] "ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 09:44] "MimBoot"="C:\PROGRA~1\MUSICM~1\MUSICM~3\mimboot.exe" [2005-09-08 18:20] [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 09:24] C:\Documents and Settings\All Users\Start Menu\Programs\Startup\ Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-01-03 15:33:50] Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 02:01:04] [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "InstallVisualStyle"=C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles "InstallTheme"=C:\WINDOWS\Resources\Themes\Royale.theme [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-02-27 11:39 282624 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless] C:\Program Files\Intel\Wireless\Bin\LgNotify.dll 2004-09-07 15:08 110592 C:\Program Files\Intel\Wireless\Bin\LgNotify.dll [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^America Online 9.0 Tray Icon.lnk] path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\America Online 9.0 Tray Icon.lnk backup=C:\WINDOWS\pss\America Online 9.0 Tray Icon.lnkCommon Startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel Photo Downloader] C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\dla] C:\WINDOWS\system32\dla\tfswctrl.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\OE_OEM] "C:\Program Files\Trend Micro\Internet Security 12\TMAS_OE\TMAS_OEMon.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 12\pccguide.exe" [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services] "tmproxy"=2 (0x2) "TmPfw"=2 (0x2) "Tmntsrv"=2 (0x2) "PcCtlCom"=2 (0x2) R1 APPDRV;APPDRV;C:\WINDOWS\system32\DRIVERS\APPDRV.SYS R1 SASDIFSV;SASDIFSV;\??\C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS R1 SASKUTIL;SASKUTIL;\??\C:\Program Files\SUPERAntiSpyware\SASKUTIL.sys R1 sscdbhk5;sscdbhk5;C:\WINDOWS\system32\drivers\sscdbhk5.sys R1 ssrtln;ssrtln;C:\WINDOWS\system32\drivers\ssrtln.sys R2 ASCTRM;ASCTRM;C:\WINDOWS\system32\drivers\ASCTRM.sys R2 drvnddm;drvnddm;C:\WINDOWS\system32\drivers\drvnddm.sys R2 ehRecvr;Media Center Receiver Service;C:\WINDOWS\eHome\ehRecvr.exe R2 ehSched;Media Center Scheduler Service;C:\WINDOWS\eHome\ehSched.exe R2 McrdSvc;Media Center Extender Service;C:\WINDOWS\ehome\mcrdsvc.exe R2 s24trans;WLAN Transport;C:\WINDOWS\system32\DRIVERS\s24trans.sys R2 tfsnboio;tfsnboio;C:\WINDOWS\system32\dla\tfsnboio.sys R2 tfsncofs;tfsncofs;C:\WINDOWS\system32\dla\tfsncofs.sys R2 tfsndrct;tfsndrct;C:\WINDOWS\system32\dla\tfsndrct.sys R2 tfsndres;tfsndres;C:\WINDOWS\system32\dla\tfsndres.sys R2 tfsnifs;tfsnifs;C:\WINDOWS\system32\dla\tfsnifs.sys R2 tfsnopio;tfsnopio;C:\WINDOWS\system32\dla\tfsnopio.sys R2 tfsnpool;tfsnpool;C:\WINDOWS\system32\dla\tfsnpool.sys R2 tfsnudf;tfsnudf;C:\WINDOWS\system32\dla\tfsnudf.sys R2 tfsnudfa;tfsnudfa;C:\WINDOWS\system32\dla\tfsnudfa.sys R3 bcm4sbxp;Broadcom 440x 10/100 Integrated Controller XP Driver;C:\WINDOWS\system32\DRIVERS\bcm4sbxp.sys R3 HSFHWICH;HSFHWICH;C:\WINDOWS\system32\DRIVERS\HSFHWICH.sys R3 IWCA;Intel Wireless Connection Agent Miniport for Win XP;C:\WINDOWS\system32\DRIVERS\iwca.sys R3 sdbus;sdbus;C:\WINDOWS\system32\DRIVERS\sdbus.sys R3 w29n51;Intel® PRO/Wireless 2200BG Network Connection Driver for Windows XP;C:\WINDOWS\system32\DRIVERS\w29n51.sys S3 E100B;Intel® PRO Adapter Driver;C:\WINDOWS\system32\DRIVERS\e100b325.sys S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0;C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe S3 idsvc;Windows CardSpace;"C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe" S3 MHN;MHN;C:\WINDOWS\System32\svchost.exe -k netsvcs S3 MHNDRV;MHN driver;C:\WINDOWS\system32\DRIVERS\mhndrv.sys S3 SASENUM;SASENUM;\??\C:\Program Files\SUPERAntiSpyware\SASENUM.SYS S3 wanatw;WAN Miniport (ATW);C:\WINDOWS\system32\DRIVERS\wanatw4.sys S4 agpCPQ;Compaq AGP Bus Filter;C:\WINDOWS\system32\DRIVERS\agpCPQ.sys S4 NetTcpPortSharing;Net.Tcp Port Sharing Service;"C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe" [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}] AutoRun\command- E:\setup.exe ************************************************************************ catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2007-07-30 14:13:36 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden registry entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************ Completion time: 2007-07-30 14:15:13 - machine was rebooted C:\ComboFix-quarantined-files.txt ... 2007-07-30 14:14 C:\ComboFix2.txt ... 2007-07-30 00:26 --- E O F ---

JSntgRvr View Member Profile	Jul 30 2007, 05:33 PM Post #6
Global Moderator Posts: 6,087 From: Puerto Rico OS: Windows XP, VISTA Home Premium	Hi, Mooka Congratulations. Since the tools we used to scan the computer, as well as tools to delete files and folders, are no longer needed, they should be removed, as well as the folders created by these tools. Reset and Re-enable your System Restore to remove bad files that have been backed up by Windows. The files in System Restore are protected to prevent any programmes changing them. This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected.) To reset your restore points, please note that you will need to log into your computer with an account which has full administrator access. You will know if the account has administrator access because you will be able to see the System Restore tab. If the tab is missing, you are logged in under a limited account. (Windows XP) 1. Turn off System Restore. On the Desktop, right-click My Computer. Click Properties. Click the System Restore tab. Check Turn off System Restore. Click Apply, and then click OK. 2. Reboot. 3. Turn ON System Restore. On the Desktop, right-click My Computer. Click Properties. Click the System Restore tab. UN-Check Turn off System Restore. Click Apply, and then click OK.. Create a Restore point: Click Start, point to All Programs, point to Accessories, point to System Tools, and then click System Restore. In the System Restore dialog box, click Create a restore point, and then click Next. Type a description for your restore point, such as "After Cleanup", then click Create. The following is a list of tools and utilities that I like to suggest to people. This list is full of great tools and utilities to help you understand how you got infected and how to keep from getting infected again. Spybot Search & Destroy - Uber powerful tool which can search and annhilate nasties that make it onto your system. Now with an Immunize section that will help prevent future infections. AdAware - Another very powerful tool which searches and kills nasties that infect your system. AdAware and Spybot Search & Destroy compliment each other very well. SpywareBlaster - Great prevention tool to keep nasties from installing on your system. IE-SpyAd - puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all. CleanUP! - Cleans temporary files from IE and Windows, empties the recycle bin and more. Great tool to help speed up your computer and knock out those nasties that like to reside in the temp folders. Windows Updates - It is very important to make sure that both Internet Explorer and Windows are kept current with the latest critical security patches from Microsoft. To do this just start Internet Explorer and select Tools > Windows Update, and follow the online instructions from there. Google Toolbar - Free google toolbar that allows you to use the powerful Google search engine from the bar, but also blocks pop up windows. Trillian or Miranda-IM - These are Malware free Instant Messenger programs which allow you to connect to multiple IM services in one program! (AOL, Yahoo, ICQ, IRC, MSN) Antivirus programs play an important role in the protection of your system. Here are some options: Free Protection: AVG FREE AVIRA AVAST Activevirusshield Shareware: Node32 Reccomendation: -> Node32 To find out more information about how you got infected in the first place and some great guidelines to follow to prevent future infections you can read this article by Tony Klein. Best wishes!

Mooka View Member Profile	Jul 30 2007, 06:53 PM Post #7
Member Posts: 12 OS: Windows XP	Done and done. Thank you so much for your time and help. Computer is running great.

JSntgRvr View Member Profile	Jul 31 2007, 08:14 AM Post #8
Global Moderator Posts: 6,087 From: Puerto Rico OS: Windows XP, VISTA Home Premium	Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

JSntgRvr View Member Profile	Jul 31 2007, 08:14 AM Post #9
Global Moderator Posts: 6,087 From: Puerto Rico OS: Windows XP, VISTA Home Premium	Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread. Everyone else please begin a New Topic.

« Next Oldest · Virus, Spyware and Trojan Removal · Next Newest »

1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)

0 Members:

Topic Title	Replies / Views	Topic Information
Virus, Spyware and Trojan Removal Issues With Spyware/Malware/Etc..[RESOLVED] 123	33 / 6,658	22nd January 2008 - 04:05 PM BTMark started - last by andrewuk
Virus, Spyware and Trojan Removal Computer infected, popups, trojans, malware, etc [CLOSED]	2 / 1,190	26th February 2008 - 02:06 PM pystryker started - last by greyknight17
Virus, Spyware and Trojan Removal Problem with AVG deleted infected system files [RESOLVED] 123	34 / 1,730	20th May 2008 - 01:15 AM dtakehana started - last by Tal
Virus, Spyware and Trojan Removal Problem with Vundo and Trojan-Downloader.Delf [RESOLVED]	9 / 618	14th July 2008 - 04:28 PM NegativeZero started - last by Rorschach112