Trojan and Worm infections [CLOSED]

Welcome! Register for a free account (or login). Geeks to Go offers free, quality tech support -- in terms anyone can understand. How does it work? �
Quickly register. Takes only a minute, and it's free. Start a new topic. Ask your question. Wait for an email reply. Infected? View malware cleaning guide �

> Geeks to Go! » Security » Virus, Spyware and Trojan Removal

Trojan and Worm infections [CLOSED], BackDoor.Generic4.TWL, Worm/Delf.ATB, p2pnetworking.exe

Options

sandihudson View Member Profile	Aug 30 2007, 12:54 AM Post #1
New Member Posts: 3 OS: xp pro	First....thank you for any assistance you can offer. The work that volunteers like you are doing is very much appreciated! Yesterday I noticed that my computer was strained to the limit with just minimal tasks. Unable to open Task Manager or even a command prompt to see what might be using the resources, I rebooted. That's when the real trouble started. The computer just ran at max until I had to hold down the power button to turn it off. Finally able to force open the Task Manager, I saw the p2pnetworking.exe which didn't look familiar, researched it, and found out it's bad news. After using AVG in an attempt to remove it, I found that my PC was infected with BackDoor.Generic4.TWL, Worm/Delf.ATB, although the p2pnetworking.exe did not show up in the list of infected items or the log file. I found registry keys for it in the registry and removed them but it's back with every reboot. Obviously I'm missing some parts of it somewhere. Killbox finally was able to get rid of it just long enough that I was able to (very slowly) take further steps. I've carefully followed your instructions about the required things to do: ATF Cleaner - left all boxes checked and deleted everything it discovered. System Restore - Created a new restore point and deleted all others. AVG Anti-Spyware - Used the settings outlined and followed the steps to scan exactly. A few items were found and quarantined as directed. However, under Reports it states there no reports available. SuperAntiSpyware - Ran this scan and posted the log below. PandaScan - Attempted numerous times to run this scan but it kept stopping with errors. AVG - I already had this installed on my computer so this was the first thing I tried....can also post the entire log if requested. Only the BackDoor.Generic4.TWL, Worm/Delf.ATB, p2pnetworking.exe were found, though in multiple instances. Windows Update - My computer shipped with SP2 on it so just ran the updates. HijackThis - See log below. After each of these steps I noticed a slight improvement to the computer's performance. Now on reboot it takes about 15 minutes for the computer to stop straining incessantly (this really is an improvement!) but when I attempt to open any program, even a browser window, it starts overworking again and the task takes several minutes. Again, any suggestions or help you can offer is very gratefully appreciated. I'd offer you my firstborn but he's 30 HijackThis Log Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 11:00:54 PM, on 8/29/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\explorer.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\WINDOWS\system32\cisvc.exe C:\Program Files\Windows Defender\MSASCui.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe C:\Program Files\hp\HP Software Update\HPWuSchd.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe C:\WINDOWS\System32\svchost.exe C:\PROGRA~1\Grisoft\AVG7\avgcc.exe C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\PROGRA~1\TRENDM~1\INTERN~2\PcScnSrv.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\Program Files\Trend Micro\Internet Security 2007\tsc.exe C:\WINDOWS\system32\cidaemon.exe C:\Program Files\Java\jre1.5.0_06\bin\jucheck.exe C:\Program Files\Internet Explorer\iexplore.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hudsonbusiness.net/ R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.roboform.net/dist/AiRoboForm.exe F2 - REG:system.ini: Shell=explorer.exe O2 - BHO: (no name) - AutorunsDisabled - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2007\pccguide.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\hp\HP Software Update\HPWuSchd.exe" O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [Gadwin PrintScreen 3.5] C:\imaging\PrintScreen\PrintScreen.exe /nosplash O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O4 - Startup: AutorunsDisabled O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe O4 - Global Startup: AutorunsDisabled O8 - Extra context menu item: &2 Customize Menu - res://C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll/ComCustomIEMenu.html O8 - Extra context menu item: &7 Fill Forms - res://C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll/ComFillForms.html O8 - Extra context menu item: &8 Save Forms - res://C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll/ComSavePass.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: LimeShop Preferences - file://C:\Program Files\Lime_Shop\Sy700\Tp700\scri700a.htm O8 - Extra context menu item: Post To &Nucleus (RV Sisters) - http://rvsisters.com/talk/nucleus/bookmark...de&blogid=1 O9 - Extra button: (no name) - AutorunsDisabled - (no file) O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra 'Tools' menuitem: &7 Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra button: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra 'Tools' menuitem: &8 Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra button: RF toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra 'Tools' menuitem: &9 Robo Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll O15 - Trusted Zone: .stumbleupon.com O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file://C:\Program Files\Travelogue 360 - Rome\Images\stg_drm.ocx O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal...ivex/hcImpl.cab O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - http://www.linkedin.com/cab/LinkedInContactFinderControl.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1143337220171 O16 - DPF: {92CA8ACC-4E99-4A2A-93F1-B2C5CADC8613} (NMInstall Control) - http://a14.g.akamai.net/f/14/7141/1d/www.n...GAPANEL_USA.cab O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} - http://a19.g.akamai.net/7/19/7125/4058/ftp...oke/Coupons.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {9FC5238F-12C4-454F-B1B5-74599A21DE47} (Webshots Photo Uploader) - http://community.webshots.com/html/WSPhotoUploader.CAB O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file://C:\Program Files\Travelogue 360 - Rome\Images\armhelper.ocx O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/eng/check/qdiagh.cab?326 O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{0F5A33CB-7125-4ECF-8247-13A5D50517A4}: NameServer = 206.13.28.12,206.13.31.12 O17 - HKLM\System\CS1\Services\Tcpip\..\{0F5A33CB-7125-4ECF-8247-13A5D50517A4}: NameServer = 206.13.28.12,206.13.31.12 O17 - HKLM\System\CS2\Services\Tcpip\..\{0F5A33CB-7125-4ECF-8247-13A5D50517A4}: NameServer = 206.13.28.12,206.13.31.12 O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcCtlCom.exe O23 - Service: Trend Micro Protection Against Spyware (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\PcScnSrv.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\Tmntsrv.exe O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~2\tmproxy.exe -- End of file - 10586 bytes --------------------------------------- SuperAntiSpyware Log* SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 08/29/2007 at 06:42 PM Application Version : 3.9.1008 Core Rules Database Version : 3294 Trace Rules Database Version: 1305 Scan type : Complete Scan Total Scan Time : 08:01:07 Memory items scanned : 401 Memory threats detected : 0 Registry items scanned : 6563 Registry threats detected : 22 File items scanned : 262694 File threats detected : 10 Adware.IWinGames HKLM\Software\Classes\CLSID\{8CA5ED52-F3FB-4414-A105-2E3491156990} HKCR\CLSID\{8CA5ED52-F3FB-4414-A105-2E3491156990} HKCR\CLSID\{8CA5ED52-F3FB-4414-A105-2E3491156990} HKCR\CLSID\{8CA5ED52-F3FB-4414-A105-2E3491156990}\InprocServer32 HKCR\CLSID\{8CA5ED52-F3FB-4414-A105-2E3491156990}\InprocServer32#ThreadingModel HKCR\CLSID\{8CA5ED52-F3FB-4414-A105-2E3491156990}\ProgID HKCR\CLSID\{8CA5ED52-F3FB-4414-A105-2E3491156990}\Programmable HKCR\CLSID\{8CA5ED52-F3FB-4414-A105-2E3491156990}\VersionIndependentProgID C:\PROGRA~1\IWINGA~1\IWINGA~1.DLL C:\SYSTEM VOLUME INFORMATION\_RESTORE{4E4ECD0F-3EF2-446D-9329-2A24EB5506A6}\RP1123\A0083906.DLL Adware.Tracking Cookie C:\Documents and Settings\Sandi\Cookies\sandi@revsci[2].txt C:\Documents and Settings\Sandi\Cookies\sandi@atwola[1].txt C:\Documents and Settings\Sandi\Cookies\sandi@2o7[1].txt C:\Documents and Settings\Sandi\Cookies\sandi@brightcove.112.2o7[1].txt C:\Documents and Settings\Sandi\Cookies\sandi@questionmarket[1].txt C:\Documents and Settings\Sandi\Cookies\sandi@specificclick[2].txt Adware.MovieLand/MediaPipe HKLM\Software\MediaPipe HKLM\Software\MediaPipe\Prefs HKLM\Software\MediaPipe\Prefs#version HKLM\Software\MediaPipe\Prefs#AltPayments HKLM\Software\MediaPipe\Prefs#ProductFamily HKLM\Software\MediaPipe\Prefs#Country HKLM\Software\MediaPipe\Prefs#Provider HKLM\Software\MediaPipe\Prefs#TRAFFIC_COUNTRY HKLM\Software\MediaPipe\Prefs#TRAFFIC_PROGRAM HKLM\Software\MediaPipe\Prefs#TRAFFIC_SOURCE HKLM\Software\MediaPipe\Prefs#TRAFFIC_SUBSOURCE HKLM\Software\MediaPipe\Prefs#JOIN_FORM_ID HKLM\Software\MediaPipe\Prefs\altpayments HKLM\Software\MediaPipe\Prefs\altpayments#Provider Adware.IST/SideFind C:\PROGRAM FILES\MICROSOFT ANTISPYWARE\QUARANTINE92E4DB9-8805-42DF-858E-DC2D58\6BEE6B21-60F2-4207-AFAF-CDA6B2 Adware.Spyware Labs C:\PROGRAM FILES\MICROSOFT ANTISPYWARE\QUARANTINE\7D750A65-F96E-45F6-A192-3F1DA3\B3A4AF86-3FA1-49E5-A119-2E88C5 ----------------------------------------- This post has been edited by sandihudson: Aug 30 2007, 01:10 AM

Stamper19 View Member Profile	Aug 30 2007, 04:04 PM Post #2
Trusted Helper Posts: 1,991 OS: Windows XP	Hi sandihudson, Welcome to Geeks to Go! Sorry for the delay, but as you can see things are rather busy around here. My name is Stamper19 and I will be helping you with your Malware problem. During the course of our interactions please be sure to follow all instructions carefully, and ask questions if you are unsure of how to proceed at any point. ---------------------------------------------------------------- Please download Deckard's System Scanner (DSS) to your Desktop. Close all applications and windows. Double-click on DSS.exe to run it, and follow the prompts. The scan may take a minute. When the scan is complete, two text files will open - Main.txt and Extra.txt Extra Note: When running DSS, some firewalls may warn that sigcheck.exe is trying to access the internet - please ensure that you allow sigcheck.exe permission to do so. Also, it may happen that your Antivirus flags DSS as suspicious. Please allow the Deckard's System Scanner to run and don't let your Antivirus delete it. (In this case, it may be better to temporary disable your Antivirus) Post the main.txt and extra.txt from the C:\Deckard\System Scanner folder into your next reply. ---------------------------------------------------------------- Information to include in your next post: main.txt and extra.txt from DSS

Stamper19 View Member Profile	Aug 30 2007, 07:30 PM Post #4
Trusted Helper Posts: 1,991 OS: Windows XP	Hi sandihudson, We have quite a few things to deal with, so lets get to work You should print out, or save these instructions to a notepad file, as you will not be able to access this thread when in Safe Mode. ---------------------------------------------------------------- First things first: You have both AVG Antivirus and PC-chillin AntiVirus installed on your PC. Running two or more anti-virus programs in real time can cause conflicts resulting in less, not more, protection. This can also cause drastic system slow-downs, which is a symptom you describe. Unless you have, or can, configure one to work only "on-demand", you will need to choose your favorite and uninstall the other. If you keep PC-chillin then be sure to update it, as it is currently out of date. ---------------------------------------------------------------- Please submit the following files for analysis. Jotti File Submission: Please go to Jotti's malware scan Copy and paste the following file path into the "File to upload & scan"box on the top of the page: C:\WINDOWS\system32\Tunjsn.exe C:\WINDOWS\ptcore.exe C:\WINDOWS\system32\Wjmyhq.exe C:\Program Files\Lime_Shop\Limeshop0.exe Click on the submit button Please post the results in your next reply. Please note that if you are submitting more than one file they will have to be entered one at a time. ---------------------------------------------------------------- Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below. O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} - http://a19.g.akamai.net/7/19/7125/4058/ftp...oke/Coupons.cab Now close all windows other than HiJackThis, then click Fix Checked. Close HiJackThis. Reboot into safe mode. Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode. ---------------------------------------------------------------- Please go to Start > Control Panel > Add/Remove Programs and remove the following (if present): LimeWire <<Optional - see below LimeWire 4.8.1 <<Optional - see below Optionals: Although LimeWire is not malware itself, the files downloaded with it are often a major source of infection, and it is likely the source of your current ailments. Hence, I strongly advise that it be removed. The choice to do so is yours, but keeping it will greatly increase your likelihood of being infected again in the future. Please note any other programs that you dont recognize in that list in your next response ---------------------------------------------------------------- Using Windows Explorer (to get there right-click your Start button and go to "Explore"), please delete these FOLDERS (if present): C:\Program Files\LimeWire <<If removed in previous step Reboot into Normal Mode. ---------------------------------------------------------------- Please do an online scan with Kaspersky WebScanner Click on Kaspersky Online Scanner You will be promted to install an ActiveX component from Kaspersky, Click Yes. The program will launch and then begin downloading the latest definition files: Once the files have been downloaded click on NEXT Now click on Scan Settings In the scan settings make that the following are selected: Scan using the following Anti-Virus database: Extended (if available otherwise Standard) Scan Options: Scan Archives Scan Mail Bases Click OK Now under select a target to scan: Select My Computer This will program will start and scan your system. The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected. Now click on the Save as Text button: Save the file to your desktop. Copy and paste that information in your next post. ---------------------------------------------------------------- Information to include in your next post: Jotti File Scan reports (4) Kapersky Scan Log Fresh HiJack This Log

sandihudson View Member Profile	Aug 31 2007, 04:04 PM Post #5
New Member Posts: 3 OS: xp pro	Stamper19, Wow, you were right about plenty to do! Happy to oblige Here's the latest go-round of completed tasks.... Anitvirus Programs Uninstalled PC-Cillin since I don't think it ever worked anyway; it wouldn't let me open the control panel once I upgraded from an older version. AVG is now the only anti-virus going. ---------------------------- Jotti's Malware Scan A note here that may have affected this scan... When I visited this site it kept resetting a timer for 30 seconds as they were very busy. In the meantime I jumped ahead to the next tasks in line. Eventually the Jotti service freed up but then I couldn't find any of the files you listed. Could this be due to my uninstalling LimeWire and LimeShop? I apologize for not taking the tasks in order; I didn't realize it might make a difference. C:\WINDOWS\system32\Tunjsn.exe There was no file by this name, although there are files named Tunjsndk.xml, Tunjsnk1.xml, Tunjsnk2.xml, Tunjsnk.xml, Tunjsnu1.xml, Tunjsnu2.xml, Tunjsnu3.xml, and Tunjsnu.xml. C:\WINDOWS\ptcore.exe There was also no file by this name or anything similar. C:\WINDOWS\system32\Wjmyhq.exe There was also no file by this name or anything similar. C:\Program Files\Lime_Shop\Limeshop0.exe There is no Lime_Shop folder or anything similar. ------------------------------------- Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 10:03:33 PM, on 8/30/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Windows Defender\MsMpEng.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe C:\WINDOWS\explorer.exe C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe C:\WINDOWS\system32\cisvc.exe C:\Program Files\Windows Defender\MSASCui.exe C:\WINDOWS\System32\nvsvc32.exe C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe C:\Program Files\hp\HP Software Update\HPWuSchd.exe C:\Program Files\HP\hpcoretech\hpcmpmgr.exe C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe C:\WINDOWS\system32\cidaemon.exe C:\Program Files\Java\jre1.5.0_06\bin\jucheck.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hudsonbusiness.net/ R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.roboform.net/dist/AiRoboForm.exe F2 - REG:system.ini: Shell=explorer.exe O2 - BHO: (no name) - AutorunsDisabled - (no file) O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb09.exe O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\hp\HP Software Update\HPWuSchd.exe" O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" O4 - HKLM\..\Run: [DrvLsnr] C:\Program Files\Analog Devices\SoundMAX\DrvLsnr.exe O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized O4 - HKCU\..\Run: [Gadwin PrintScreen 3.5] C:\imaging\PrintScreen\PrintScreen.exe /nosplash O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user') O4 - Startup: AutorunsDisabled O4 - Startup: Webshots.lnk = C:\Program Files\Webshots\Launcher.exe O4 - Global Startup: AutorunsDisabled O8 - Extra context menu item: &2 Customize Menu - res://C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll/ComCustomIEMenu.html O8 - Extra context menu item: &7 Fill Forms - res://C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll/ComFillForms.html O8 - Extra context menu item: &8 Save Forms - res://C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll/ComSavePass.html O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O8 - Extra context menu item: LimeShop Preferences - file://C:\Program Files\Lime_Shop\Sy700\Tp700\scri700a.htm O8 - Extra context menu item: Post To &Nucleus (RV Sisters) - http://rvsisters.com/talk/nucleus/bookmark...de&blogid=1 O9 - Extra button: (no name) - AutorunsDisabled - (no file) O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra 'Tools' menuitem: &7 Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra button: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra 'Tools' menuitem: &8 Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra button: RF toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra 'Tools' menuitem: &9 Robo Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\RoboForm.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O12 - Plugin for .mpeg: C:\Program Files\Internet Explorer\PLUGINS\npqtplugin3.dll O15 - Trusted Zone: .stumbleupon.com O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file://C:\Program Files\Travelogue 360 - Rome\Images\stg_drm.ocx O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecal...ivex/hcImpl.cab O16 - DPF: {493ACF15-5CD9-4474-82A6-91670C3DD66E} (LinkedIn ContactFinderControl) - http://www.linkedin.com/cab/LinkedInContactFinderControl.cab O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdat...b?1143337220171 O16 - DPF: {92CA8ACC-4E99-4A2A-93F1-B2C5CADC8613} (NMInstall Control) - http://a14.g.akamai.net/f/14/7141/1d/www.n...GAPANEL_USA.cab O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} - http://a19.g.akamai.net/7/19/7125/4058/ftp...oke/Coupons.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab O16 - DPF: {9FC5238F-12C4-454F-B1B5-74599A21DE47} (Webshots Photo Uploader) - http://community.webshots.com/html/WSPhotoUploader.CAB O16 - DPF: {B49C4597-8721-4789-9250-315DFBD9F525} (IWinAmpActiveX Class) - http://cdn.digitalcity.com/radio/ampx/ampx2.6.1.11_en_dl.cab O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file://C:\Program Files\Travelogue 360 - Rome\Images\armhelper.ocx O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/aio/eng/check/qdiagh.cab?326 O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/controls/msnchat45.cab O17 - HKLM\System\CCS\Services\Tcpip\..\{0F5A33CB-7125-4ECF-8247-13A5D50517A4}: NameServer = 206.13.28.12,206.13.31.12 O17 - HKLM\System\CS1\Services\Tcpip\..\{0F5A33CB-7125-4ECF-8247-13A5D50517A4}: NameServer = 206.13.28.12,206.13.31.12 O17 - HKLM\System\CS2\Services\Tcpip\..\{0F5A33CB-7125-4ECF-8247-13A5D50517A4}: NameServer = 206.13.28.12,206.13.31.12 O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe O23 - Service: Trend Micro Personal Firewall (TmPfw) - Unknown owner - C:\PROGRA~1\TRENDM~1\INTERN~2\TmPfw.exe (file missing) -- End of file - 9617 bytes --------------------------------------- Rebooted in Safe Mode and uninstalled LimeWire and LimeShop. I'm not sure how long these programs have been on my computer or how they got there; I've never used either and they don't look familiar. Deleted the LimeWire folder as well. Rebooted to Normal mode. --------------------------------- Kaspersky Webscanner Log* See attached file. When I attempted to paste the report here, my reply wouldn't post. It was rather long A lot of these infections seem to be in backups for various customers and any of those files can be (and should be anyway) deleted. ------------------------------------ There you go Stamper19! Again, thanks for all your help and patience! This post has been edited by sandihudson: Aug 31 2007, 04:22 PM Attached File(s) kaspersky08312007.txt ( 143.48K ) Number of downloads: 35

Stamper19 View Member Profile	Aug 31 2007, 04:41 PM Post #6
Trusted Helper Posts: 1,991 OS: Windows XP	Hi sandihudson, Good work getting through all that Im not surprised that most of those upload files werent there, so no worries. Things look pretty good here actually. All of the Kapersky hits are in those backup files. I recommend you clear them out. I did notice that the one HiJack This entry we wanted to fix is still there. Bit odd as Ive never seen an entry of that type fail to go away when fixed, but lets try it again. ---------------------------------------------------------------- Please re-open HiJackThis and scan. Check the boxes next to all the entries listed below. O16 - DPF: {9522B3FB-7A2B-4646-8AF6-36E7F593073C} - http://a19.g.akamai.net/7/19/7125/4058/ftp...oke/Coupons.cab Now close all windows other than HiJackThis, then click Fix Checked. Close HiJackThis. ---------------------------------------------------------------- How are things running at this point? Also, please post a fresh HiJack This log.

Stamper19 View Member Profile	Sep 17 2007, 08:27 PM Post #7
Trusted Helper Posts: 1,991 OS: Windows XP	Due to lack of feedback, this topic has been closed. If you need this topic reopened, please contact a staff member. This applies only to the original topic starter. Everyone else please begin a New Topic.

« Next Oldest · Virus, Spyware and Trojan Removal · Next Newest »

1 User(s) are reading this topic (1 Guests and 0 Anonymous Users)

0 Members:

Topic Title	Replies / Views	Topic Information
Virus, Spyware and Trojan Removal WIll someone please help me delete Trojan and worm virsuses on my comp	1 / 420	18th February 2007 - 10:59 PM xjackiex started - last by OwNt
Virus, Spyware and Trojan Removal Keylogger, Trojan and probably more [CLOSED]	4 / 569	4th November 2007 - 11:50 AM VBianco started - last by greyknight17
Virus, Spyware and Trojan Removal need help removing winantiviruspro and other infections [CLOSED]	2 / 320	14th June 2008 - 06:33 PM pdsc started - last by Rorschach112
Virus, Spyware and Trojan Removal Trojan and Worm. SCtri.exe and c1234[1].exe [Solved] 1234	53 / 9,645	18th February 2009 - 12:30 PM lostris started - last by Thunderbird1988