1) Ad-aware hangs up. I have uninstalled and reinstalled Ad-aware, then updated it, but it still hangs up during the search at one of the registry keys, and I have to alt/ctrl/del to stop the program.
2) Spybot Search and Destroy hangs up. I have uninstalled and reinstalled Spybot, then updated it, but it still hangs up during the search.
3) Internet explorer acts wierd: upon completing a google or yahoo search, each time I select one of the pages identified by a Yahoo or Google search, I am directed to a completely different URL. I can "go back" and click the link again, only to be taken to yet another URL; and finally when I "go back" and click on the desired link the THIRD time, I finally successfully reach that URL.
Steps I have taken:
1) CWShredder finds no spyware/adware
2) as mentioned above, Ad-aware and Spybot S&D won't fully scan
3) AVG was run and the notable findings in the test report were:
C:\System Volume Information\_restore{29FD9B63-4F58-4DB0-B2C4-8709D5244F27}\RP29\A0002401.exe was deleted as it contained a trojan horse generic.lzz
C:\WINDOWS\system32\dgprpsetup.exe was deleted because it contained trojan horse Downloader.Agent.SH
4) Trojan Hunter found no trojan horses during a full system scan.
5) Ewido was updated and run, but appears to have some problem during cleaning (Ewido log is posted at the bottom)
Thanks very much for your help:
Ken
Here is my Hijack this log (By the way, I really don't remember ever installing ipod software on this computer...)
Logfile of HijackThis v1.99.1
Scan saved at 10:03:11 PM, on 1/3/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\System32\ibmpmsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\S24EvMon.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\Program Files\ewido anti-malware\ewidoguard.exe
C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
C:\WINDOWS\System32\QCONSVC.EXE
C:\WINDOWS\System32\RegSrvc.exe
C:\WINDOWS\system32\TpKmpSVC.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\tp4serv.exe
C:\WINDOWS\System32\hkcmd.exe
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\IBMTOOLS\UTILS\ibmprc.exe
C:\WINDOWS\system32\RunDll32.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\DIGStream\digstream.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Hijack this\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = sas.ne2.attbb.net:8000
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.ne2.attbb.net
O4 - HKLM\..\Run: [TrackPointSrv] tp4serv.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe irprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [TPKMAPHELPER] C:\Program Files\ThinkPad\Utilities\TpKmapAp.exe -helper
O4 - HKLM\..\Run: [TpShocks] TpShocks.exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [BMMLREF] C:\Program Files\ThinkPad\Utilities\BMMLREF.EXE
O4 - HKLM\..\Run: [BMMMONWND] rundll32.exe C:\PROGRA~1\ThinkPad\UTILIT~1\BatInfEx.dll,BMMAutonomicMonitor
O4 - HKLM\..\Run: [TP4EX] tp4ex.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [UC_Start] C:\Program Files\IBM\Updater\\ucstartup.exe
O4 - HKLM\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\\ibmmessages.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [IBMPRC] C:\IBMTOOLS\UTILS\ibmprc.exe
O4 - HKLM\..\Run: [BMMGAG] RunDll32 C:\PROGRA~1\ThinkPad\UTILIT~1\pwrmonit.dll,StartPwrMonitor
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [DIGStream] C:\Program Files\DIGStream\digstream.exe
O4 - HKCU\..\Run: [ibmmessages] C:\Program Files\IBM\Messages By IBM\ibmmessages.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 5.0\Distillr\AcroTray.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra 'Tools' menuitem: IBM Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll
O9 - Extra button: (no name) - {91663649-416A-42A5-8E54-B63C1ECA0548} - C:\Program Files\Surfapps.com\PopThis! Free Version\PopThis.dll (file missing)
O9 - Extra 'Tools' menuitem: PopThis! Options... - {91663649-416A-42A5-8E54-B63C1ECA0548} - C:\Program Files\Surfapps.com\PopThis! Free Version\PopThis.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [JAVA_IBM] Java (IBM)
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/download/ipixx.cab
O16 - DPF: {225781F3-B27C-4182-83F1-CBF79247D36B} (PHSVPNPortal.VPNPortalCtl) - http://phsweb31.mgh....HSVPNPortal.CAB
O16 - DPF: {2FAD241F-D04F-43A4-9356-BF78AEBEFAD2} (XMLtoRTF.XML) - http://ppd.partners.org/lmr/lmr.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.micros...b?1125753684218
O16 - DPF: {6F74F92E-8DD8-4DDE-8FB8-CBB882A68048} (Microsoft Office XP Professional Step by Step Interactive) - file://C:\Program Files\Microsoft Interactive Training\O10C\mitm0026.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoft...free/asinst.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{0C331D17-7180-415B-AF77-51260282A621}: NameServer = 85.255.116.137,85.255.112.199
O17 - HKLM\System\CCS\Services\Tcpip\..\{4E08780A-19C2-435F-87F6-BD0720ACE7D3}: NameServer = 85.255.116.137,85.255.112.199
O17 - HKLM\System\CCS\Services\Tcpip\..\{D4D72A14-E78B-43A1-9640-CA65B060853E}: NameServer = 85.255.116.137,85.255.112.199
O17 - HKLM\System\CS1\Services\Tcpip\..\{0C331D17-7180-415B-AF77-51260282A621}: NameServer = 85.255.116.137,85.255.112.199
O17 - HKLM\System\CS2\Services\Tcpip\..\{0C331D17-7180-415B-AF77-51260282A621}: NameServer = 85.255.116.137,85.255.112.199
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
O23 - Service: IBM Rapid Restore Ultra Service - Unknown owner - C:\Program Files\IBM\IBM Rapid Restore Ultra\rrpcsb.exe
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINDOWS\System32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: IBM PSA Access Driver Control (PsaSrv) - Unknown owner - C:\WINDOWS\system32\PsaSrv.exe (file missing)
O23 - Service: QCONSVC - IBM Corp. - C:\WINDOWS\System32\QCONSVC.EXE
O23 - Service: RegSrvc - Intel Corporation - C:\WINDOWS\System32\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\WINDOWS\System32\S24EvMon.exe
O23 - Service: IBM KCU Service (TpKmpSVC) - Unknown owner - C:\WINDOWS\system32\TpKmpSVC.exe
Here is my Ewido log:
---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------
+ Created on: 3:59:23 PM, 12/31/2005
+ Report-Checksum: 44C6DDB0
+ Scan result:
[1052] VM_007C0000 -> Downloader.Agent.uj : Error during cleaning
[1076] VM_01310000 -> Downloader.Agent.uj : Error during cleaning
[1120] VM_009C0000 -> Downloader.Agent.uj : Error during cleaning
[1132] VM_00C80000 -> Downloader.Agent.uj : Error during cleaning
[1300] VM_00CC0000 -> Downloader.Agent.uj : Error during cleaning
[1368] VM_00D20000 -> Downloader.Agent.uj : Error during cleaning
[1412] VM_009A0000 -> Downloader.Agent.uj : Error during cleaning
[1556] VM_01BE0000 -> Downloader.Agent.uj : Error during cleaning
[1640] VM_00DB0000 -> Downloader.Agent.uj : Error during cleaning
[1740] VM_00740000 -> Downloader.Agent.uj : Error during cleaning
[1912] VM_00B80000 -> Downloader.Agent.uj : Error during cleaning
[360] VM_00C80000 -> Downloader.Agent.uj : Error during cleaning
[1480] VM_018F0000 -> Trojan.Pakes : Error during cleaning
[1780] VM_00C50000 -> Downloader.Agent.uj : Error during cleaning
[1808] VM_00860000 -> Downloader.Agent.uj : Error during cleaning
[1900] VM_00D70000 -> Downloader.Agent.uj : Error during cleaning
[2000] VM_00C00000 -> Downloader.Agent.uj : Error during cleaning
[300] VM_00890000 -> Downloader.Agent.uj : Error during cleaning
[448] VM_00AF0000 -> Downloader.Agent.uj : Error during cleaning
[644] VM_00CD0000 -> Downloader.Agent.uj : Error during cleaning
[704] VM_00AC0000 -> Downloader.Agent.uj : Error during cleaning
[756] VM_00E50000 -> Downloader.Agent.uj : Error during cleaning
[828] VM_00660000 -> Downloader.Agent.uj : Error during cleaning
[1356] VM_00E80000 -> Downloader.Agent.uj : Error during cleaning
[920] VM_00CB0000 -> Downloader.Agent.uj : Error during cleaning
[1004] VM_01180000 -> Downloader.Agent.uj : Error during cleaning
[1248] VM_00A90000 -> Downloader.Agent.uj : Error during cleaning
[1472] VM_009D0000 -> Downloader.Agent.uj : Error during cleaning
[1496] VM_00B30000 -> Downloader.Agent.uj : Error during cleaning
[1236] VM_00E80000 -> Downloader.Agent.uj : Error during cleaning
[1928] VM_00B00000 -> Downloader.Agent.uj : Error during cleaning
[1364] VM_017E0000 -> Downloader.Agent.uj : Error during cleaning
[192] VM_00A40000 -> Downloader.Agent.uj : Error during cleaning
[264] VM_00B00000 -> Downloader.Agent.uj : Error during cleaning
[464] VM_008C0000 -> Downloader.Agent.uj : Error during cleaning
[576] VM_00AE0000 -> Downloader.Agent.uj : Error during cleaning
[764] VM_00A70000 -> Downloader.Agent.uj : Error during cleaning
[680] VM_00FB0000 -> Downloader.Agent.uj : Error during cleaning
[1016] VM_019B0000 -> Downloader.Agent.uj : Error during cleaning
[2072] VM_009F0000 -> Downloader.Agent.uj : Error during cleaning
[2268] VM_01360000 -> Downloader.Agent.uj : Error during cleaning
[2440] VM_00AC0000 -> Downloader.Agent.uj : Error during cleaning
[2800] VM_007C0000 -> Downloader.Agent.uj : Error during cleaning
[1592] VM_009B0000 -> Downloader.Agent.uj : Error during cleaning
[404] VM_009B0000 -> Downloader.Agent.uj : Error during cleaning
[2828] VM_009E0000 -> Downloader.Agent.uj : Error during cleaning
[2644] VM_00A80000 -> Downloader.Agent.uj : Error during cleaning
[904] VM_00CC0000 -> Downloader.Agent.uj : Error during cleaning
[816] VM_00620000 -> Downloader.Agent.uj : Error during cleaning
::Report End
Edited by OwNt, 05 January 2006 - 01:58 AM.