Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

Infected with Spyware from China


  • Please log in to reply

#1
mambo123

mambo123

    New Member

  • Member
  • Pip
  • 1 posts
Hi,

I think I am infected with spyware from China. My system is very slow especially IE. Launching IE is very slow too. IE will hang or crash every now and then. Clicking on hyperlinks in my Outlook email will sometime crash IE too. Seems like the spyware have hijacked my IE. I have tried to uninstall OCNIS already. Please help me.

I have done the following:
1. ATF Cleaner
2. Spyware Terminator

Here's my Hijack log:

Logfile of HijackThis v1.99.1
Scan saved at 00:19, on 2007-06-17
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
C:\Program Files\Network Associates\VirusScan\Mcshield.exe
C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\conime.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Dell\QuickSet\quickset.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE
C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe
C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\Program Files\Qlock\qlock.exe
C:\WINDOWS\system32\taskmgr.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\Program Files\Hijackthis\HijackThis.exe

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {C74CDF30-68C2-49B4-9918-EBD66B8D9FBF} - C:\WINDOWS\system32\dnnvxznlgs.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\Network Associates\VirusScan\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [Network Associates Error Reporting Service] "C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1
O4 - Startup: qlock.lnk = C:\Program Files\Qlock\qlock.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Cisco Systems VPN Client.lnk = C:\Program Files\Cisco Systems\VPN Client\vpngui.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: ÉÏ´«µ½QQÍøÂçÓ²ÅÌ - D:\Programs\Tencent\QQ\AddToNetDisk.htm
O8 - Extra context menu item: Ìí¼Óµ½QQ×Ô¶¨ÒåÃæ°å - D:\Programs\Tencent\QQ\AddPanel.htm
O8 - Extra context menu item: Ìí¼Óµ½QQ±íÇé - D:\Programs\Tencent\QQ\AddEmotion.htm
O8 - Extra context menu item: ÓÃQQ²ÊÐÅ·¢Ë͸ÃͼƬ - D:\Programs\Tencent\QQ\SendMMS.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0CA54D3F-CEAE-48AF-9A2B-31909CB9515D} (Edit Class) - https://www.sz1.cmbc...oad/CMBEdit.cab
O16 - DPF: {1E0DFFCF-27FF-4574-849B-55007349FEDA} (iTrusPTA Class) - https://img.alipay.c...101/aliedit.cab
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - C:\Program Files\Cisco Systems\VPN Client\cvpnd.exe
O23 - Service: Intel® PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - Network Associates, Inc. - C:\Program Files\Network Associates\Common Framework\FrameworkService.exe
O23 - Service: Network Associates McShield (McShield) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\Mcshield.exe
O23 - Service: Network Associates Task Manager (McTaskManager) - Network Associates, Inc. - C:\Program Files\Network Associates\VirusScan\VsTskMgr.exe
O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\QuickSet\NICCONFIGSVC.exe
O23 - Service: Intel® PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)
O23 - Service: Intel® PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: VNC Server Version 4 (WinVNC4) - Unknown owner - C:\Program Files\RealVNC\VNC4\WinVNC4.exe" -service (file missing)
O23 - Service: Intel® PROSet/Wireless SSO Service (WLANKEEPER) - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

I tried running ComboFix as well. Here's the log:

ComboFix 07-06-13.3 - C:\Documents and Settings\j1007151\Desktop\ComboFix.exe
"j1007151" - 2007-06-17 0:22:09 - Service Pack 2 NTFS


((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\124.dll
C:\WINDOWS\178.dll
C:\WINDOWS\187.dll
C:\WINDOWS\19124.exe
C:\WINDOWS\227.dll
C:\WINDOWS\233.exe


((((((((((((((((((((((((( Files Created from 2007-05-16 to 2007-06-16 )))))))))))))))))))))))))))))))


2007-06-17 00:18 558,641 --a------ C:\WINDOWS\setup-264.exe
2007-06-17 00:18 49,152 --a------ C:\WINDOWS\setpwrcg.exe
2007-06-17 00:18 479,232 --a------ C:\WINDOWS\Setup1.exe
2007-06-17 00:18 0 --a------ C:\WINDOWS\resouese.dll
2007-06-16 22:15 28,408 --a------ C:\temp\ExchangePerflog_8484fa313524cdf2cfcccd43.dat
2007-06-16 21:53 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-06-07 13:46 <DIR> d-------- C:\Program Files\PSPad editor
2007-06-01 10:49 605,696 --a------ C:\WINDOWS\system32\CMBPBUninstall.exe
2007-06-01 10:49 466,944 --a------ C:\WINDOWS\system32\PBHttpComm.dll
2007-06-01 10:49 323,584 --a------ C:\WINDOWS\system32\Cmb_Pb_LiveUpdate.exe
2007-06-01 10:49 3,584 --a------ C:\WINDOWS\system32\drivers\CMBProtector.dat
2007-06-01 10:49 3,038 --a------ C:\WINDOWS\system32\drivers\CertClient.dat
2007-06-01 10:49 264,192 --a------ C:\WINDOWS\system32\midas.dll
2007-06-01 10:49 180,224 --a------ C:\WINDOWS\system32\PersonalBankPortal.exe
2007-06-01 10:49 100,008 --a------ C:\WINDOWS\system32\CmbSafeBase.dll
2007-06-01 10:49 <DIR> d-------- C:\DOCUME~1\j1007151\CMB
2007-06-01 10:29 43,280 --a------ C:\WINDOWS\system32\lmdimon.dll
2007-05-29 17:03 176,235 --a------ C:\WINDOWS\system32\Primomonnt.dll
2007-05-29 17:02 <DIR> d-------- C:\WINDOWS\PrimoPDF
2007-05-29 17:02 <DIR> d-------- C:\Program Files\activePDF
2007-05-28 15:31 <DIR> d-------- C:\WINDOWS\system32\aliedit
2007-05-25 09:09 4,733,788 --a------ C:\WINDOWS\system32\dmap_01200019124.exe
2007-05-23 09:18 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
2007-05-23 09:18 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
2007-05-23 09:18 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
2007-05-21 21:38 <DIR> d-------- C:\DOCUME~1\j1007151\APPLIC~1\CyberLink
2007-05-21 17:47 <DIR> d---s---- C:\temp\Temporary Internet Files
2007-05-21 16:29 579,584 --a------ C:\WINDOWS\system32\dnnvxznlgs.dll
2007-05-21 16:28 618,496 --a------ C:\WINDOWS\system32\Eraser.dll
2007-05-21 16:28 286,720 --a------ C:\WINDOWS\system32\erasext.dll
2007-05-21 16:28 241,664 --a------ C:\WINDOWS\system32\eraserl.exe
2007-05-21 16:28 <DIR> d-------- C:\Program Files\Eraser
2007-05-21 14:57 <DIR> d-------- C:\Program Files\Singapore Airlines PC Timetable
2007-05-21 12:41 <DIR> d-------- C:\Program Files\TENCENT
2007-05-21 10:44 <DIR> d-------- C:\Program Files\Infotriever


(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-16 14:06:35 -------- d-----w C:\Program Files\SWIFT
2007-05-28 11:47:11 -------- d-----w C:\Program Files\Online Services
2007-05-16 15:12:02 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-05-14 05:42:54 -------- d-----w C:\DOCUME~1\j1007151\APPLIC~1\AdobeUM
2007-05-11 09:49:41 -------- d-----w C:\Program Files\Common Files\Research In Motion
2007-05-11 04:01:22 -------- d-----w C:\DOCUME~1\j1007151\APPLIC~1\Research In Motion
2007-05-11 03:59:23 -------- d-----w C:\Program Files\Research In Motion
2007-05-11 02:57:18 -------- d-----w C:\DOCUME~1\j1007151\APPLIC~1\Sonic
2007-05-11 02:56:58 -------- d-----w C:\DOCUME~1\j1007151\APPLIC~1\Leadertech
2007-05-10 06:09:26 -------- d-----w C:\Program Files\WinPcap
2007-05-10 05:17:42 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2007-05-10 02:26:52 -------- d-----w C:\Program Files\Qlock
2007-05-09 08:07:08 364,544 ----a-w C:\WINDOWS\system32\CMBEdit.dll
2007-05-09 07:55:11 -------- d-----w C:\Program Files\Cisco Systems
2007-05-09 07:55:10 -------- d--h--w C:\Program Files\InstallShield Installation Information
2007-05-09 07:55:10 -------- d-----w C:\Program Files\Common Files\Deterministic Networks
2007-05-09 04:06:27 -------- d-----w C:\DOCUME~1\j1007151\APPLIC~1\QQ
2007-05-09 02:03:53 -------- d-----w C:\DOCUME~1\j1007151\APPLIC~1\QQUpdate
2007-05-08 03:20:46 -------- d-----w C:\Program Files\Update
2007-05-08 03:05:45 -------- d-----w C:\Program Files\Paragon Software
2007-05-07 10:23:19 1,156 ----a-w C:\WINDOWS\mozver.dat
2007-05-07 08:20:02 -------- d-----w C:\DOCUME~1\j1007151\APPLIC~1\WinRAR
2007-05-07 07:47:08 0 ----a-w C:\WINDOWS\nsreg.dat
2007-05-03 04:36:55 -------- d-----w C:\Program Files\MSXML 4.0
2007-05-03 04:33:43 38 ----a-w C:\AUTOEXEC.BAT
2007-05-02 06:10:38 -------- d-----w C:\Program Files\Microsoft ActiveSync
2007-05-02 06:08:54 -------- d-----w C:\Program Files\Microsoft.NET
2007-05-02 04:31:01 -------- d-----w C:\Program Files\Common Files\Cisco Systems
2007-05-02 04:31:00 -------- d-----w C:\Program Files\Network Associates
2007-05-02 04:30:31 -------- d-----w C:\Program Files\Common Files\Network Associates
2007-05-02 04:17:40 -------- d-----w C:\Program Files\Broadcom
2007-05-02 04:17:15 -------- d-----w C:\Program Files\Wave Systems Corp
2007-05-02 04:04:41 -------- d-----w C:\Program Files\RealVNC
2007-04-25 14:21:15 144,896 ----a-w C:\WINDOWS\system32\schannel.dll
2007-04-25 10:42:02 -------- d-----w C:\Program Files\Roxio
2007-04-25 10:42:02 -------- d-----w C:\Program Files\Common Files\SureThing Shared
2007-04-25 10:41:56 -------- d-----w C:\Program Files\Sonic
2007-04-25 10:41:56 -------- d-----w C:\Program Files\Common Files\InstallShield
2007-04-25 10:41:49 -------- d-----w C:\Program Files\Common Files\Sonic Shared
2007-04-25 10:41:06 -------- d-----w C:\Program Files\Digital Line Detect
2007-04-25 10:40:59 -------- d-----w C:\Program Files\Modem Helper
2007-04-25 10:40:51 -------- d-----w C:\Program Files\NetWaiting
2007-04-25 10:40:42 -------- d-----w C:\Program Files\Dell
2007-04-25 10:40:22 -------- d-----w C:\Program Files\CyberLink
2007-04-25 10:31:54 -------- d-----w C:\Program Files\CONEXANT
2007-04-25 10:31:43 -------- d-----w C:\Program Files\Sigmatel
2007-04-25 10:30:06 -------- d-----w C:\Program Files\Intel, Inc
2007-04-25 10:29:31 -------- d-----w C:\DOCUME~1\j1007151\APPLIC~1\Intel
2007-04-25 10:29:23 319,488 ----a-w C:\WINDOWS\system32\AegisI5Installer.exe
2007-04-25 10:29:23 21,425 ----a-w C:\WINDOWS\system32\drivers\AegisP.sys
2007-04-25 10:28:51 -------- d-----w C:\Program Files\Intel
2007-04-25 10:26:27 -------- d-----w C:\Program Files\Messenger
2007-04-25 10:04:30 -------- d-----w C:\Program Files\Apoint
2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-16 14:47:36 33,624 ----a-w C:\WINDOWS\system32\wups.dll
2007-04-16 14:45:54 1,710,936 ----a-w C:\WINDOWS\system32\wuaueng.dll
2007-04-16 14:45:48 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
2007-04-16 14:45:42 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
2007-04-16 14:45:36 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
2007-04-16 14:45:28 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
2007-04-16 14:45:20 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
2007-04-16 14:45:20 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
2007-03-30 01:47:20 499,712 ----a-r C:\WINDOWS\system32\msvcp71.dll
2007-03-30 01:47:20 348,160 ----a-r C:\WINDOWS\system32\msvcr71.dll
2007-03-30 01:47:20 1,060,864 ----a-r C:\WINDOWS\system32\MFC71.dll
2007-03-17 13:43:01 292,864 ----a-w C:\WINDOWS\system32\winsrv.dll


((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2005-09-23 20:12]
{5CA3D70E-1895-11CF-8E15-001234567890}=C:\WINDOWS\System32\DLA\DLASHX_W.DLL [2005-09-08 05:20]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll [2005-11-10 13:22]
{C74CDF30-68C2-49B4-9918-EBD66B8D9FBF}=C:\WINDOWS\system32\dnnvxznlgs.dll [2007-05-21 16:29]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2005-10-06 23:13]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe" [2005-11-10 13:03]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-10-18 18:04]
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-10-18 17:58]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 02:30 C:\WINDOWS\stsystra.exe]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-09 20:29]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2006-06-29 12:13]
"ISUSPM Startup"="C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" [2004-07-27 16:50]
"ISUSScheduler"="C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2004-07-27 16:50]
"ShStatEXE"="C:\Program Files\Network Associates\VirusScan\SHSTAT.exe" [2004-08-18 08:00]
"McAfeeUpdaterUI"="C:\Program Files\Network Associates\Common Framework\UpdaterUI.exe" [2004-08-06 03:50]
"Network Associates Error Reporting Service"="C:\Program Files\Common Files\Network Associates\TalkBack\TBMon.exe" [2003-10-07 09:48]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2005-08-18 10:49]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\0\0]
"Script"=ASPACWorkstationStartup.vbs

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-8915387-776344908-1874078741-61262\Scripts\Logon\0\0]
"Script"=trackit.vbs


**************************************************************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-17 00:23:15
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-06-17 0:23:39
C:\ComboFix-quarantined-files.txt ... 2007-06-17 00:23

--- E O F ---

I would appreciate any help.
  • 0

Advertisements







Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP