Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Vundo Infection But Not Sure


  • Please log in to reply

#16
newbiefollies

newbiefollies

    Member

  • Topic Starter
  • Member
  • PipPip
  • 23 posts
Dear steamwiz,
Thanks for all your help. Here are the mbam, dss main.txt & dss extra.txt reports.

Malwarebytes' Anti-Malware 1.11
Database version: 660

Scan type: Quick Scan
Objects scanned: 30957
Time elapsed: 8 minute(s), 1 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 6
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 2
Files Infected: 7

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\Typelib\{50ccd00a-66b6-4d95-aaef-8ee959498f92} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\MediaHoldings (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\PlayMP3 (Adware.PlayMP3Z) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\Software\FBrowsingAdvisor (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\fbrowsingadvisor_is1 (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\stfngdvw.1 (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Program Files\FBrowsingAdvisor (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Program Files\FBrowserAdvisor (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.

Files Infected:
C:\Program Files\Mozilla Firefox\regxpcom.exe (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Program Files\FBrowsingAdvisor\IXPCOMEvents.xpt (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Program Files\FBrowsingAdvisor\Logo.png (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Program Files\FBrowsingAdvisor\main.db (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Program Files\FBrowsingAdvisor\unins000.dat (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Program Files\FBrowsingAdvisor\unins000.exe (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.
C:\Program Files\FBrowsingAdvisor\XPCOMEvents.dll (Trojan.FBrowsingAdvisor) -> Quarantined and deleted successfully.

Deckard's System Scanner v20071014.68
Run by Arun on 2008-04-20 16:07:47
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- System Restore --------------------------------------------------------------

Successfully created a Deckard's System Scanner Restore Point.


-- Last 5 Restore Point(s) --
12: 2008-04-20 10:37:54 UTC - RP551 - Deckard's System Scanner Restore Point
11: 2008-04-20 07:28:38 UTC - RP550 - System Checkpoint
10: 2008-04-19 06:58:29 UTC - RP549 - System Checkpoint
9: 2008-04-18 06:00:14 UTC - RP548 - System Checkpoint
8: 2008-04-15 13:18:11 UTC - RP547 - Software Distribution Service 3.0


-- First Restore Point --
1: 2008-04-02 09:45:56 UTC - RP540 - finalpurge


Backed up registry hives.
Performed disk cleanup.

Total Physical Memory: 479 MiB (512 MiB recommended).


-- HijackThis (run as Arun.exe) ------------------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:09:19 PM, on 4/20/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\System32\igfxtray.exe
C:\WINDOWS\System32\hkcmd.exe
C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\HPQ\SHARED\HPQWMI.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Messenger\MSMSGS.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\SpyCatcher\Protector.exe
C:\Program Files\SpyCatcher\Scheduler daemon.exe
C:\Documents and Settings\Arun\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Arun.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.relianceb...band.co.in/home
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://ie.redirect.h...a...o&pf=laptop
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SpywareBlock Class - {0A87E45F-537A-40B4-B812-E2544C21A09F} - C:\Program Files\SpyCatcher\SCActiveBlock.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
O4 - HKLM\..\Run: [Cpqset] C:\Program Files\HPQ\Default Settings\cpqset.exe
O4 - HKLM\..\Run: [eabconfg.cpl] C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe /Start
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [OpwareSE2] "C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe"
O4 - HKLM\..\Run: [OPSE reminder] "C:\Program Files\ScanSoft\OmniPageSE2.0\EregEng\Ereg.exe" -r "C:\Program Files\ScanSoft\OmniPageSE2.0\EregEng\ereg.ini"
O4 - HKLM\..\Run: [YeppStudioAgent] C:\Program Files\Samsung\SamsungMediaStudio4.1\SamsungMediaStudioAgent.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SpyCatcher Reminder] C:\Program Files\SpyCatcher\SpyCatcher.exe reminder
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\MSMSGS.EXE" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Picasa Media Detector] C:\Program Files\Picasa2\PicasaMediaDetector.exe (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: Scheduler.lnk = C:\Program Files\SpyCatcher\Scheduler daemon.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: SpyCatcher Protector.lnk = C:\Program Files\SpyCatcher\Protector.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O20 - AppInit_DLLs: secuload.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: HP WMI Interface (hpqwmi) - Hewlett Packard Company - C:\Program Files\HPQ\SHARED\HPQWMI.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Tally License Server (NT) (Tally License Server) - Unknown owner - C:\Tally\tallylicserver.exe (file missing)

--
End of file - 8753 bytes

-- File Associations -----------------------------------------------------------

.js - JSFile - DefaultIcon - "C:\Program Files\Macromedia\Dreamweaver 8\dreamweaver.exe",2
.reg - regfile - shell\open\command - regedit.exe "%1" %*
.scr - scrfile - shell\open\command - "%1" %*


-- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

R1 eabfiltr - c:\windows\system32\drivers\eabfiltr.sys <Not Verified; Hewlett-Packard Company; Quick Launch Buttons>
R1 PCLEPCI - c:\windows\system32\drivers\pclepci.sys <Not Verified; Pinnacle Systems GmbH; PCLEPCI>
R3 SASENUM - c:\program files\superantispyware\sasenum.sys <Not Verified; SuperAdBlocker, Inc.; SuperAntiSpyware>

S3 eabusb - c:\windows\system32\drivers\eabusb.sys <Not Verified; Hewlett-Packard Company; Quick Launch Buttons>
S3 MEMSWEEP2 - c:\windows\system32\a8.tmp (file missing)


-- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

R2 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service>
R2 Bonjour Service - "c:\program files\bonjour\mdnsresponder.exe" <Not Verified; Apple Inc.; Bonjour>
R3 hpqwmi (HP WMI Interface) - c:\program files\hpq\shared\hpqwmi.exe <Not Verified; Hewlett Packard Company; hpqwmi Module>

S2 Tally License Server (Tally License Server (NT)) - c:\tally\tallylicserver.exe -s (file missing)


-- Device Manager: Disabled ----------------------------------------------------

No disabled devices found.


-- Scheduled Tasks -------------------------------------------------------------

2008-03-11 13:21:21 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job


-- Files created between 2008-03-20 and 2008-04-20 -----------------------------

2008-04-20 15:34:36 0 d-------- C:\Documents and Settings\Arun\Application Data\Malwarebytes
2008-04-20 15:34:07 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-04-20 15:34:07 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-04-16 12:12:14 0 d-------- C:\Program Files\Sophos
2008-04-15 17:26:21 0 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-04-15 17:26:06 0 d-------- C:\Program Files\SUPERAntiSpyware
2008-04-15 17:26:06 0 d-------- C:\Documents and Settings\Arun\Application Data\SUPERAntiSpyware.com
2008-04-15 17:25:16 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-04-15 13:37:49 0 d-------- C:\Program Files\Common Files\Java
2008-03-30 15:30:11 68096 --a------ C:\WINDOWS\system32\zip.exe
2008-03-30 15:30:11 98816 --a------ C:\WINDOWS\system32\sed.exe
2008-03-30 15:30:11 80412 --a------ C:\WINDOWS\system32\grep.exe
2008-03-30 15:30:11 73728 --a------ C:\WINDOWS\system32\fdsv.exe <Not Verified; Smallfrogs Studio; >
2008-03-30 12:56:18 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-03-30 12:56:17 0 d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-03-30 10:18:35 0 d-------- C:\Program Files\Trend Micro
2008-03-29 17:28:35 0 d-------- C:\Documents and Settings\Arun\Application Data\Grisoft
2008-03-29 17:27:33 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-03-22 15:00:19 0 d-------- C:\tally
2008-03-22 12:09:09 0 d-------- C:\Documents and Settings\Administrator\Application Data\Talkback
2008-03-22 12:08:47 0 d-------- C:\Documents and Settings\Administrator\Application Data\Mozilla
2008-03-22 12:06:58 0 d-------- C:\Documents and Settings\Administrator\Application Data\Tenebril
2008-03-22 10:06:01 0 d--h----- C:\Documents and Settings\Administrator\Templates
2008-03-22 10:06:01 0 dr------- C:\Documents and Settings\Administrator\Start Menu
2008-03-22 10:06:01 0 dr-h----- C:\Documents and Settings\Administrator\SendTo
2008-03-22 10:06:01 0 d--h----- C:\Documents and Settings\Administrator\Recent
2008-03-22 10:06:01 0 d--h----- C:\Documents and Settings\Administrator\PrintHood
2008-03-22 10:06:01 524288 --ah----- C:\Documents and Settings\Administrator\NTUSER.DAT
2008-03-22 10:06:01 0 d--h----- C:\Documents and Settings\Administrator\NetHood
2008-03-22 10:06:01 0 d-------- C:\Documents and Settings\Administrator\My Documents
2008-03-22 10:06:01 0 d--h----- C:\Documents and Settings\Administrator\Local Settings
2008-03-22 10:06:01 0 d-------- C:\Documents and Settings\Administrator\Favorites
2008-03-22 10:06:01 0 d-------- C:\Documents and Settings\Administrator\Desktop
2008-03-22 10:06:01 0 d--hs---- C:\Documents and Settings\Administrator\Cookies
2008-03-22 10:06:01 0 dr-h----- C:\Documents and Settings\Administrator\Application Data
2008-03-22 10:06:01 0 d---s---- C:\Documents and Settings\Administrator\Application Data\Microsoft


-- Find3M Report ---------------------------------------------------------------

2008-04-15 17:25:16 0 d-------- C:\Program Files\Common Files
2008-04-15 13:40:49 0 d-------- C:\Program Files\Java
2008-03-16 10:54:05 0 d-------- C:\Documents and Settings\Arun\Application Data\Tenebril
2008-03-16 10:46:28 0 d-------- C:\Program Files\SpyCatcher
2008-03-15 10:20:13 0 d-------- C:\Program Files\InternetProgram
2008-03-14 16:50:05 0 d-------- C:\Program Files\LimeWire
2008-03-11 13:25:23 0 d-------- C:\Program Files\iTunes
2008-03-11 13:25:10 0 d-------- C:\Program Files\iPod
2008-03-11 13:23:53 0 d-------- C:\Program Files\Bonjour
2008-03-11 13:23:35 0 d-------- C:\Program Files\QuickTime
2008-03-11 13:21:15 0 d-------- C:\Program Files\Apple Software Update
2008-03-11 13:20:34 0 d-------- C:\Program Files\Common Files\Apple
2008-03-05 17:38:40 0 d-------- C:\Documents and Settings\Arun\Application Data\Canon


-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [05/27/2004 05:45 AM]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [05/27/2004 05:45 AM]
"IgfxTray"="C:\WINDOWS\System32\igfxtray.exe" [10/30/2003 02:16 PM]
"HotKeysCmds"="C:\WINDOWS\System32\hkcmd.exe" [10/30/2003 02:03 PM]
"Cpqset"="C:\Program Files\HPQ\Default Settings\cpqset.exe" [04/30/2004 10:32 AM]
"eabconfg.cpl"="C:\Program Files\HPQ\Quick Launch Buttons\EabServr.exe" [04/30/2004 01:50 PM]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [08/19/2003 01:01 AM]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [03/30/2008 12:07 AM]
"OpwareSE2"="C:\Program Files\ScanSoft\OmniPageSE2.0\OpwareSE2.exe" [05/08/2003 11:00 AM]
"OPSE reminder"="C:\Program Files\ScanSoft\OmniPageSE2.0\EregEng\Ereg.exe" [07/07/2003 09:29 AM]
"YeppStudioAgent"="C:\Program Files\Samsung\SamsungMediaStudio4.1\SamsungMediaStudioAgent.exe" []
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [01/31/2008 11:13 PM]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [02/19/2008 01:10 PM]
"SpyCatcher Reminder"="C:\Program Files\SpyCatcher\SpyCatcher.exe" [10/16/2007 12:05 PM]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [06/11/2007 02:55 PM]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [02/22/2008 04:25 AM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RecordNow!"="" []
"MSMSGS"="C:\Program Files\Messenger\MSMSGS.exe" [10/13/2004 09:54 PM]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 01:26 PM]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [02/29/2008 04:03 PM]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"Picasa Media Detector"=C:\Program Files\Picasa2\PicasaMediaDetector.exe

C:\Documents and Settings\Arun\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [3/16/2005 7:16:50 PM]
Scheduler.lnk - C:\Program Files\SpyCatcher\Scheduler daemon.exe [3/16/2008 10:46:26 AM]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [9/23/2005 10:05:26 PM]
Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2/13/2001 1:01:04 AM]
SpyCatcher Protector.lnk - C:\Program Files\SpyCatcher\Protector.exe [3/16/2008 10:46:26 AM]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)
"HideLegacyLogonScripts"=0 (0x0)
"HideLogoffScripts"=0 (0x0)
"RunLogonScriptSync"=1 (0x1)
"RunStartupScriptSync"=1 (0x1)
"HideStartupScripts"=0 (0x0)

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"HideLegacyLogonScripts"=0 (0x0)
"HideLogoffScripts"=0 (0x0)
"RunLogonScriptSync"=1 (0x1)
"RunStartupScriptSync"=1 (0x1)
"HideStartupScripts"=0 (0x0)
"DisableRegistryTools"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [12/20/2006 12:55 PM 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 04/19/2007 12:41 PM 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=secuload.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"




-- End of Deckard's System Scanner: finished at 2008-04-20 16:11:07 ------------

Deckard's System Scanner v20071014.68
Extra logfile - please post this as an attachment with your post.
--------------------------------------------------------------------------------

-- System Information ----------------------------------------------------------

Microsoft Windows XP Home Edition (build 2600) SP 2.0
Architecture: X86; Language: English

CPU 0: Intel® Celeron® M processor 1400MHz
Percentage of Memory in Use: 71%
Physical Memory (total/avail): 478.42 MiB / 133.99 MiB
Pagefile Memory (total/avail): 1121.07 MiB / 655.1 MiB
Virtual Memory (total/avail): 2047.88 MiB / 1928.59 MiB

C: is Fixed (NTFS) - 19.53 GiB total, 10.68 GiB free.
D: is Fixed (NTFS) - 54.99 GiB total, 51.28 GiB free.
E: is CDROM (No Media)

\\.\PHYSICALDRIVE0 - ST980815A - 74.53 GiB - 2 partitions
\PARTITION0 (bootable) - Installable File System - 19.53 GiB - C:
\PARTITION1 - Extended w/Extended Int 13 - 54.99 GiB - D:



-- Security Center -------------------------------------------------------------

AUOptions is scheduled to auto-install.
Windows Internal Firewall is enabled.

AV: avast! antivirus 4.8.1169 [VPS 080419-0] v4.8.1169 (ALWIL Software)

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

[HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"="%windir%\\system32\\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\\StubInstaller.exe"="C:\\StubInstaller.exe:*:Enabled:LimeWire swarmed installer"
"C:\\Program Files\\LimeWire\\LimeWire.exe"="C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire"
"%windir%\\Network Diagnostic\\xpnetdiag.exe"="%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\\Program Files\\iTunes\\iTunes.exe"="C:\\Program Files\\iTunes\\iTunes.exe:*:Enabled:iTunes"
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"="C:\\Program Files\\Bonjour\\mDNSResponder.exe:*:Enabled:Bonjour"


-- Environment Variables -------------------------------------------------------

ALLUSERSPROFILE=C:\Documents and Settings\All Users
APPDATA=C:\Documents and Settings\Arun\Application Data
CLASSPATH=.;C:\Program Files\Java\jre1.5.0_03\lib\ext\QTJava.zip
CLIENTNAME=Console
CommonProgramFiles=C:\Program Files\Common Files
COMPUTERNAME=LAPTOP1
ComSpec=C:\WINDOWS\system32\cmd.exe
FP_NO_HOST_CHECK=NO
HOMEDRIVE=C:
HOMEPATH=\Documents and Settings\Arun
LOGONSERVER=\\LAPTOP1
NUMBER_OF_PROCESSORS=1
OS=Windows_NT
Path=C:\WINDOWS\system32;C:\WINDOWS;C:\WINDOWS\system32\wbem;C:\Program Files\Common Files\Adobe\AGL;C:\Program Files\QuickTime\QTSystem
PATHEXT=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
PROCESSOR_ARCHITECTURE=x86
PROCESSOR_IDENTIFIER=x86 Family 6 Model 9 Stepping 5, GenuineIntel
PROCESSOR_LEVEL=6
PROCESSOR_REVISION=0905
ProgramFiles=C:\Program Files
PROMPT=$P$G
QTJAVA=C:\Program Files\Java\jre1.5.0_03\lib\ext\QTJava.zip
SESSIONNAME=Console
SystemDrive=C:
SystemRoot=C:\WINDOWS
TEMP=C:\DOCUME~1\Arun\LOCALS~1\Temp
TMP=C:\DOCUME~1\Arun\LOCALS~1\Temp
USERDOMAIN=LAPTOP1
USERNAME=Arun
USERPROFILE=C:\Documents and Settings\Arun
windir=C:\WINDOWS


-- User Profiles ---------------------------------------------------------------

Arun (admin)
Administrator (new local, admin)


-- Add/Remove Programs ---------------------------------------------------------

--> C:\WINDOWS\System32\\MSIEXEC.EXE /I {09DA4F91-2A09-4232-AB8C-6BC740096DE3} REMOVE=UpdateMgrFeature
--> C:\WINDOWS\System32\\MSIEXEC.EXE /x {9541FED0-327F-4df0-8B96-EF57EF622F19}
--> rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Bridge 1.0 --> MsiExec.exe /I{B74D4E10-1033-0000-0000-000000000001}
Adobe Common File Installer --> MsiExec.exe /I{8EDBA74D-0686-4C99-BFDD-F894678E5B39}
Adobe Flash Player Plugin --> C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Help Center 1.0 --> MsiExec.exe /I{E9787678-1033-0000-8E67-000000000001}
Adobe Photoshop CS2 --> msiexec /I {236BB7C4-4419-42FD-0409-1E257A25E34D}
Adobe Reader 7.0.9 --> MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A70900000002}
Adobe Stock Photos 1.0 --> MsiExec.exe /I{786C5747-1033-0000-B58E-000000000001}
Apple Mobile Device Support --> MsiExec.exe /I{44734179-8A79-4DEE-BB08-73037F065543}
Apple Software Update --> MsiExec.exe /I{B74F042E-E1B9-4A5B-8D46-387BB172F0A4}
ArcSoft PhotoStudio 5.5 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{85309D89-7BE9-4094-BB17-24999C6118FC}\SETUP.EXE" -l0x9
avast! Antivirus --> C:\Program Files\Alwil Software\Avast4\aswRunDll.exe "C:\Program Files\Alwil Software\Avast4\Setup\setiface.dll",RunSetup
AVG Anti-Rootkit Free --> C:\Program Files\GRISOFT\AVG Anti-Rootkit Free\Uninstall.exe
AVG Anti-Spyware 7.5 --> C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Uninstall.exe
Bonjour --> MsiExec.exe /I{47BF1BD6-DCAC-468F-A0AD-E5DECC2211C3}
Broadcom 802.11 Driver --> C:\WINDOWS\system32\BCMWLU00.exe verbose /rootkey=Software\Broadcom\802.11\UninstallInfo
Canon Camera Support Core Library --> C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{B9B9863A-32FD-4133-ADB7-46244ED77694} /l1033
Canon Camera Window for ZoomBrowser EX --> C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{F37942A8-B21B-4C5A-A1D2-B676BF55EAE0}
Canon MovieEdit Task for ZoomBrowser EX --> C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{DE286975-ACF1-45B8-9EF7-34E162B2C817}
Canon MP Navigator 2.0 --> "C:\Program Files\Canon\MP Navigator 2.0\Maint.exe" /UninstallRemove C:\Program Files\Canon\MP Navigator 2.0\uninst.ini
Canon MP150 --> "C:\WINDOWS\system32\CanonMP Uninstaller Information\{CA9A3609-3ECC-4574-8824-A8161A71A603}\DelDrv.exe" /U:{CA9A3609-3ECC-4574-8824-A8161A71A603} /L0x0009
Canon PhotoRecord --> MsiExec.exe /X{BEF56F2D-56ED-4176-BF72-7B68D4A3B98D}
Canon RAW Image Task for ZoomBrowser EX --> C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{9518F764-C54D-47B2-9E73-154B21E79FD2}
Canon RemoteCapture Task for ZoomBrowser EX --> C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{2C164906-E68F-462A-9010-70DD022223EF}
Canon Utilities Easy-PhotoPrint --> C:\Program Files\Canon\Easy-PhotoPrint\uninst.exe uninst.ini
Canon Utilities PhotoStitch 3.1 --> C:\Program Files\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{EF4C7EB0-D71B-43A3-9552-8053DE4B0401}
Canon Utilities ZoomBrowser EX --> MsiExec.exe /X{C1D76D7A-F3BB-47EA-A746-5B1E2FFC1DF2}
ClinicGate Basic --> MsiExec.exe /I{E20E1B04-1465-4593-8DBA-71939BF05A5F}
Conexant AC-Link Audio --> CIAunwdm.exe
ContentSAFER for Wizmax -->
DIGM --> C:\DIGM\myUninst.exe
Easy-WebPrint --> C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Canon\Easy-WebPrint\Uninst.isu"
Google Earth --> MsiExec.exe /I{1E04F83B-2AB9-4301-9EF7-E86307F79C72}
HijackThis 2.0.2 --> "C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Intel® Extreme Graphics 2 Driver --> RUNDLL32.EXE C:\WINDOWS\System32\ialmrem.dll,UninstallW2KIGfx PCI\VEN_8086&DEV_3582
InternetProgram --> C:\Program Files\InternetProgram\uninstall.exe
InterVideo WinDVD --> "C:\Program Files\InstallShield Installation Information\{98E8A2EF-4EAE-43B8-A172-74842B764777}\setup.exe" REMOVEALL
iTunes --> MsiExec.exe /I{80FD852F-5AAC-4129-B931-06AAFFA43138}
Java™ 6 Update 5 --> MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
Kaspersky Online Scanner --> C:\WINDOWS\system32\Kaspersky Lab\Kaspersky Online Scanner\kavuninstall.exe
Lame ACM MP3 Codec --> "C:\WINDOWS\IFinst26.exe" -UC:\Program Files\Lame MP3 Codec\IFUA.inf
LimeWire 4.16.6 --> "C:\Program Files\LimeWire\uninstall.exe"
Macromedia Dreamweaver 8 --> MsiExec.exe /I{0837A661-FEC3-48B3-876C-91E7D32048A9}
Macromedia Extension Manager --> MsiExec.exe /I{5546CDB5-2CE2-498B-B059-5B3BF81FC41F}
Malwarebytes' Anti-Malware --> "C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft Office XP Professional with FrontPage --> MsiExec.exe /I{90280409-6000-11D3-8CFE-0050048383C9}
Mozilla Firefox (2.0.0.14) --> C:\Program Files\Mozilla Firefox\uninstall\helper.exe
OmniPage SE 2.0 --> MsiExec.exe /I{79D5997E-BF79-48BB-8B41-9BE59C15C2D7}
Picasa 2 --> "C:\Program Files\Picasa2\Uninstall.exe"
Pinnacle Hollywood FX for Studio --> C:\WINDOWS\unvise32.exe C:\Program Files\Pinnacle\Hollywood FX for Studio\5.5\uninstal.log
Quick Launch Buttons 5.00 A5 --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{CEB326EC-8F40-47B2-BA22-BB092565D66F}\setup.exe" -l0x9 -uninst
QuickTime --> MsiExec.exe /I{BFD96B89-B769-4CD6-B11E-E79FFD46F067}
REALTEK Gigabit and Fast Ethernet NIC Driver --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{94FB906A-CF42-4128-A509-D353026A607E}\Setup.exe" -l0x9 REMOVE
RecordNow! --> MsiExec.exe /I{9541FED0-327F-4DF0-8B96-EF57EF622F19}
SamsungMediaStudio --> RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{289CA3B4-9525-4B31-B58F-D76B2B52EA5A}\Setup.exe" -l0x9
SmartSound Quicktracks Plugin --> C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{4A7FDA4D-F4D7-4A49-934A-066D59A43C7E}
SoftV92 Data Fax Modem with SmartCP --> C:\Program Files\CONEXANT\CNXT_MODEM_PCI_VEN_8086&DEV_24C6&SUBSYS_3080103C\HXFSETUP.EXE -U -Ihpm30805.inf
Sonic Update Manager --> MsiExec.exe /I{09DA4F91-2A09-4232-AB8C-6BC740096DE3}
Sophos Anti-Rootkit 1.3.1 --> C:\Program Files\Sophos\Sophos Anti-Rootkit\helper.exe remove
SpyCatcher Express 2007 --> "C:\Program Files\SpyCatcher\unins000.exe"
SUPERAntiSpyware Professional --> MsiExec.exe /X{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}
Synaptics Pointing Device Driver --> rundll32.exe "C:\Program Files\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
Teton Viewer --> C:\WINDOWS\ISUNINST.EXE -f"C:\Program Files\Teton Data Systems\Teton Viewer\DeIsL1.isu" -c"C:\Program Files\Teton Data Systems\Teton Viewer\tdsun32.dll"
Textbook of Dermatology --> C:\WINDOWS\uninst.exe -f"C:\Program Files\Champion\DeIsL1.isu" -c"C:\Program Files\Champion\_ISREG32.DLL"
XviD MPEG-4 Video Codec --> "C:\Program Files\XviD\unins000.exe"


-- Application Event Log -------------------------------------------------------

Event Record #/Type5161 / Error
Event Submitted/Written: 04/20/2008 04:09:29 PM
Event ID/Source: 11 / crypt32
Event Description:
Failed extract of third-party root list from auto update cab at: <http://www.download....uthrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Event Record #/Type5160 / Error
Event Submitted/Written: 04/20/2008 04:09:29 PM
Event ID/Source: 11 / crypt32
Event Description:
Failed extract of third-party root list from auto update cab at: <http://www.download....uthrootstl.cab> with error: A required certificate is not within its validity period when verifying against the current system clock or the timestamp in the signed file.

Event Record #/Type5146 / Warning
Event Submitted/Written: 04/16/2008 05:38:54 PM
Event ID/Source: 1001 / MsiInstaller
Event Description:
Detection of product '{90280409-6000-11D3-8CFE-0050048383C9}', feature 'WORDFiles' failed during request for component '{8E46FEFA-D973-6294-B305-E968CEDFFCB9}'

Event Record #/Type5072 / Error
Event Submitted/Written: 03/22/2008 00:29:27 PM
Event ID/Source: 3 / crypt32
Event Description:
Failed auto update retrieval of third-party root list cab from: <http://www.download....uthrootstl.cab> with error: This network connection does not exist.

Event Record #/Type5070 / Error
Event Submitted/Written: 03/22/2008 00:29:27 PM
Event ID/Source: 3 / crypt32
Event Description:
Failed auto update retrieval of third-party root list cab from: <http://www.download....uthrootstl.cab> with error: This network connection does not exist.



-- Security Event Log ----------------------------------------------------------

No Errors/Warnings found.


-- System Event Log ------------------------------------------------------------

Event Record #/Type30265 / Error
Event Submitted/Written: 04/20/2008 10:01:44 AM
Event ID/Source: 16 / Windows Update Agent
Event Description:
Unable to Connect: Windows is unable to connect to the automatic updates service and therefore cannot download and install updates according to the set schedule. Windows will continue to try to establish a connection.

Event Record #/Type30238 / Error
Event Submitted/Written: 04/20/2008 09:55:13 AM
Event ID/Source: 7000 / Service Control Manager
Event Description:
The Tally License Server (NT) service failed to start due to the following error:
%%2

Event Record #/Type30192 / Error
Event Submitted/Written: 04/19/2008 09:46:58 AM
Event ID/Source: 7023 / Service Control Manager
Event Description:
The Windows Firewall/Internet Connection Sharing (ICS) service terminated with the following error:
%%6

Event Record #/Type30191 / Error
Event Submitted/Written: 04/19/2008 09:46:58 AM
Event ID/Source: 7000 / Service Control Manager
Event Description:
The Tally License Server (NT) service failed to start due to the following error:
%%2

Event Record #/Type30190 / Error
Event Submitted/Written: 04/19/2008 09:46:52 AM
Event ID/Source: 21 / W32Time
Event Description:
The time service is configured to use one or more input
providers, however, none of the input providers are available.
The time service has no source of accurate time.



-- End of Deckard's System Scanner: finished at 2008-04-20 16:11:07 ------------
  • 0

Advertisements


#17
steamwiz

steamwiz

    Malware Expert

  • Retired Staff
  • 68 posts
  • MVP
Hi

I don't believe you have a problem with those files ...

Were you working on Word document files when when you found them ?

They are temp files created when you open a document to work on it, you wont see them normally unless you have "hidden files" set to show ... when you open a document file & start making changes to it, the changes are made to the temporarily created one, the original is not changed unless you "save the changes"

Those files are either opened files in use .. or shortcuts to them ...

For instance if I have a .doc file in a folder, called steamwiz.doc & I open the document to work on it, then a file will appear in the same folder called ~$eamwiz.doc ... when I close the original file, the one called ~$eamwiz.doc disappears ...


As for your new logs ... Malwarebytes took out a few stragglers, but your logs look fine now ...

Are you still having any problems ?

steam

Edited by steamwiz, 20 April 2008 - 11:11 AM.

  • 0

#18
newbiefollies

newbiefollies

    Member

  • Topic Starter
  • Member
  • PipPip
  • 23 posts
Dear steamwiz,
Thank you for your reply. It was a great relief to learn that the ~$ files were not created by some malware. I strongly believe that the problems I was having have been sorted out, touch wood. My sincerest thanks go out to you for helping me clean my machine. One last question. What do I do with all the programs I have downloaded? Do I let them be as they are? Do I turn them off? Or do I unistall them?
With best regards,
newbiefollies.
  • 0

#19
steamwiz

steamwiz

    Malware Expert

  • Retired Staff
  • 68 posts
  • MVP
Hi

Go to add\remove programs in the control panel and uninstall :-

AVG Anti-Rootkit
Sophos Anti-Rootkit 1.3.1

These it would be a good idea to keep, just update them & run a scan every couple of weeks :-

Malwarebytes' Anti-Malware
SUPERAntiSpyware

Go to Start > Run > copy and paste ComboFix /u into the Open: box & press OK

Posted Image

Now you are clean ... have a look here :-

So how did I get infected in the first place? By TonyKlein > http://forums.spybot...hread.php?t=279

steam
  • 0

#20
newbiefollies

newbiefollies

    Member

  • Topic Starter
  • Member
  • PipPip
  • 23 posts
Dear steamwiz,
Thanks for your reply. I have uninstalled AVG Anti-Rootkit & Sophos Anti-Rootkit 1.3.1. The SUPERAntiSpyware, that I have downloaded, is the professional trial version. It will stop working after a few days. I also have SpyCatcher & AVG Anti-Spyware. Should I keep or uninstall them?
Regarding ComboFix /u, when I did what you had asked me to do, I got the following window.
Expired - 08-03-30.1
Current date is Wed 04/23/2008.
This copy of ComboFix has expired.
Please download an updated copy.
Do you want me to do this? How should I go about it?
With best regards,
newbiefollies.
  • 0

#21
steamwiz

steamwiz

    Malware Expert

  • Retired Staff
  • 68 posts
  • MVP
HI

As a general rule, you should only have one anti-virus as 2 or more will most probably conflict ... because an anti-virus is continually monitoring your system... you have avast! Antivirus ... OK

With anti-spyware a similar thing applies ... you should only have 1 real-time anti-spyware scanner running, ... the more you have running... the more chance you have of a conflict ...

SUPERAntiSpyware
SpyCatcher
AVG Anti-Spyware

As well as ...

Malwarebytes' Anti-Malware
Spybot S & D
Adaware
+ many others

You can keep any or all of the above, just have one of them running real-time protection

Just keeping them wont use any resources, or cause conflicts, because they wont be actually running, just update them & run a scan every couple of weeks :-

I see you have AVG Anti-Spyware running real-time protection, so when SUPERAntiSpyware stops real-time protection you will still have AVG Anti-Spyware running ... obviously these 2 programs work together for you, so i would leave things as they are... if at some time in the future you want to change the program running real-time protection, then disable it in AVG Anti-Spyware, and enable it in another program.

Don't do anything about Combofix yet, I'll get back to you on that.

steam
  • 0

#22
steamwiz

steamwiz

    Malware Expert

  • Retired Staff
  • 68 posts
  • MVP
Hi

I've been in touch with sUBs, the author of Combofix, & he recommends that as Combofix drops a lot of files on your computer, in order to carry out the cleaning, that it would be best if you deleted the Combofix.exe file from your desktop, & downloaded a new version, then proceeded with the ComboFix /u instructions ... this will ensure all the files are removed.

cheers

steam
  • 0

#23
newbiefollies

newbiefollies

    Member

  • Topic Starter
  • Member
  • PipPip
  • 23 posts
Dear steamwiz,
Thanks for your reply. It's strange, but I can't find the ComboFix icon on my desktop anymore. I certainly haven't deleted it.
What should I do now?
Regards,
newbiefollies.
  • 0

#24
steamwiz

steamwiz

    Malware Expert

  • Retired Staff
  • 68 posts
  • MVP
Hi

It looks like when you ran ComboFix /u ... & you got the error that This copy of ComboFix has expired. ComboFix self deleted ... but not all the associated files ... please go ahead and download the latest version to your desktop, then run ... ComboFix /u as described earlier ...

cheers

steam
  • 0

#25
newbiefollies

newbiefollies

    Member

  • Topic Starter
  • Member
  • PipPip
  • 23 posts
Dear steamwiz,
Thanks for your reply. I followed your instructions. When I ran ComboFix /u, this is what happened.
A window called Info opened. It said, "ComboFix is uninstalled."
I clicked on OK.
Then another window called Nircmd.exe opened. It said, "Windows cannot find 'Nircmd.exe'. Make sure you type the name correctly, and then try again. To search for a file, click the start button, and then click Search."
I clicked on OK, but the same window opened again.
I again clicked on OK and this time the window disappeared.
Is everything alright now with my machine?
I am now going to read "So how did I get infected in the first place" by Tony Klein.
Thanks a ton for your help.
Regards,
newbiefollies.
  • 0

Advertisements


#26
steamwiz

steamwiz

    Malware Expert

  • Retired Staff
  • 68 posts
  • MVP
Hi

It looks like when you got this error about downloading a new version, Combofix did actually continue with the uninstall anyway ...

Regarding ComboFix /u, when I did what you had asked me to do, I got the following window.
Expired - 08-03-30.1
Current date is Wed 04/23/2008.
This copy of ComboFix has expired.
Please download an updated copy.


In your last post, the Nircmd.exe mentioned is a file which Combofix uses, with it not being there, it must be uninstalled.

A window called Info opened. It said, "ComboFix is uninstalled."
I clicked on OK.
Then another window called Nircmd.exe opened. It said, "Windows cannot find 'Nircmd.exe'. Make sure you type the name correctly, and then try again. To search for a file, click the start button, and then click Search."
I clicked on OK, but the same window opened again.
I again clicked on OK and this time the window disappeared.


Just delete the new Combofix.exe from your desktop now, & you're done ....

Sorry for all the confusion ...

steam
  • 0

#27
newbiefollies

newbiefollies

    Member

  • Topic Starter
  • Member
  • PipPip
  • 23 posts
Dear steamwiz,
Please do not apologise. I am really fortunate to receive your help. ComboFix got removed when I followed your previous instructions. I read Tony Klein's article & downloaded Online Armor firewall.
I tried to stop Spycatcher & use AVG AntiSpyware for realtime protection. But each time I reboot, Spycatcher comes on again, which is a bit irritating. I tried to uninstall Spycatcher, but got a message that the quarantined malware would get released, so I didn't. Is there any way that I can uninstall without this happening?
Thanks a ton once again. You are brilliant.
newbiefollies.
  • 0

#28
steamwiz

steamwiz

    Malware Expert

  • Retired Staff
  • 68 posts
  • MVP
Hi

You should be able to uninstall Spycatcher from add/remove programs in the Control panel ...

When you say you got the message that "the quarantined malware would get released," ... are you sure it didn't say that "the quarantined malware would be permanently deleted"

If it did, then that's OK, it just means everything concerning Spycatcher will be removed, including any malware which it has quarantined ...

I have never heard of any program saying it will release malware back on to your computer if you delete the program.

If you are still in doubt, can you please post the exact message you get.

steam
  • 0

#29
newbiefollies

newbiefollies

    Member

  • Topic Starter
  • Member
  • PipPip
  • 23 posts
Dear steamwiz,
Thanks for your reply. This is the window that opened when I last tried to uninstall SpyCatcher Express 2007.

Uninstall
Uninstalling SpyCatcher will remove quarantine protection. The spyware & suspicious files you have quarantined will be active once SpyCatcher is removed. Are you sure you want to uninstall SpyCatcher?
Yes No

With best regards,
newbiefollies.
  • 0

#30
steamwiz

steamwiz

    Malware Expert

  • Retired Staff
  • 68 posts
  • MVP
HI

I see ...

This is SpyCatcher's own uninstall instructions :-

http://www.tenebril.....php?faq_id=287

very detailed ... I don't think ... & regularly updated ... last updated: 2005/10/19 ... sure ...

My first instinct was to tell you to empty (delete) the files in the quarantine folder ..

But SpyCatcher has trashed more than it's far share of computers by quarantining/deleting legit files ...

if all the files in quarantine have been there for quite a while, then I doubt you need them as you haven't missed them so far, so either go ahead & empty (delete) the files in the quarantine folder .. or if you can copy & paste them, post them here first, & I'll see if I can see anything which shouldn't have been quarantined first, so that you can restore it, before deleting the rest ...

steam
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP