Javascript Disabled Detected

You currently have javascript disabled. Several functions may not work. Please re-enable javascript to access full functionality.

Can't get rid of Trojan Generic3.Uns & Program Files\func

Started by rlfaress , May 05 2008 08:13 PM

This topic is locked

#16 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #16$
rlfaress

Posted 08 May 2008 - 04:33 PM

Member

Topic Starter
Member
24 posts

05082008_181804.log file:

Explorer killed successfully
C:\WINDOWS\four444444.exe moved successfully.
C:\WINDOWS\LOT66225.exe moved successfully.
C:\WINDOWS\two222222.exe moved successfully.
< purity >
Explorer started successfully

OTMoveIt2 by OldTimer - Version 1.0.4.1 log created on 05082008_181804

Deckard's System Scanner v20071014.68
Run by Everyone Else on 2008-05-08 18:29:20
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- HijackThis (run as Everyone Else.exe) ---------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 6:29:48 PM, on 5/8/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\PC Tools Firewall Plus\FWService.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Dell\QuickSet\QuickSet.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Apoint\HidFind.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\explorer.exe
C:\Program Files\VnrPack\VnrPack15.exe
C:\Documents and Settings\Everyone Else\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\EVERYO~1.EXE

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft....k/?LinkId=74005
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) - {718FFD62-B1B2-420C-BC73-0A14B6EB80A7} - C:\Program Files\ATI Technologies\pexyh66225.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: BeSideit IE Helper - {89CBB8EA-FA02-4f61-B997-0247E69F002B} - C:\Program Files\QdrDrive\QdrDrive15.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\QuickSet.exe
O4 - HKLM\..\Run: [ShowLOMControl]
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\CVS\CVS Photo Editor Plus\Corel Photo Downloader.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [VnrPack15] "C:\Program Files\VnrPack\VnrPack15.exe"
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.appl...ex/qtplugin.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoft...s/as2stubie.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace....ploader1006.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail....es/MSNPUpld.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onec...wlscbase370.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1101076214519
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://floridakeysme...sCamControl.ocx
O16 - DPF: {A93B47FD-9BF6-4DA8-97FC-9270B9D64A6C} (VaPgCtrl Class) - http://www.dlink.com...in/h263ctrl.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Program Files\PC Tools Firewall Plus\FWService.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 8869 bytes

-- Files created between 2008-04-08 and 2008-05-08 -----------------------------

2008-05-08 18:24:59 0 d-------- C:\Program Files\VnrPack
2008-05-08 18:24:59 0 d-------- C:\Program Files\QdrDrive
2008-05-08 18:24:58 0 d-------- C:\Program Files\ISM
2008-05-08 14:32:54 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-05-08 14:32:52 0 d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-05-08 14:32:51 0 d-------- C:\WINDOWS\LastGood
2008-05-07 18:26:11 0 d-------- C:\Documents and Settings\Everyone Else\Application Data\Any Video Converter
2008-05-07 18:26:06 0 d-------- C:\Program Files\Any Video Converter
2008-05-06 15:44:25 0 d-------- C:\WINDOWS\system32\appmgmt
2008-05-05 18:37:08 0 d-------- C:\Program Files\Panda Security
2008-05-05 16:22:29 0 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-05-05 16:22:14 0 d-------- C:\Program Files\SUPERAntiSpyware
2008-05-05 16:22:14 0 d-------- C:\Documents and Settings\Everyone Else\Application Data\SUPERAntiSpyware.com
2008-05-05 16:21:39 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-05-05 01:32:08 3478 --a------ C:\WINDOWS\system32\tmp.reg
2008-05-05 01:31:23 25600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-05-05 01:31:23 289144 --a------ C:\WINDOWS\system32\VCCLSID.exe <Not Verified; S!Ri; >
2008-05-05 01:31:23 86528 --a------ C:\WINDOWS\system32\VACFix.exe <Not Verified; S!Ri.URZ; VACFix>
2008-05-05 01:31:23 288417 --a------ C:\WINDOWS\system32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS>
2008-05-05 01:31:23 53248 --a------ C:\WINDOWS\system32\Process.exe <Not Verified; http://www.beyondlogic.org; Command Line Process Utility>
2008-05-05 01:31:23 82944 --a------ C:\WINDOWS\system32\IEDFix.exe <Not Verified; S!Ri.URZ; IEDFix>
2008-05-05 01:31:23 51200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-05-05 01:31:23 82944 --a------ C:\WINDOWS\system32\404Fix.exe <Not Verified; S!Ri.URZ; IEDFix>
2008-05-04 21:53:23 0 d-------- C:\WINDOWS\system32\NtmsData
2008-05-04 20:05:40 0 d-------- C:\Documents and Settings\Everyone Else\Application Data\CyberLink
2008-05-04 19:56:47 0 d-------- C:\Documents and Settings\Everyone Else\Application Data\Malwarebytes
2008-05-04 19:56:40 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-04 19:56:39 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-05-04 19:55:29 0 d-------- C:\Program Files\Common Files\Download Manager
2008-05-04 18:53:24 0 d-------- C:\Program Files\Windows Live Safety Center
2008-05-04 18:07:31 0 d-------- C:\Program Files\Trend Micro
2008-05-04 16:33:37 0 d-------- C:\Program Files\iPod
2008-05-04 16:33:22 0 d-------- C:\Program Files\iTunes
2008-05-04 16:32:14 0 d-------- C:\Program Files\Bonjour
2008-05-04 16:30:58 0 d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-05-04 16:28:36 0 d-------- C:\Program Files\Common Files\Apple
2008-05-04 16:23:07 0 d-------- C:\Documents and Settings\Everyone Else\Application Data\Apple Computer
2008-04-30 17:57:55 0 d-------- C:\Documents and Settings\Everyone Else\Application Data\DivX
2008-04-11 23:42:26 0 d-------- C:\Documents and Settings\Everyone Else\Application Data\Help
2008-04-11 19:53:19 0 d-------- C:\Documents and Settings\Everyone Else\Application Data\ArcSoft
2008-04-11 19:16:51 495616 --a------ C:\WINDOWS\system32\PICSDK2.dll <Not Verified; SEIKO EPSON CORPORATION; EPSON PIC SDK>
2008-04-11 19:16:51 73728 --a------ C:\WINDOWS\system32\PICSDK.dll <Not Verified; SEIKO EPSON CORPORATION; EPSON PIC SDK>
2008-04-11 19:16:51 77824 --a------ C:\WINDOWS\system32\PICEntry.dll <Not Verified; SEIKO EPSON CORPORATION; EPSON PIC SDK>
2008-04-11 19:16:51 114688 --a------ C:\WINDOWS\system32\EpPicPrt.dll <Not Verified; SEIKO EPSON CORPORATION; EPSON PIC SDK>
2008-04-11 19:16:51 111932 --a------ C:\WINDOWS\system32\EPPICPrinterDB.dat
2008-04-11 19:16:51 1120 --a------ C:\WINDOWS\system32\EPPICPresetData_IT.dat
2008-04-11 19:16:51 1107 --a------ C:\WINDOWS\system32\EPPICPresetData_GE.dat
2008-04-11 19:16:51 1136 --a------ C:\WINDOWS\system32\EPPICPresetData_ES.dat
2008-04-11 19:16:51 1104 --a------ C:\WINDOWS\system32\EPPICPresetData_EN.dat
2008-04-11 19:16:51 1146 --a------ C:\WINDOWS\system32\EPPICPresetData_DU.dat
2008-04-11 19:16:50 1139 --a------ C:\WINDOWS\system32\EPPICPresetData_PT.dat
2008-04-11 19:16:50 1129 --a------ C:\WINDOWS\system32\EPPICPresetData_FR.dat
2008-04-11 19:16:50 1129 --a------ C:\WINDOWS\system32\EPPICPresetData_CF.dat
2008-04-11 19:16:50 1139 --a------ C:\WINDOWS\system32\EPPICPresetData_BP.dat
2008-04-11 19:16:50 4943 --a------ C:\WINDOWS\system32\EPPICPattern6.dat
2008-04-11 19:16:50 21390 --a------ C:\WINDOWS\system32\EPPICPattern5.dat
2008-04-11 19:16:50 11811 --a------ C:\WINDOWS\system32\EPPICPattern4.dat
2008-04-11 19:16:50 24903 --a------ C:\WINDOWS\system32\EPPICPattern3.dat
2008-04-11 19:16:50 20148 --a------ C:\WINDOWS\system32\EPPICPattern2.dat
2008-04-11 19:16:50 31053 --a------ C:\WINDOWS\system32\EPPICPattern131.dat
2008-04-11 19:16:50 27417 --a------ C:\WINDOWS\system32\EPPICPattern121.dat
2008-04-11 19:16:50 26154 --a------ C:\WINDOWS\system32\EPPICPattern1.dat
2008-04-11 19:16:50 65536 --a------ C:\WINDOWS\system32\EPPicMgr.dll <Not Verified; SEIKO EPSON CORPORATION; EPSON PIC SDK>
2008-04-11 19:16:24 45056 --a------ C:\WINDOWS\system32\PhDi2.sys <Not Verified; Matsushita Electric Industrial Co., Ltd.; PHOTOfunSTUDIO version 0.99J>
2008-04-11 19:14:51 21248 --a------ C:\WINDOWS\system32\drivers\pfc.sys <Not Verified; Padus, Inc.; Padus® ASPI Shell>
2008-04-11 19:14:50 0 d-------- C:\Program Files\Common Files\ArcSoft
2008-04-11 19:14:49 143360 --a------ C:\WINDOWS\system32\PhotoBase Screen Saver.scr <Not Verified; ArcSoft Inc.; PhotoBase Screen Saver>
2008-04-11 19:12:38 212480 --a------ C:\WINDOWS\PCDLIB32.DLL <Not Verified; Eastman Kodak; Kodak Photo CD Access Developer Toolkit>
2008-04-11 19:12:38 0 d-------- C:\Program Files\ArcSoft
2008-04-08 20:43:22 0 d-------- C:\Program Files\Windows Media Connect 2
2008-04-08 20:41:08 0 d-------- C:\WINDOWS\system32\drivers\UMDF
2008-04-08 20:36:29 0 d-------- C:\Program Files\DivX

-- Find3M Report ---------------------------------------------------------------

2008-05-08 14:24:49 0 d-------- C:\Documents and Settings\Everyone Else\Application Data\AVG7
2008-05-06 17:47:34 0 d-------- C:\Documents and Settings\Everyone Else\Application Data\Corel
2008-05-06 17:32:35 2828 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
2008-05-06 17:32:08 88 -r-hs---- C:\WINDOWS\system32\22F5F226D9.sys
2008-05-06 15:44:10 0 d-------- C:\Program Files\Windows Live
2008-05-06 15:43:21 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-05-06 15:37:29 0 d-------- C:\Program Files\Kodak
2008-05-06 15:37:18 0 d-------- C:\Program Files\Common Files
2008-05-06 15:33:24 80332 --a------ C:\logfile
2008-05-05 20:11:18 0 d-------- C:\Program Files\LimeWire
2008-05-04 19:18:45 0 d-------- C:\Program Files\Incomplete
2008-05-04 17:34:01 0 d-------- C:\Program Files\ATI Technologies
2008-05-04 17:04:45 0 d-------- C:\Documents and Settings\Everyone Else\Application Data\LimeWire
2008-05-04 16:31:51 0 d-------- C:\Program Files\QuickTime
2008-04-26 05:41:52 142 --a------ C:\Program Files\page.html
2008-04-10 15:36:29 0 d-------- C:\Program Files\PC Tools Firewall Plus
2008-04-09 20:13:46 0 d-------- C:\Program Files\Java
2008-03-31 17:25:48 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll <Not Verified; DivX, Inc.; DivX®>
2008-03-31 17:25:48 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll <Not Verified; DivX, Inc.; DivX®>
2008-03-31 17:25:46 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll <Not Verified; DivX, Inc.; DivX?>
2008-03-31 17:25:46 831488 --a------ C:\WINDOWS\system32\divx_xx0a.dll
2008-03-31 17:25:46 682496 --a------ C:\WINDOWS\system32\DivX.dll <Not Verified; DivX, Inc.; DivX®>
2008-03-26 04:07:28 0 d-------- C:\Program Files\Family Tree Maker 2005
2008-03-22 00:38:33 0 d-------- C:\Documents and Settings\Everyone Else\Application Data\FTW
2008-03-21 21:43:20 0 d-------- C:\Program Files\TUGZip
2008-03-21 16:30:08 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2008-03-21 16:28:54 81920 --a------ C:\WINDOWS\system32\dpl100.dll <Not Verified; DivX, Inc.; DivX, Inc. dpl100>
2008-03-21 16:28:20 12288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll
2008-03-14 19:56:29 1376 --a------ C:\Documents and Settings\Everyone Else\Application Data\lp.xml
2008-03-08 19:52:39 0 d-------- C:\Program Files\MySpace
2008-03-08 19:50:36 0 d-------- C:\Documents and Settings\Everyone Else\Application Data\PCToolsFirewallPlus
2008-03-08 19:45:36 0 d-------- C:\Program Files\Common Files\PC Tools
2008-03-08 04:10:47 0 d-------- C:\Documents and Settings\Everyone Else\Application Data\MySpace
2008-03-08 01:35:05 0 d--hs--c- C:\Program Files\Common Files\WindowsLiveInstaller
2008-03-08 00:54:47 0 d-------- C:\Program Files\Yahoo!
2008-03-02 16:41:08 29 --a------ C:\WINDOWS\Snap Component
2008-02-21 23:18:17 42 --a------ C:\END

-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{718FFD62-B1B2-420C-BC73-0A14B6EB80A7}]
02/27/2008 09:54 PM 217088 --a------ C:\Program Files\ATI Technologies\pexyh66225.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{89CBB8EA-FA02-4f61-B997-0247E69F002B}]
04/15/2008 03:40 PM 147456 --a------ C:\Program Files\QdrDrive\QdrDrive15.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [12/19/2005 01:08 PM]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [10/07/2005 06:13 PM]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\QuickSet.exe" [12/15/2005 01:44 PM]
"ShowLOMControl"="1 (0x1)" []
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [11/11/2005 12:05 AM]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [12/10/2005 04:29 AM]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [08/13/2004 09:05 AM]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [01/07/2004 09:01 AM]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 11:16 PM]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [04/16/2008 02:46 PM]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [02/22/2008 04:25 AM]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [11/03/2006 08:20 PM]
"00PCTFW"="C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" [04/10/2008 03:36 PM]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [03/28/2008 11:37 PM]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [03/30/2008 10:36 AM]
"Corel Photo Downloader"="C:\Program Files\CVS\CVS Photo Editor Plus\Corel Photo Downloader.exe" [02/06/2007 12:20 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/12/2004 09:18 AM]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [05/05/2008 06:14 PM]
"VnrPack15"="C:\Program Files\VnrPack\VnrPack15.exe" [04/15/2008 04:50 PM]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Find Fast.lnk - C:\Program Files\Microsoft Office\Office\FINDFAST.EXE [7/11/1997 8:00:00 AM]
Office Startup.lnk - C:\Program Files\Microsoft Office\Office\OSA.EXE [7/11/1997 8:00:00 AM]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"disableregistrytools"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [12/20/2006 12:55 PM 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL 05/05/2008 06:15 PM 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

-- End of Deckard's System Scanner: finished at 2008-05-08 18:33:03 ------------

#17 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #17$
Rorschach112

Posted 08 May 2008 - 05:32 PM

Ralphie

Retired Staff
47,710 posts

Hello

Please download the OTMoveIt2 by OldTimer.

Save it to your desktop.
Please double-click OTMoveIt2.exe to run it.
Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
```
[kill explorer]
C:\Program Files\VnrPack
C:\Program Files\QdrDrive
C:\Program Files\ISM
purity 
[start explorer]
```
Return to OTMoveIt2, right click in the "Paste List of Files/Folders to Move" window (under the light Yellow bar) and choose Paste.
Click the red Moveit! button.
A log of files and folders moved will be created in the c:\_OTMoveIt\MovedFiles folder in the form of Date and Time (mmddyyyy_hhmmss.log). Please open this log in Notepad and post its contents in your next reply.
Close OTMoveIt2

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Download Dr.Web CureIt to the desktop:
ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe

Doubleclick the drweb-cureit.exe file and Allow to run the express scan
This will scan the files currently running in memory and when something is found, click the yes button when it asks you if you want to cure it. This is only a short scan.
Once the short scan has finished, mark the drives that you want to scan.
Select all drives. A red dot shows which drives have been chosen.
Click the green arrow at the right, and the scan will start.
Click 'Yes to all' if it asks if you want to cure/move the file.
When the scan has finished, in the menu, click file and choose save report list
Save the report to your desktop. The report will be called DrWeb.csv
Close Dr.Web Cureit.

Also post a new DSS log

#18 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #18$
rlfaress

Posted 08 May 2008 - 08:15 PM

Member

Topic Starter
Member
24 posts

Logs requested:

Explorer killed successfully
Folder move failed. C:\Program Files\VnrPack scheduled to be moved on reboot.
C:\Program Files\QdrDrive moved successfully.
C:\Program Files\ISM moved successfully.
< purity >
Explorer started successfully

OTMoveIt2 by OldTimer - Version 1.0.4.1 log created on 05082008_200645

Files moved on Reboot...
C:\Program Files\VnrPack moved successfully.

Dr.Web.cvs

00237922.FIL;C:\$VAULT$.AVG;Trojan.StartPage.19993;Deleted.;
Process.exe;C:\Documents and Settings\Everyone Else\Desktop\SmitfraudFix;Tool.Prockill;;
restart.exe;C:\Documents and Settings\Everyone Else\Desktop\SmitfraudFix;Tool.ShutDown.11;;
TEK76[1].exe;C:\Documents and Settings\Everyone Else\Local Settings\Temporary Internet Files\Content.IE5\6S66TLCN;Trojan.StartPage.19993;Deleted.;
A0009140.dll;C:\System Volume Information\_restore{6B8BF05F-EEFE-4A41-96AD-B82E393DA7FC}\RP39;Adware.SearchAid.origin;;
A0009146.exe;C:\System Volume Information\_restore{6B8BF05F-EEFE-4A41-96AD-B82E393DA7FC}\RP39;Trojan.Click.origin;Incurable.Moved.;
A0010892.bat;C:\System Volume Information\_restore{6B8BF05F-EEFE-4A41-96AD-B82E393DA7FC}\RP46;Probably BATCH.Virus;;
A0010899.bat;C:\System Volume Information\_restore{6B8BF05F-EEFE-4A41-96AD-B82E393DA7FC}\RP46;Probably SCRIPT.Virus;;
TEK76.exe;C:\WINDOWS;Trojan.StartPage.19993;Deleted.;
Process.exe;C:\WINDOWS\system32;Tool.Prockill;;
QdrDrive15.dll;C:\_OTMoveIt\MovedFiles\05082008_200645\Program Files\QdrDrive;Adware.SearchAid.origin;;
VnrPack15.exe;C:\_OTMoveIt\MovedFiles\05082008_200645\Program Files\VnrPack;Trojan.Click.origin;Incurable.Moved.;

Deckard's System Scanner v20071014.68
Run by Everyone Else on 2008-05-08 22:11:34
Computer is in Normal Mode.
--------------------------------------------------------------------------------

-- HijackThis (run as Everyone Else.exe) ---------------------------------------

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:12:00 PM, on 5/8/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\PC Tools Firewall Plus\FWService.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Dell\QuickSet\QuickSet.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\Everyone Else\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\EVERYO~1.EXE

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft....k/?LinkId=74005
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) - {718FFD62-B1B2-420C-BC73-0A14B6EB80A7} - C:\Program Files\ATI Technologies\pexyh66225.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: BeSideit IE Helper - {89CBB8EA-FA02-4f61-B997-0247E69F002B} - C:\Program Files\QdrDrive\QdrDrive15.dll (file missing)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\QuickSet.exe
O4 - HKLM\..\Run: [ShowLOMControl]
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\CVS\CVS Photo Editor Plus\Corel Photo Downloader.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKCU\..\Run: [VnrPack15] "C:\Program Files\VnrPack\VnrPack15.exe"
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.appl...ex/qtplugin.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoft...s/as2stubie.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace....ploader1006.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail....es/MSNPUpld.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onec...wlscbase370.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1101076214519
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://floridakeysme...sCamControl.ocx
O16 - DPF: {A93B47FD-9BF6-4DA8-97FC-9270B9D64A6C} (VaPgCtrl Class) - http://www.dlink.com...in/h263ctrl.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - http://fpdownload2.m...ash/swflash.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Program Files\PC Tools Firewall Plus\FWService.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 8969 bytes

-- Files created between 2008-04-08 and 2008-05-08 -----------------------------

2008-05-08 20:27:35 0 d-------- C:\Documents and Settings\Everyone Else\DoctorWeb
2008-05-08 14:32:54 0 d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-05-08 14:32:52 0 d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-05-07 18:26:11 0 d-------- C:\Documents and Settings\Everyone Else\Application Data\Any Video Converter
2008-05-07 18:26:06 0 d-------- C:\Program Files\Any Video Converter
2008-05-06 15:44:25 0 d-------- C:\WINDOWS\system32\appmgmt
2008-05-05 18:37:08 0 d-------- C:\Program Files\Panda Security
2008-05-05 16:22:29 0 d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-05-05 16:22:14 0 d-------- C:\Program Files\SUPERAntiSpyware
2008-05-05 16:22:14 0 d-------- C:\Documents and Settings\Everyone Else\Application Data\SUPERAntiSpyware.com
2008-05-05 16:21:39 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-05-05 01:32:08 3478 --a------ C:\WINDOWS\system32\tmp.reg
2008-05-05 01:31:23 25600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-05-05 01:31:23 289144 --a------ C:\WINDOWS\system32\VCCLSID.exe <Not Verified; S!Ri; >
2008-05-05 01:31:23 86528 --a------ C:\WINDOWS\system32\VACFix.exe <Not Verified; S!Ri.URZ; VACFix>
2008-05-05 01:31:23 288417 --a------ C:\WINDOWS\system32\SrchSTS.exe <Not Verified; S!Ri; SrchSTS>
2008-05-05 01:31:23 82944 --a------ C:\WINDOWS\system32\IEDFix.exe <Not Verified; S!Ri.URZ; IEDFix>
2008-05-05 01:31:23 51200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-05-05 01:31:23 82944 --a------ C:\WINDOWS\system32\404Fix.exe <Not Verified; S!Ri.URZ; IEDFix>
2008-05-04 21:53:23 0 d-------- C:\WINDOWS\system32\NtmsData
2008-05-04 20:05:40 0 d-------- C:\Documents and Settings\Everyone Else\Application Data\CyberLink
2008-05-04 19:56:47 0 d-------- C:\Documents and Settings\Everyone Else\Application Data\Malwarebytes
2008-05-04 19:56:40 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-05-04 19:56:39 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-05-04 19:55:29 0 d-------- C:\Program Files\Common Files\Download Manager
2008-05-04 18:53:24 0 d-------- C:\Program Files\Windows Live Safety Center
2008-05-04 18:07:31 0 d-------- C:\Program Files\Trend Micro
2008-05-04 16:33:37 0 d-------- C:\Program Files\iPod
2008-05-04 16:33:22 0 d-------- C:\Program Files\iTunes
2008-05-04 16:32:14 0 d-------- C:\Program Files\Bonjour
2008-05-04 16:30:58 0 d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
2008-05-04 16:28:36 0 d-------- C:\Program Files\Common Files\Apple
2008-05-04 16:23:07 0 d-------- C:\Documents and Settings\Everyone Else\Application Data\Apple Computer
2008-04-30 17:57:55 0 d-------- C:\Documents and Settings\Everyone Else\Application Data\DivX
2008-04-11 23:42:26 0 d-------- C:\Documents and Settings\Everyone Else\Application Data\Help
2008-04-11 19:53:19 0 d-------- C:\Documents and Settings\Everyone Else\Application Data\ArcSoft
2008-04-11 19:16:51 495616 --a------ C:\WINDOWS\system32\PICSDK2.dll <Not Verified; SEIKO EPSON CORPORATION; EPSON PIC SDK>
2008-04-11 19:16:51 73728 --a------ C:\WINDOWS\system32\PICSDK.dll <Not Verified; SEIKO EPSON CORPORATION; EPSON PIC SDK>
2008-04-11 19:16:51 77824 --a------ C:\WINDOWS\system32\PICEntry.dll <Not Verified; SEIKO EPSON CORPORATION; EPSON PIC SDK>
2008-04-11 19:16:51 114688 --a------ C:\WINDOWS\system32\EpPicPrt.dll <Not Verified; SEIKO EPSON CORPORATION; EPSON PIC SDK>
2008-04-11 19:16:51 111932 --a------ C:\WINDOWS\system32\EPPICPrinterDB.dat
2008-04-11 19:16:51 1120 --a------ C:\WINDOWS\system32\EPPICPresetData_IT.dat
2008-04-11 19:16:51 1107 --a------ C:\WINDOWS\system32\EPPICPresetData_GE.dat
2008-04-11 19:16:51 1136 --a------ C:\WINDOWS\system32\EPPICPresetData_ES.dat
2008-04-11 19:16:51 1104 --a------ C:\WINDOWS\system32\EPPICPresetData_EN.dat
2008-04-11 19:16:51 1146 --a------ C:\WINDOWS\system32\EPPICPresetData_DU.dat
2008-04-11 19:16:50 1139 --a------ C:\WINDOWS\system32\EPPICPresetData_PT.dat
2008-04-11 19:16:50 1129 --a------ C:\WINDOWS\system32\EPPICPresetData_FR.dat
2008-04-11 19:16:50 1129 --a------ C:\WINDOWS\system32\EPPICPresetData_CF.dat
2008-04-11 19:16:50 1139 --a------ C:\WINDOWS\system32\EPPICPresetData_BP.dat
2008-04-11 19:16:50 4943 --a------ C:\WINDOWS\system32\EPPICPattern6.dat
2008-04-11 19:16:50 21390 --a------ C:\WINDOWS\system32\EPPICPattern5.dat
2008-04-11 19:16:50 11811 --a------ C:\WINDOWS\system32\EPPICPattern4.dat
2008-04-11 19:16:50 24903 --a------ C:\WINDOWS\system32\EPPICPattern3.dat
2008-04-11 19:16:50 20148 --a------ C:\WINDOWS\system32\EPPICPattern2.dat
2008-04-11 19:16:50 31053 --a------ C:\WINDOWS\system32\EPPICPattern131.dat
2008-04-11 19:16:50 27417 --a------ C:\WINDOWS\system32\EPPICPattern121.dat
2008-04-11 19:16:50 26154 --a------ C:\WINDOWS\system32\EPPICPattern1.dat
2008-04-11 19:16:50 65536 --a------ C:\WINDOWS\system32\EPPicMgr.dll <Not Verified; SEIKO EPSON CORPORATION; EPSON PIC SDK>
2008-04-11 19:16:24 45056 --a------ C:\WINDOWS\system32\PhDi2.sys <Not Verified; Matsushita Electric Industrial Co., Ltd.; PHOTOfunSTUDIO version 0.99J>
2008-04-11 19:14:51 21248 --a------ C:\WINDOWS\system32\drivers\pfc.sys <Not Verified; Padus, Inc.; Padus® ASPI Shell>
2008-04-11 19:14:50 0 d-------- C:\Program Files\Common Files\ArcSoft
2008-04-11 19:14:49 143360 --a------ C:\WINDOWS\system32\PhotoBase Screen Saver.scr <Not Verified; ArcSoft Inc.; PhotoBase Screen Saver>
2008-04-11 19:12:38 212480 --a------ C:\WINDOWS\PCDLIB32.DLL <Not Verified; Eastman Kodak; Kodak Photo CD Access Developer Toolkit>
2008-04-11 19:12:38 0 d-------- C:\Program Files\ArcSoft
2008-04-08 20:43:22 0 d-------- C:\Program Files\Windows Media Connect 2
2008-04-08 20:41:08 0 d-------- C:\WINDOWS\system32\drivers\UMDF
2008-04-08 20:36:29 0 d-------- C:\Program Files\DivX

-- Find3M Report ---------------------------------------------------------------

2008-05-08 14:24:49 0 d-------- C:\Documents and Settings\Everyone Else\Application Data\AVG7
2008-05-06 17:47:34 0 d-------- C:\Documents and Settings\Everyone Else\Application Data\Corel
2008-05-06 17:32:35 2828 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
2008-05-06 17:32:08 88 -r-hs---- C:\WINDOWS\system32\22F5F226D9.sys
2008-05-06 15:44:10 0 d-------- C:\Program Files\Windows Live
2008-05-06 15:43:21 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-05-06 15:37:29 0 d-------- C:\Program Files\Kodak
2008-05-06 15:37:18 0 d-------- C:\Program Files\Common Files
2008-05-06 15:33:24 80332 --a------ C:\logfile
2008-05-05 20:11:18 0 d-------- C:\Program Files\LimeWire
2008-05-04 19:18:45 0 d-------- C:\Program Files\Incomplete
2008-05-04 17:34:01 0 d-------- C:\Program Files\ATI Technologies
2008-05-04 17:04:45 0 d-------- C:\Documents and Settings\Everyone Else\Application Data\LimeWire
2008-05-04 16:31:51 0 d-------- C:\Program Files\QuickTime
2008-04-26 05:41:52 142 --a------ C:\Program Files\page.html
2008-04-10 15:36:29 0 d-------- C:\Program Files\PC Tools Firewall Plus
2008-04-09 20:13:46 0 d-------- C:\Program Files\Java
2008-03-31 17:25:48 823296 --a------ C:\WINDOWS\system32\divx_xx0c.dll <Not Verified; DivX, Inc.; DivX®>
2008-03-31 17:25:48 823296 --a------ C:\WINDOWS\system32\divx_xx07.dll <Not Verified; DivX, Inc.; DivX®>
2008-03-31 17:25:46 802816 --a------ C:\WINDOWS\system32\divx_xx11.dll <Not Verified; DivX, Inc.; DivX?>
2008-03-31 17:25:46 831488 --a------ C:\WINDOWS\system32\divx_xx0a.dll
2008-03-31 17:25:46 682496 --a------ C:\WINDOWS\system32\DivX.dll <Not Verified; DivX, Inc.; DivX®>
2008-03-26 04:07:28 0 d-------- C:\Program Files\Family Tree Maker 2005
2008-03-22 00:38:33 0 d-------- C:\Documents and Settings\Everyone Else\Application Data\FTW
2008-03-21 21:43:20 0 d-------- C:\Program Files\TUGZip
2008-03-21 16:30:08 3596288 --a------ C:\WINDOWS\system32\qt-dx331.dll
2008-03-21 16:28:54 81920 --a------ C:\WINDOWS\system32\dpl100.dll <Not Verified; DivX, Inc.; DivX, Inc. dpl100>
2008-03-21 16:28:20 12288 --a------ C:\WINDOWS\system32\DivXWMPExtType.dll
2008-03-14 19:56:29 1376 --a------ C:\Documents and Settings\Everyone Else\Application Data\lp.xml
2008-03-08 19:52:39 0 d-------- C:\Program Files\MySpace
2008-03-08 19:50:36 0 d-------- C:\Documents and Settings\Everyone Else\Application Data\PCToolsFirewallPlus
2008-03-08 19:45:36 0 d-------- C:\Program Files\Common Files\PC Tools
2008-03-08 04:10:47 0 d-------- C:\Documents and Settings\Everyone Else\Application Data\MySpace
2008-03-08 01:35:05 0 d--hs--c- C:\Program Files\Common Files\WindowsLiveInstaller
2008-03-08 00:54:47 0 d-------- C:\Program Files\Yahoo!
2008-03-02 16:41:08 29 --a------ C:\WINDOWS\Snap Component
2008-02-21 23:18:17 42 --a------ C:\END

-- Registry Dump ---------------------------------------------------------------

*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{718FFD62-B1B2-420C-BC73-0A14B6EB80A7}]
02/27/2008 09:54 PM 217088 --a------ C:\Program Files\ATI Technologies\pexyh66225.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{89CBB8EA-FA02-4f61-B997-0247E69F002B}]
C:\Program Files\QdrDrive\QdrDrive15.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [12/19/2005 01:08 PM]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [10/07/2005 06:13 PM]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\QuickSet.exe" [12/15/2005 01:44 PM]
"ShowLOMControl"="1 (0x1)" []
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [11/11/2005 12:05 AM]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [12/10/2005 04:29 AM]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [08/13/2004 09:05 AM]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [01/07/2004 09:01 AM]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [01/11/2008 11:16 PM]
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [04/16/2008 02:46 PM]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [02/22/2008 04:25 AM]
"Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [11/03/2006 08:20 PM]
"00PCTFW"="C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" [04/10/2008 03:36 PM]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [03/28/2008 11:37 PM]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [03/30/2008 10:36 AM]
"Corel Photo Downloader"="C:\Program Files\CVS\CVS Photo Editor Plus\Corel Photo Downloader.exe" [02/06/2007 12:20 PM]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [08/12/2004 09:18 AM]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [05/05/2008 06:14 PM]
"VnrPack15"="C:\Program Files\VnrPack\VnrPack15.exe" []

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Find Fast.lnk - C:\Program Files\Microsoft Office\Office\FINDFAST.EXE [7/11/1997 8:00:00 AM]
Office Startup.lnk - C:\Program Files\Microsoft Office\Office\OSA.EXE [7/11/1997 8:00:00 AM]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"disableregistrytools"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [12/20/2006 12:55 PM 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL 05/05/2008 06:15 PM 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

-- End of Deckard's System Scanner: finished at 2008-05-08 22:12:31 ------------

#19 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #19$
Rorschach112

Posted 09 May 2008 - 06:24 AM

Ralphie

Retired Staff
47,710 posts

Hello

1. Please re-open HiJackThis and choose do a system scan only. Check the boxes next to ONLY the entries listed below(if present):

O2 - BHO: BeSideit IE Helper - {89CBB8EA-FA02-4f61-B997-0247E69F002B} - C:\Program Files\QdrDrive\QdrDrive15.dll (file missing)
O4 - HKCU\..\Run: [VnrPack15] "C:\Program Files\VnrPack\VnrPack15.exe"

2. Now close all windows other than HiJackThis, including browsers, so that nothing other than HijackThis is open, then click Fix Checked. A box will pop up asking you if you wish to fix the selected items. Please choose YES. Once it has fixed them, please exit/close HijackThis.

Reboot and post a new HijackThis log and tell me how your PC is running

#20 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #20$
rlfaress

Posted 09 May 2008 - 02:08 PM

Member

Topic Starter
Member
24 posts

HI
Found both in Hijack and deleted. Upon reboot, got the same script error, Loading Script C:\ProgramFiles\func.js Failed (access denied) and AVG detected the same Trojan gen3. Also, there are 3 trojans in AVG vault again and I am still experiencing squirrely curser and keyboard movement. Should I delete the trojans in the vault?

Here is log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:03:56 PM, on 5/9/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\PC Tools Firewall Plus\FWService.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\WLTRYSVC.EXE
C:\WINDOWS\System32\bcmwltry.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\PSIService.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\WLTRAY.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Dell\QuickSet\QuickSet.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft Office\Office\OSA.EXE
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft....k/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://go.microsoft....k/?LinkId=74005
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: (no name) - {718FFD62-B1B2-420C-BC73-0A14B6EB80A7} - C:\Program Files\ATI Technologies\pexyh66225.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\QuickSet.exe
O4 - HKLM\..\Run: [ShowLOMControl]
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [00PCTFW] "C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe" -s
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\CVS\CVS Photo Editor Plus\Corel Photo Downloader.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office\Office\FINDFAST.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office\Office\OSA.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://appldnld.appl...ex/qtplugin.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {2D8ED06D-3C30-438B-96AE-4D110FDC1FB8} (ActiveScan 2.0 Installer Class) - http://acs.pandasoft...s/as2stubie.cab
O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace....ploader1006.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.hotmail....es/MSNPUpld.cab
O16 - DPF: {5ED80217-570B-4DA9-BF44-BE107C0EC166} (Windows Live Safety Center Base Module) - http://cdn.scan.onec...wlscbase370.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.mi...b?1101076214519
O16 - DPF: {917623D1-D8E5-11D2-BE8B-00104B06BDE3} (CamImage Class) - http://floridakeysme...sCamControl.ocx
O16 - DPF: {A93B47FD-9BF6-4DA8-97FC-9270B9D64A6C} (VaPgCtrl Class) - http://www.dlink.com...in/h263ctrl.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.m...ash/swflash.cab
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: PC Tools Firewall Plus (PCToolsFirewallPlus) - PC Tools - C:\Program Files\PC Tools Firewall Plus\FWService.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

--
End of file - 8772 bytes

#21 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #21$
Rorschach112

Posted 09 May 2008 - 02:12 PM

Ralphie

Retired Staff
47,710 posts

One more thing

Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select "Perform Quick Scan", then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

#22 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #22$
rlfaress

Posted 09 May 2008 - 02:50 PM

Member

Topic Starter
Member
24 posts

mbam log:

Malwarebytes' Anti-Malware 1.12
Database version: 737

Scan type: Quick Scan
Objects scanned: 54366
Time elapsed: 17 minute(s), 22 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 2
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 1
Files Infected: 3

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CURRENT_USER\Software\QdrDrive (Adware.ISM) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ISM (Adware.ISM) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
C:\Documents and Settings\Everyone Else\Start Menu\Programs\Internet Speed Monitor (Adware.AdSponsor) -> Quarantined and deleted successfully.

Files Infected:
C:\Documents and Settings\Everyone Else\Start Menu\Programs\Internet Speed Monitor\Check Now.lnk (Adware.AdSponsor) -> Quarantined and deleted successfully.
C:\Documents and Settings\Everyone Else\Start Menu\Programs\Internet Speed Monitor\Uninstall.lnk (Adware.AdSponsor) -> Quarantined and deleted successfully.
C:\Program Files\page.html (Malware.Trace) -> Quarantined and deleted successfully.

#23 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #23$
rlfaress

Posted 09 May 2008 - 02:58 PM

Member

Topic Starter
Member
24 posts

Also, upon this reboot AVG again detected Trojan Horse Generic3.UNS Path= C:\Windows\Tek76.exe.

#24 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #24$
Rorschach112

Posted 09 May 2008 - 03:27 PM

Ralphie

Retired Staff
47,710 posts

Wouldn't worry about that

Make sure you have an Internet Connection.
Double-click OTMoveIt2.exe to run it.
Click on the CleanUp! button
A list of tool components used in the Cleanup of malware will be downloaded.
If your Firewall or Real Time protection attempts to block OtMoveit2 to rech the Internet, please allow the application to do so.
Click Yes to beging the Cleanup process and remove these components, including this application.
You will be asked to reboot the machine to finish the Cleanup process. If you are asked to reboot the machine choose Yes.

You now need to update your Java and remove your older versions.

Please follow these steps to remove older version Java components.

* Click Start > Control Panel.
* Click Add/Remove Programs.
* Check any item with Java Runtime Environment (JRE) in the name.
* Click the Remove or Change/Remove button.

Download the latest version of Java Runtime Environment (JRE), and install it to your computer from
here

Now we need to create a new System Restore point.

Click Start Menu > Run > type (or copy and paste)

%SystemRoot%\System32\restore\rstrui.exe

Press OK. Choose Create a Restore Point then click Next. Name it and click Create, when the confirmation screen shows the restore point has been created click Close.

Next goto Start Menu > Run > type

cleanmgr

Click OK, Disk Cleanup will open and start calculating the amount of space that can be freed, Once thats finished it will open the Disk Cleanup options screen, click the More Options tab then click Clean up on the system restore area and choose Yes at the confirmation window which will remove all the restore points except the one we just created.

To close Disk Cleanup and remove the Temporary Internet Files detected in the initial scan click OK then choose Yes on the confirmation window.

Below I have included a number of recommendations for how to protect your computer against malware infections.

* Keep Windows updated by regularly checking their website at :
http://windowsupdate.microsoft.com/
This will ensure your computer has always the latest security updates available installed on your computer.

* To reduce re-infection for malware in the future, I strongly recommend installing these free programs:
SpywareBlaster protects against bad ActiveX
IE-SPYAD puts over 5000 sites in your restricted zone so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all
Have a look at this tutorial for IE-Spyad here

* SpywareGuard offers realtime protection from spyware installation attempts.

Make Internet Explorer more secure

Click Start > Run
Type Inetcpl.cpl & click OK
Click on the Security tab
Click Reset all zones to default level
Make sure the Internet Zone is selected & Click Custom level
In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to "Prompt", and ("Initialize and Script ActiveX controls not marked as safe") to "Disable".
Next Click OK, then Apply button and then OK to exit the Internet Properties page.

* MVPS Hosts file replaces your current HOSTS file with one containing well known ad sites and other bad sites. Basically, this prevents your computer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer, meaning it will be difficult to infect yourself in the future.

* Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more
secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in pop up
blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from
Here

* Take a good look at the following suggestions for malware prevention by reading Tony Klein’s article 'How Did I Get Infected In The First Place'
Here

Thank you for your patience, and performing all of the procedures requested.

#25 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #25$
rlfaress

Posted 09 May 2008 - 04:06 PM

Member

Topic Starter
Member
24 posts

which version of java do you recommend? they have a new beta

#26 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #26$
rlfaress

Posted 09 May 2008 - 04:07 PM

Member

Topic Starter
Member
24 posts

never mind....didn't see the runtime...b back in a few

#27 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #27$
rlfaress

Posted 09 May 2008 - 04:26 PM

Member

Topic Starter
Member
24 posts

great! I can't thank you enough for all your help, I have 81cents in my paypal, but as soon as I get a new deposit I will be sending you some cho! Ok, now I have a few questions....

does this mean my system is clean?
when I download firefox, do I keep the IE or do I uninstall?
should I get rid of the programs I downloaded and used to scan for logs or keep them?
and the new programs you suggested, will they conflict with any programs ie: firewall & avg?

#28 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #28$
Rorschach112

Posted 09 May 2008 - 04:34 PM

Ralphie

Retired Staff
47,710 posts

Yes your system is clean

You need IE, so keep it

Yes get rid of the programs you downloaded

The programs I suggested won't conflict with the other programs

Any other questions ?

#29 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #29$
rlfaress

Posted 09 May 2008 - 04:45 PM

Member

Topic Starter
Member
24 posts

Nope, your amazing! Thank you again!

#30 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #30$
Rorschach112

Posted 09 May 2008 - 04:49 PM

Ralphie

Retired Staff
47,710 posts

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.

Back to Virus, Spyware, Malware Removal · Next Unread Topic →

As Featured On:

Geeks to Go Forum 343,327 topics
Quick Links FAQ Malware Cleaning Guide How it Works
Downloads 2+ million

View New Content

Can't get rid of Trojan Generic3.Uns & Program Files\func

#16 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #16$
rlfaress

Posted 08 May 2008 - 04:33 PM

Advertisements

#17 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #17$
Rorschach112

Posted 08 May 2008 - 05:32 PM

#18 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #18$
rlfaress

Posted 08 May 2008 - 08:15 PM

#19 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #19$
Rorschach112

Posted 09 May 2008 - 06:24 AM

#20 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #20$
rlfaress

Posted 09 May 2008 - 02:08 PM

#21 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #21$
Rorschach112

Posted 09 May 2008 - 02:12 PM

#22 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #22$
rlfaress

Posted 09 May 2008 - 02:50 PM

#23 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #23$
rlfaress

Posted 09 May 2008 - 02:58 PM

#24 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #24$
Rorschach112

Posted 09 May 2008 - 03:27 PM

#25 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #25$
rlfaress

Posted 09 May 2008 - 04:06 PM

Advertisements

#26 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #26$
rlfaress

Posted 09 May 2008 - 04:07 PM

#27 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #27$
rlfaress

Posted 09 May 2008 - 04:26 PM

#28 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #28$
Rorschach112

Posted 09 May 2008 - 04:34 PM

#29 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #29$
rlfaress

Posted 09 May 2008 - 04:45 PM

#30 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #30$
Rorschach112

Posted 09 May 2008 - 04:49 PM

Similar Topics

0 user(s) are reading this topic

As Featured On:

Forums

Downloads

Members

Connect With Us

Can't get rid of Trojan Generic3.Uns & Program Files\func

#16 rlfaress Posted 08 May 2008 - 04:33 PM

Advertisements

#17 Rorschach112 Posted 08 May 2008 - 05:32 PM

#18 rlfaress Posted 08 May 2008 - 08:15 PM

#19 Rorschach112 Posted 09 May 2008 - 06:24 AM

#20 rlfaress Posted 09 May 2008 - 02:08 PM

#21 Rorschach112 Posted 09 May 2008 - 02:12 PM

#22 rlfaress Posted 09 May 2008 - 02:50 PM

#23 rlfaress Posted 09 May 2008 - 02:58 PM

#24 Rorschach112 Posted 09 May 2008 - 03:27 PM

#25 rlfaress Posted 09 May 2008 - 04:06 PM

Advertisements

#26 rlfaress Posted 09 May 2008 - 04:07 PM

#27 rlfaress Posted 09 May 2008 - 04:26 PM

#28 Rorschach112 Posted 09 May 2008 - 04:34 PM

#29 rlfaress Posted 09 May 2008 - 04:45 PM

#30 Rorschach112 Posted 09 May 2008 - 04:49 PM

Similar Topics

0 user(s) are reading this topic

As Featured On:

Forums

Downloads

Members

Connect With Us

Sign In

#16 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #16$
rlfaress

Posted 08 May 2008 - 04:33 PM

#17 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #17$
Rorschach112

Posted 08 May 2008 - 05:32 PM

#18 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #18$
rlfaress

Posted 08 May 2008 - 08:15 PM

#19 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #19$
Rorschach112

Posted 09 May 2008 - 06:24 AM

#20 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #20$
rlfaress

Posted 09 May 2008 - 02:08 PM

#21 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #21$
Rorschach112

Posted 09 May 2008 - 02:12 PM

#22 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #22$
rlfaress

Posted 09 May 2008 - 02:50 PM

#23 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #23$
rlfaress

Posted 09 May 2008 - 02:58 PM

#24 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #24$
Rorschach112

Posted 09 May 2008 - 03:27 PM

#25 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #25$
rlfaress

Posted 09 May 2008 - 04:06 PM

#26 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #26$
rlfaress

Posted 09 May 2008 - 04:07 PM

#27 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #27$
rlfaress

Posted 09 May 2008 - 04:26 PM

#28 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #28$
Rorschach112

Posted 09 May 2008 - 04:34 PM

#29 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #29$
rlfaress

Posted 09 May 2008 - 04:45 PM

#30 $Can't get rid of Trojan Generic3.Uns & Program Files\func: post #30$
Rorschach112

Posted 09 May 2008 - 04:49 PM