Sorry D: i deleted before you said not to... i hope it doesnt effect it much
06/29/2008 22:50
Scan of all local drives
File C:\System Volume Information\_restore{FF2F2071-FA9A-4418-B833-F9E85D88AAA1}\RP34\A0008600.dll is infected by Win32:Vapsup-EB [Adw], Deleted
Number of searched folders: 6587
Number of tested files: 57815
Number of infected files: 1
----------------------------------------
Deckard's System Scanner v20071014.68
Run by Saki on 2008-06-29 23:41:59
Computer is in Normal Mode.
--------------------------------------------------------------------------------
-- HijackThis (run as Saki.exe) ------------------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:42:08 PM, on 6/29/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16674)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\VentSrv\ventrilo_svc.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\VentSrv\ventrilo_srv.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Saki.1DCGCC1\Desktop\dss.exe
C:\PROGRA~1\TRENDM~1\HIJACK~1\Saki.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =
http://go.microsoft....k/?LinkId=54896R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft....k/?LinkId=69157R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
http://www.zpecialof...om/indexie.htmlR3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
R3 - URLSearchHook: (no name) - {12F02779-6D88-4958-8AD3-83C12D86ADC7} - (no file)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Reactivator Class - {6C31790D-1EDF-4b05-83DC-925B3A8E2318} - C:\Program Files\FreeShield Toolbar\elertz.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: Free Shield Toolbar - {0C6DD65A-F36B-4ac8-89EB-6175AEE6BB8C} - C:\Program Files\FreeShield Toolbar\elertz.dll
O3 - Toolbar: Veoh Browser Plug-in - {D0943516-5076-4020-A3B5-AEFAF26AB263} - C:\Program Files\Veoh Networks\Veoh\Plugins\reg\VeohToolbar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [DLCFCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCFtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Yahoo! Pager] "C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.EXE" -quiet
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites -
http://favorites.liv...m/quickadd.aspxO9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
http://go.microsoft....k/?linkid=39204O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) -
http://messenger.zon...kr.cab56986.cabO16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5C051655-FCD5-4969-9182-770EA5AA5565} (Solitaire Showdown Class) -
http://messenger.zon...wn.cab56986.cabO16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) -
http://messenger.zon...1/GAME_UNO1.cabO16 - DPF: {A1D886C6-4039-4451-97A9-515F5BE5D4C2} (mkdplusCtrl Class) -
http://ahnlabdownloa...cab/mkdplus.cabO16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) -
http://messenger.zon...nt.cab56907.cabO16 - DPF: {F04A8AE2-A59D-11D2-8792-00C04F8EF29D} (Hotmail Attachments Control) -
http://by130fd.bay13...ex/HMAtchmt.ocxO23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: dlcf_device - - C:\WINDOWS\system32\dlcfcoms.exe
O23 - Service: LVCOMSer - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
O23 - Service: Process Monitor (LVPrcSrv) - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
O23 - Service: LVSrvLauncher - Logitech Inc. - C:\Program Files\Common Files\LogiShrd\SrvLnch\SrvLnch.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Ventrilo - Unknown owner - C:\Program Files\VentSrv\ventrilo_svc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
--
End of file - 7333 bytes
-- Files created between 2008-05-29 and 2008-06-29 -----------------------------
2008-06-29 23:35:42 0 dr-h----- C:\Documents and Settings\Saki.1DCGCC1\Recent
2008-06-29 22:49:14 0 d-------- C:\Program Files\Alwil Software
2008-06-29 16:37:58 0 d-------- C:\Program Files\Windows Live Toolbar
2008-06-29 16:37:57 0 d-------- C:\Program Files\Windows Live Favorites
2008-06-29 01:17:30 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Yahoo! Companion
2008-06-29 01:06:31 0 d-------- C:\Program Files\Amazon
2008-06-28 01:31:55 0 d-------- C:\Program Files\Trend Micro
2008-06-27 23:21:19 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\ADSL Software Ltd
2008-06-27 23:09:45 0 d-------- C:\Documents and Settings\Saki.1DCGCC1\Application Data\zweitgeist
2008-06-27 22:35:41 0 d-------- C:\ckis
2008-06-27 22:09:30 96966 --a------ C:\WINDOWS\system32\drivers\klin.dat
2008-06-27 22:09:30 88774 --a------ C:\WINDOWS\system32\drivers\klick.dat
2008-06-27 22:09:01 38688 --ahs---- C:\WINDOWS\system32\drivers\fidbox2.dat
2008-06-27 22:09:01 4200480 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
2008-06-27 22:09:01 0 d-------- C:\Documents and Settings\All Users.WINDOWS\Application Data\Kaspersky Lab
2008-06-23 23:39:49 6553600 --a------ C:\Documents and Settings\Saki.1DCGCC1\ntuser.dat
2008-06-16 11:21:55 0 d-------- C:\Program Files\MP3 WAV Converter
2008-06-13 15:47:55 0 d-------- C:\Program Files\VentSrv
2008-06-12 03:34:03 0 d-------- C:\Program Files\Microsoft Silverlight
2008-06-12 03:33:05 0 d-------- C:\WINDOWS\system32\URTTEMP
2008-06-12 03:24:32 0 d-------- C:\WINDOWS\Prefetch
2008-06-12 03:20:32 0 d-------- C:\Program Files\Messenger
2008-06-12 03:20:23 0 d-------- C:\WINDOWS\system32\scripting
2008-06-12 03:20:23 0 d-------- C:\WINDOWS\system32\en
2008-06-12 03:20:23 0 d-------- C:\WINDOWS\l2schemas
2008-06-12 03:20:22 0 d-------- C:\WINDOWS\system32\bits
2008-06-12 03:19:13 0 d-------- C:\WINDOWS\ServicePackFiles
2008-06-12 03:14:38 0 d-------- C:\WINDOWS\EHome
2008-06-12 00:47:20 0 d-------- C:\Documents and Settings\Saki.1DCGCC1\Application Data\Amazon
2008-06-01 02:37:57 0 d-------- C:\Program Files\Veoh Networks
-- Find3M Report ---------------------------------------------------------------
2008-06-29 23:21:19 0 d-------- C:\Program Files\dl_Cats
2008-06-29 03:25:09 0 d-------- C:\Program Files\Windows Live
2008-06-29 01:06:48 0 d-------- C:\Documents and Settings\Saki.1DCGCC1\Application Data\Azureus
2008-06-29 01:06:47 0 d-------- C:\Program Files\Azureus
2008-06-28 01:34:48 0 d-------- C:\Program Files\Yahoo!
2008-06-28 01:18:07 0 d-------- C:\Documents and Settings\Saki.1DCGCC1\Application Data\Mozilla
2008-06-13 16:12:24 0 d-------- C:\Documents and Settings\Saki.1DCGCC1\Application Data\Ventrilo
2008-06-13 15:47:42 0 d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-06-12 23:46:08 3500 --a----c- C:\WINDOWS\mozver.dat
2008-06-12 20:55:33 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-12 03:20:22 0 d-------- C:\Program Files\Movie Maker
2008-06-12 03:19:03 0 d-------- C:\Program Files\Windows NT
2008-06-03 00:31:28 0 d-------- C:\Program Files\Lavasoft
2008-06-01 02:39:07 0 d--h----- C:\Program Files\InstallShield Installation Information
2008-05-25 23:38:31 0 d-------- C:\Documents and Settings\Saki.1DCGCC1\Application Data\Nexon
2008-05-25 23:37:13 0 d-------- C:\Program Files\Common Files
2008-05-25 23:37:13 0 d-------- C:\Program Files\Common Files\INCA Shared
2008-05-21 04:33:49 0 d-------- C:\Program Files\CCleaner
2008-05-19 16:37:33 0 dr-h----- C:\Documents and Settings\Saki.1DCGCC1\Application Data\yahoo!
2008-05-19 15:21:08 0 d-------- C:\Program Files\MSN Messenger
2008-05-17 21:51:47 0 d-------- C:\Program Files\AIM6
2008-05-17 21:47:45 0 d-------- C:\Documents and Settings\Saki.1DCGCC1\Application Data\acccore
2008-05-17 21:46:35 0 d-------- C:\Program Files\Viewpoint
2008-05-17 21:45:58 0 d-------- C:\Program Files\Common Files\AOL
2008-05-13 21:27:41 0 d-------- C:\Documents and Settings\Saki.1DCGCC1\Application Data\Malwarebytes
2008-05-13 20:07:04 0 d-------- C:\Program Files\Java
2008-05-03 15:33:03 0 d-------- C:\Program Files\Messenger Plus! Live
2008-05-03 02:34:42 0 d-------- C:\Program Files\Windows Media Connect 2
2008-05-02 02:38:13 0 d-------- C:\Documents and Settings\Saki.1DCGCC1\Application Data\Windows Live Writer
2008-05-02 02:29:09 0 d--hs--c- C:\Program Files\Common Files\WindowsLiveInstaller
2008-04-30 11:04:49 0 d-------- C:\Documents and Settings\Saki.1DCGCC1\Application Data\LimeWire
2008-04-29 06:05:36 0 d-------- C:\Documents and Settings\Saki.1DCGCC1\Application Data\NCH Swift Sound
2008-04-29 05:59:44 0 d-------- C:\Documents and Settings\Saki.1DCGCC1\Application Data\StanaPhone
2008-04-17 16:22:18 208896 --a------ C:\WINDOWS\system32\ConTest.dll <Not Verified; Ascentive; ConnectionTester>
-- Registry Dump ---------------------------------------------------------------
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [08/23/2006 02:12 PM]
"DLCFCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCFtime.dll" [09/08/2005 11:55 AM]
"nwiz"="nwiz.exe" [08/23/2006 02:12 PM C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [08/23/2006 02:12 PM]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [02/22/2008 04:25 AM]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [05/15/2008 04:19 PM]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [04/13/2008 05:12 PM]
"Aim6"="" []
"@"="" []
"Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe" [08/30/2007 05:43 PM]
"MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [10/18/2007 11:34 AM]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ClearRecentDocsOnExit"=1 (0x1)
"NoRecentDocsMenu"=1 (0x1)
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
@="Service"
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
@="Volume shadow copy"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
"Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"AVP"="C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
"NvCplDaemon"=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
"SigmatelSysTrayApp"=stsystra.exe
"DLCFCATS"=rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\DLCFtime.dll,_RunDLLEntry@16
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
eapsvcs eaphost
dot3svc dot3svc
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
napagent
hkmsvc
-- End of Deckard's System Scanner: finished at 2008-06-29 23:44:12 ------------
And i didnt get an Extra =/
Edited by SakiKitty, 30 June 2008 - 09:49 PM.