[mbrikha]

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 7:35:30 PM, on 8/2/2008
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\AOL\1139186156\ee\AOLSoftware.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\McAfee.com\Agent\mcagent.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
c:\program files\common files\aol\1139186156\ee\AOLOpenRide.exe
C:\Program Files\Common Files\AOL\1139186156\ee\aolsoftware.exe
C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
c:\program files\common files\mcafee\mna\mcnasvc.exe
c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
C:\Program Files\McAfee\MPF\MPFSrv.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\wanmpsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - C:\Program Files\McAfee\VirusScan\scriptsn.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE NvQTwk,NvCplDaemon initialize
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded
O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1139186156\ee\AOLSoftware.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [mcagent_exe] C:\Program Files\McAfee.com\Agent\mcagent.exe /runkey
O4 - HKCU\..\Run: [NVIEW] rundll32.exe nview.dll,nViewLoadHook
O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user')
O4 - Startup: AOL OpenRide.lnk = C:\Program Files\Common Files\AOL\Launch\aollaunch.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView6\NkvMon.exe
O4 - Global Startup: officejet 6100.lnk = ?
O4 - Global Startup: Quicken Scheduled Updates.lnk = C:\Program Files\Quicken\bagent.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Related - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O9 - Extra 'Tools' menuitem: Show &Related Links - {c95fe080-8f5d-11d2-a20b-00aa003c157a} - C:\WINDOWS\web\related.htm
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky...can_unicode.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com Operating System Class) - http://download.mcaf...96/mcinsctl.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) -
O16 - DPF: {77E32299-629F-43C6-AB77-6A1E6D7663F6} (Groove Control) - http://atv.disney.go...y/OTOYAX29b.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr Class) - http://download.mcaf...,26/mcgdmgr.cab
O16 - DPF: {BDBDE413-7B1C-4C68-A8FF-C5B2B4090876} (F-Secure Online Scanner 3.3) - http://support.f-sec...m/ols/fscax.cab
O20 - AppInit_DLLs:
O23 - Service: AOL Connectivity Service (AOL ACS) - AOL LLC - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe
O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
O23 - Service: Content Monitoring Tool (msCMTSrvc) - Unknown owner - C:\WINDOWS\system32\msCMTSrvc.exe (file missing)
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: WAN Miniport (ATW) Service (WANMiniportService) - America Online, Inc. - C:\WINDOWS\wanmpsvc.exe
O24 - Desktop Component 0: (no name) - http://i21.photobuck...Grl90/black.jpg

--
End of file - 7050 bytes

[Advertisements]

also, im trying to attach the AVZ log, but it wont let me. and its too long to post

Edited by mbrikha, 02 August 2008 - 08:15 PM.

[mbrikha]

also, im trying to attach the AVZ log, but it wont let me. and its too long to post

Edited by mbrikha, 02 August 2008 - 08:15 PM.

[fenzodahl512]

also, im trying to attach the AVZ log, but it wont let me. and its too long to post

Ok.. upload the log at link below:
http://www.2shared.com/

Then, after you successfully upload it, please copy/paste the link given under Here is your download link: tab..


Please give me sometime to read your log.. How is your computer now?

[mbrikha]

my computer is doing a lot better than before ...and take all the time you need

Edited by mbrikha, 02 August 2008 - 10:32 PM.

[mbrikha]

http://www.2shared.c...a4/avz_log.html

[fenzodahl512]

Err.. I'm afraid you have posted the wrong log.. The one that I requested is virusinfo_syscheck.htm and not avzlog.txt..


Nevermind.. Lets do below:

Hello.. I'm afraid you have posted the wrong log.. Nevermind.. Lets do this instead..


Please download ATF Cleaner by Atribune.
Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.
If you use Firefox browserClick Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
If you use Opera browserClick Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.
Click Exit on the Main menu to close the program.




NEXT


Please double click on AVZ.exe to run it.
[*]Run an update by clicking the Auto Update button on the Right of the Log window:
[*]Click Start to begin the update[/list]Note: If you recieve an error message, chose a different source, then click Start again

• After the update, from the "File" menu, choose "Standard Scripts"
• Put a check next to item 2: Advanced System Investigation
• Click Execute selected scripts
• At the next prompt, click the OK button
• Let the scan run and click "OK" when the completion prompt pops up
• Now Close out of the Standard Scripts window, and exit AVZ
• Navigate to the avz4 folder and locate the folder LOG
• Inside the LOG folder you will find virusinfo_syscheck.htm and virusinfo_syscheck.zip
• Attach virusinfo_syscheck.htm to your next reply..

NEXT


Now download OTScanIt.exe to your Desktop and double-click on it to extract the files. It will create a folder named OTScanIt on your desktop.

Note: You must be logged on to the system with an account that has Administrator privileges to run this program.

• Close ALL OTHER PROGRAMS.
• Open the OTScanIt folder and double-click on OTScanIt.exe to start the program (if you are running on Vista then right-click the program and choose Run as Administrator).
• At the top, tick on Scan All Users section
• In the Processes, Services, Drivers and Registry section set on Non-Microsoft.
• In the Rootkit Search section, set to Yes
• In the Files Created Within and Files Modified Within section, set it on 30 Days
• At the bottom, tick on all Non-Microsoft Only and Include All Unicode Names option
• Under Additional Scans click the checkboxes in front of the following items to select them:
  
  • Reg - BotCheck
    Reg - ContolSets
    Reg - Security Settings
    File - Additional Folder Scans
    
• Do not change any other settings.
• Now click the Run Scan button on the toolbar.
• Let it run unhindered until it finishes.
• When the scan is complete Notepad will open with the report file loaded in it.
• Click the Format menu and make sure that Wordwrap is not checked. If it is then click on it to uncheck it.

Use the Add Reply button and Copy/Paste the information back here. I will review it when it comes in. Make sure that the first line is code with brackets around it [] and that the last line is /code with brackets around it [].

If, after posting, the last line is not <End of Report> then the log is too big to fit into a single post and you will need to split it into multiple posts or attach it as a file.



Please attach the following logs in your next reply..

1. virusinfo_syscheck.htm
2. OTScanIt log..


Regards
fenzodahl512

[mbrikha]

virusinfo_syscheck.htm log

Attached Files

•  virusinfo_syscheck.htm   223.2KB   9 downloads

[fenzodahl512]

Erm.. Your AVZ log looks very nice to me.. erm.. Lets do below...


Please show hidden files and folders. Please visit HERE if you don't know how.

• Please go to VirSCAN.org FREE on-line scan service
• Copy and paste the following file path into the "Suspicious files to scan"box on the top of the page:
  
  
  • c:\program files\common files\aol\1139186156\ee\services\search\ver2_0_39_1\injectDll.dll
• Click on the Upload button
• Once the Scan is completed, click on the "Copy to Clipboard" button. This will copy the link of the report into the Clipboard.
• Paste the contents of the Clipboard in your next reply.

If VirScan.org server is too busy, please submit the file to VirusTotal instead.



Post VirScan log and attach the requested OTScanIt2 log in your next reply.. Use the 2shared website to attach your file

[mbrikha]

VirSCAN.org Scanned Report :
Scanned time : 2008/08/05 11:53:27 (CDT)
Scanner results: All Scanners reported not find malware!
File Name : InjectDll.dll
File Size : 81920 byte
File Type : PE32 executable for MS Windows (DLL) (GUI) Intel 80386 32-bi
MD5 : ea1f2fb94df6bc57825d618b58ca3264
SHA1 : 32ceca068ab8cfda7eb27b5b2725384908d4b99c
Online report : http://virscan.org/r...24016efb2a.html

Scanner Engine Ver Sig Ver Sig Date Time Scan result
a-squared 3.5.0.22 2008.08.04 2008-08-04 2.39 -
AhnLab V3 2008.08.05.01 2008.08.05 2008-08-05 0.86 -
AntiVir 7.8.1.15 7.0.5.217 2008-08-05 2.19 -
Arcavir 1.0.5 200808051157 2008-08-05 1.20 -
AVAST! 3.0.1 080805-0 2008-08-05 0.67 -
AVG 7.5.51.442 270.5.12/1592 2008-08-05 1.52 -
BitDefender 7.60825.1415000 7.20368 2008-08-05 2.70 -
CA (VET) 9.0.0.143 31.6.6011 2008-08-05 5.13 -
ClamAV 0.93.3 7943 2008-08-05 0.02 -
Comodo 2.11 2.0.0.607 2008-08-05 0.43 -
CP Secure 1.1.0.715 2008.08.05 2008-08-05 5.92 -
Dr.Web 4.44.0.9170 2008.08.05 2008-08-05 3.08 -
ewido 4.0.0.2 2008.08.04 2008-08-04 2.31 -
F-Prot 4.4.4.56 20080804 2008-08-04 0.98 -
F-Secure 5.51.6100 2008.08.05.04 2008-08-05 2.94 -
Fortinet 2.81-3.11 9.388 2008-08-05 1.65 -
ViRobot 20080801 2008.08.01 2008-08-01 0.40 -
Ikarus T3.1.01.34 2008.08.05.71221 2008-08-05 3.18 -
JiangMin 11.0.706 2008.08.05 2008-08-05 1.42 -
Kaspersky 5.5.10 2008.08.05 2008-08-05 0.04 -
KingSoft 2008.1.14.15 2008.8.5.17 2008-08-05 0.57 -
McAfee 5.2.00 5353 2008-08-04 2.38 -
Microsoft 1.3807 2008.08.05 2008-08-05 4.02 -
mks_vir 2.01 2008.08.05 2008-08-05 2.55 -
Norman 5.93.01 5.93.00 2008-08-04 4.73 -
Panda 9.05.01 2008.08.05 2008-08-05 1.99 -
Trend Micro 8.700-1004 5.456.04 2008-08-05 0.02 -
Quick Heal 9.50 2008.08.05 2008-08-05 1.64 -
Rising 20.0 20.56.12.00 2008-08-05 0.73 -
Sophos 2.75.4 4.31 2008-08-05 2.51 -
Sunbelt 3.1.1537.1 2176 2008-08-01 0.42 -
Symantec 1.3.0.24 20080803.002 2008-08-03 0.05 -
nProtect 2008-08-05.00 1738111 2008-08-05 3.23 -
The Hacker 6.2.96 v00393 2008-08-04 0.40 -
VBA32 3.12.8.2 20080805.0822 2008-08-05 1.15 -
VirusBuster 4.5.11.10 4.5.11/ 0010-00-00 0.82 -

[mbrikha]

also, do you want me to do the second part of the last reply?

[fenzodahl512]

also, do you want me to do the second part of the last reply?

Just need the OTScanIt log

Please attach it.. And if you can't attach it, upload it at link below:
http://www.2shared.com/

Then, after you successfully upload it, please copy/paste the link given under Here is your download link: tab..

[mbrikha]

http://www.2shared.c...a/OTScanIt.html

[fenzodahl512]

Hi.. I found nothing on your OTScanIt log.. How is your computer?


Please show hidden files and folders


Then delete these two folders..

C:\Documents and Settings\Owner\Application Data\Hotbar
C:\Documents and Settings\Owner\Application Data\Viewpoint


Other than that, the OTScanIt log looks clean to me..


Just tell me about your computer condition and those two folders in your next reply..

[mbrikha]

my computer is doing really well, a lot better than before, but i cant seem to delete those two folders. when i try to go open the owner folder, it says access is denied

[fenzodahl512]

Do this then.. First, uninstall Viewpoint from your computer.. Then do below..


Please double-click OTMoveIt2.exe to run it. (Vista users, please right click on OTMoveit2.exe and select "Run as an Administrator")

• Let the Unregister Dll's and Ocx's remain ticked and Zip Files After Moves remain unticked..
• Copy the file paths below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):
  
  

  [kill explorer]
  C:\Documents and Settings\Owner\Application Data\Hotbar
  C:\Documents and Settings\Owner\Application Data\Viewpoint
  EmptyTemp
  purity
  [start explorer]

• Return to OTMoveIt2, right click in the "Paste List of Files/Folders to Move" window (under the light Yellow bar) and choose Paste.
• Click the red Moveit! button.
• A log of files and folders moved will be created in the c:\_OTMoveIt\MovedFiles folder in the form of Date and Time (mmddyyyy_hhmmss.log). Please open this log in Notepad and post its contents in your next reply.
• Close OTMoveIt2

If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.