Jump to content

Welcome to Geeks to Go - Register now for FREE

Need help with your computer or device? Want to learn new tech skills? You're in the right place!
Geeks to Go is a friendly community of tech experts who can solve any problem you have. Just create a free account and post your question. Our volunteers will reply quickly and guide you through the steps. Don't let tech troubles stop you. Join Geeks to Go now and get the support you need!

How it Works Create Account
Photo

suspected virus - Help please. [RESOLVED]

Started by brufolo , Aug 03 2008 05:52 AM

  • This topic is locked This topic is locked

#1
brufolo
Posted 03 August 2008 - 05:52 AM

brufolo

    New Member

  • Member
  • Pip
  • 5 posts
Here is my HiJackThis log. Hope somebody can help me. Thanks. :) Logfile of Trend Micro HijackThis v2.0.2



Scan saved at 13.27.17, on 03/08/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16681)
Boot mode: Normal

Running processes:
C:\Windows\system32\taskeng.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Windows\System32\DeltaIITray.exe
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
F:\Emule\emule.exe
C:\Windows\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
F:\Programmi piccoli e utili\HiJack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O4 - HKLM\..\Run: [AVP] "C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe"
O4 - HKLM\..\Run: [DeltaIITaskbarApp] C:\Windows\system32\DeltaIITray.exe
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKCU\..\Run: [\WinBF58.exe] C:\Windows\system32\WinBF58.exe
O4 - HKCU\..\Run: [\WinC003.exe] C:\Windows\system32\WinC003.exe
O4 - HKCU\..\Run: [\WinC0AF.exe] C:\Windows\system32\WinC0AF.exe
O4 - HKCU\..\Run: [\WinC254.exe] C:\Windows\system32\WinC254.exe
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVIZIO DI RETE')
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O17 - HKLM\System\CCS\Services\Tcpip\..\{E580B69D-99F8-49A9-8F0D-61455C42CA8A}: NameServer = 88.149.128.12,88.149.128.22
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\r3hook.dll,C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: Acronis Try And Decide Service (TryAndDecideService) - Unknown owner - C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe

--
End of file - 3597 bytes
  • 0

Advertisements

#2
Thunderbird1988
Posted 04 August 2008 - 04:33 AM

Thunderbird1988

    Member 2k

  • Member
  • PipPipPipPipPip
  • 2,416 posts
Hello Brufolo and welcome at Geekstogo,

Please visit this web page for instructions for downloading and running ComboFix

http://www.bleepingc...to-use-combofix

This includes installing the Windows XP Recovery Console in case you have not installed it yet.

For more information on the Windows XP Recovery Console read http://support.microsoft.com/kb/314058.

Once you install the Recovery Console, when you reboot your computer, you'll see the option for the Recovery Console now as well. Don't select Recovery Console as we don't need it. By default, your main OS is selected there. The screen stays for 2 seconds and then it proceeds to load Windows. That is normal.

Post the log from ComboFix when you've accomplished that, along with a new HijackThis log.

Thunderbird1988
  • 0

#3
brufolo
Posted 05 August 2008 - 01:11 AM

brufolo

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts
Many thanks for the reply. I post the two logs you've request:



ComboFix 08-08-04.01 - maurizio 2008-08-05 8.47.51.1 - NTFSx86
Microsoft® Windows Vista™ Ultimate 6.0.6000.0.1252.1.1040.18.1409 [GMT 2:00]
Eseguito da: C:\Users\maurizio\Downloads\ComboFix.exe
* Creato nuovo punto di ripristino
.

((((((((((((((((((((((((((((((((((((( Altre eliminazioni )))))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\ProgramData\Microsoft\Network\Downloader\qmgr0.dat
C:\ProgramData\Microsoft\Network\Downloader\qmgr1.dat
C:\Windows\eqvwamkl.dll
C:\Windows\etfl.exe
C:\Windows\fdkowvbp.dll
C:\Windows\grswptdl.exe
C:\Windows\wnslvxtf.dll

----- BITS: Sites possivelmente infetados -----

http://pornotube8.net
.
((((((((((((((((((((((((( Files Creati Da 2008-07-05 al 2008-08-05 )))))))))))))))))))))))))))))))))))
.

2008-08-04 21:06 . 2008-06-19 17:24 28,544 --a------ C:\Windows\System32\drivers\pavboot.sys
2008-08-04 21:05 . 2008-08-04 21:05 <DIR> d-------- C:\Program Files\Panda Security
2008-08-04 19:56 . 2008-08-04 20:21 <DIR> d-------- C:\Windows\BDOSCAN8
2008-08-04 19:44 . 2008-08-04 19:44 <DIR> d-------- C:\Program Files\Java
2008-08-04 19:42 . 2008-08-04 19:42 <DIR> d-------- C:\Program Files\Common Files\Java
2008-08-04 18:52 . 2006-10-13 00:00 61,952 --a------ C:\Windows\System32\escwiad.dll
2008-08-04 18:51 . 2006-08-10 02:02 75,264 --a------ C:\Windows\System32\E_FLBBEE.DLL
2008-08-04 18:51 . 2006-04-19 02:00 62,976 --a------ C:\Windows\System32\E_FD4BBEE.DLL
2008-08-04 18:51 . 2004-09-10 20:12 49,152 --a------ C:\Windows\System32\E_DCINST.DLL
2008-08-04 18:50 . 2008-08-04 18:51 <DIR> d-------- C:\Users\All Users\EPSON
2008-08-04 18:50 . 2008-08-04 18:51 <DIR> d-------- C:\ProgramData\EPSON
2008-08-04 18:50 . 2008-08-04 18:52 <DIR> d-------- C:\Program Files\EPSON
2008-08-03 14:07 . 2008-08-03 14:07 <DIR> d-------- C:\Windows\System32\Macromed
2008-08-02 22:57 . 2008-08-02 22:57 1,885,464 --a------ C:\Windows\System32\AutoPartNt.exe
2008-08-02 22:57 . 2008-08-02 22:58 1,024 --a------ C:\Windows\System32\AutoPartNt.let
2008-08-02 22:41 . 2008-08-02 22:41 <DIR> d-------- C:\Users\All Users\Acronis
2008-08-02 22:41 . 2008-08-02 22:41 <DIR> d-------- C:\ProgramData\Acronis
2008-08-02 22:41 . 2008-08-02 22:41 441,760 --a------ C:\Windows\System32\drivers\timntr.sys
2008-08-02 22:41 . 2008-08-02 22:41 44,384 --a------ C:\Windows\System32\drivers\tifsfilt.sys
2008-08-02 22:40 . 2008-08-02 22:40 <DIR> d-------- C:\Program Files\Common Files\Acronis
2008-08-02 22:40 . 2008-08-02 22:40 <DIR> d-------- C:\Program Files\Acronis
2008-08-02 22:40 . 2008-08-02 22:40 368,480 --a------ C:\Windows\System32\drivers\tdrpman.sys
2008-08-02 22:40 . 2008-08-02 22:40 132,224 --a------ C:\Windows\System32\drivers\snapman.sys
2008-08-02 19:24 . 2000-05-22 00:00 608,448 --a------ C:\Windows\System32\COMCTL32.OCX
2008-08-02 19:24 . 2000-10-10 10:01 162,816 --a------ C:\Windows\System32\MSCOMM32.OCX
2008-08-02 19:23 . 1999-03-23 09:12 299,520 --a------ C:\Windows\uninst.exe
2008-08-02 17:53 . 2008-08-02 17:53 <DIR> d-------- C:\Windows\PCHEALTH
2008-08-02 17:53 . 2008-08-02 17:53 <DIR> d-------- C:\Program Files\Microsoft.NET
2008-08-02 17:53 . 2008-08-02 17:53 <DIR> d-------- C:\Program Files\Microsoft Works
2008-08-02 17:50 . 2008-08-02 17:54 <DIR> d-------- C:\Users\All Users\Microsoft Help
2008-08-02 17:50 . 2008-08-02 17:54 <DIR> d-------- C:\ProgramData\Microsoft Help
2008-08-02 17:49 . 2008-08-02 17:49 <DIR> dr-h----- C:\MSOCache
2008-08-02 15:53 . 2008-08-02 15:54 <DIR> d-------- C:\Program Files\Unlocker
2008-08-02 13:55 . 2008-08-02 16:27 <DIR> d-------- C:\Users\maurizio\AppData\Roaming\uTorrent
2008-08-02 13:55 . 2008-08-02 13:55 <DIR> d-------- C:\Program Files\uTorrent
2008-08-02 10:04 . 2006-11-10 16:03 615,424 --a------ C:\Windows\System32\themeui.dll
2008-08-02 10:04 . 2006-11-10 16:05 240,640 --a------ C:\Windows\System32\uxtheme.dll
2008-08-01 23:10 . 2008-08-01 23:10 <DIR> d-------- C:\Program Files\Stardock
2008-08-01 23:10 . 2008-08-01 23:10 <DIR> d-------- C:\Program Files\Common Files\Stardock
2008-08-01 22:57 . 2008-08-01 22:57 <DIR> d-------- C:\Users\maurizio\AppData\Roaming\TuneUp Software
2008-08-01 22:57 . 2008-08-01 22:57 355,584 --a------ C:\Windows\System32\TuneUpDefragService.exe
2008-08-01 22:57 . 2008-05-29 09:28 28,416 --a------ C:\Windows\System32\uxtuneup.dll
2008-08-01 22:57 . 2008-05-29 09:28 16,640 --a------ C:\Windows\System32\authuitu.dll
2008-08-01 22:56 . 2008-08-01 22:56 <DIR> d-------- C:\Users\All Users\TuneUp Software
2008-08-01 22:56 . 2008-08-01 22:56 <DIR> d-------- C:\ProgramData\TuneUp Software
2008-08-01 22:56 . 2008-08-01 22:56 <DIR> d-------- C:\Program Files\TuneUp Utilities 2008
2008-08-01 22:55 . 2008-08-01 22:55 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-08-01 22:50 . 2008-08-01 22:50 <DIR> d-------- C:\Users\maurizio\AppData\Roaming\URSoft
2008-08-01 22:50 . 2008-08-02 22:14 <DIR> d-a------ C:\Users\All Users\TEMP
2008-08-01 22:50 . 2008-08-02 22:14 <DIR> d-a------ C:\ProgramData\TEMP
2008-08-01 22:50 . 2008-08-01 22:50 <DIR> d-------- C:\Program Files\Your Uninstaller 2008
2008-08-01 22:05 . 2008-08-01 22:25 <DIR> d-------- C:\Users\maurizio\AppData\Roaming\Winamp
2008-08-01 22:05 . 2008-08-01 22:47 <DIR> d-------- C:\Program Files\Winamp
2008-08-01 22:05 . 2007-03-08 01:51 129,784 --------- C:\Windows\System32\pxafs.dll
2008-08-01 21:26 . 2008-08-01 21:26 <DIR> d-------- C:\Users\maurizio\AppData\Roaming\vlc
2008-08-01 21:24 . 2008-08-01 21:24 <DIR> d-------- C:\Program Files\VideoLAN
2008-08-01 15:52 . 2008-08-01 15:52 <DIR> d-------- C:\Users\All Users\eMule
2008-08-01 15:52 . 2008-08-01 15:52 <DIR> d-------- C:\ProgramData\eMule
2008-08-01 15:01 . 2008-08-01 15:01 1,244,672 --a------ C:\Windows\System32\mcmde.dll
2008-08-01 15:01 . 2008-08-01 15:01 428,032 --a------ C:\Windows\System32\EncDec.dll
2008-08-01 15:01 . 2008-08-01 15:01 292,352 --a------ C:\Windows\System32\psisdecd.dll
2008-08-01 15:01 . 2008-08-01 15:01 218,624 --a------ C:\Windows\System32\psisrndr.ax
2008-08-01 15:01 . 2008-08-01 15:01 80,896 --a------ C:\Windows\System32\MSNP.ax
2008-08-01 15:01 . 2008-08-01 15:01 68,608 --a------ C:\Windows\System32\Mpeg2Data.ax
2008-08-01 15:01 . 2008-08-01 15:01 57,856 --a------ C:\Windows\System32\MSDvbNP.ax
2008-08-01 14:58 . 2008-08-01 14:58 224,768 --a------ C:\Windows\System32\drivers\usbport.sys
2008-08-01 14:58 . 2008-08-01 14:58 192,000 --a------ C:\Windows\System32\drivers\usbhub.sys
2008-08-01 14:58 . 2008-08-01 14:58 73,216 --a------ C:\Windows\System32\drivers\usbccgp.sys
2008-08-01 14:58 . 2008-08-01 14:58 38,400 --a------ C:\Windows\System32\drivers\usbehci.sys
2008-08-01 14:58 . 2008-08-01 14:58 23,040 --a------ C:\Windows\System32\drivers\usbuhci.sys
2008-08-01 14:58 . 2008-08-01 14:58 8,704 --a------ C:\Windows\System32\hcrstco.dll
2008-08-01 14:58 . 2008-08-01 14:58 8,704 --a------ C:\Windows\System32\hccoin.dll
2008-08-01 14:58 . 2008-08-01 14:58 5,888 --a------ C:\Windows\System32\drivers\usbd.sys
2008-08-01 14:38 . 2008-08-01 14:38 2,923,520 --a------ C:\Windows\explorer.exe
2008-08-01 14:37 . 2008-08-01 14:37 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
2008-08-01 14:37 . 2008-03-03 10:13 2,513,432 --a------ C:\Windows\System32\pcifmdio.dll
2008-08-01 14:37 . 2008-03-03 10:13 739,848 --a------ C:\Windows\System32\DeltaIICpl.exe
2008-08-01 14:37 . 2008-03-03 10:13 302,728 --a------ C:\Windows\System32\drivers\deltaII.sys
2008-08-01 14:37 . 2008-03-03 10:13 236,040 --a------ C:\Windows\System32\DeltaIITray.exe
2008-08-01 14:37 . 2008-08-01 14:37 194,560 --a------ C:\Windows\System32\WebClnt.dll
2008-08-01 14:37 . 2008-08-01 14:37 110,080 --a------ C:\Windows\System32\drivers\mrxdav.sys
2008-08-01 14:37 . 2008-03-03 10:13 26,632 --a------ C:\Windows\System32\DeltaII.cpl
2008-08-01 14:37 . 2008-03-03 10:13 25,096 --a------ C:\Windows\System32\deltaIIasio.dll
2008-08-01 14:37 . 2008-03-03 10:13 21,000 --a------ C:\Windows\System32\DeltaIIpnl.dll
2008-08-01 14:37 . 2008-03-03 10:13 12,296 --a------ C:\Windows\System32\deltaIICoIn.dll
2008-08-01 14:36 . 2008-08-01 14:36 <DIR> d-------- C:\Users\maurizio\AppData\Roaming\InstallShield
2008-08-01 14:36 . 2008-08-01 14:36 <DIR> d-------- C:\Program Files\M-Audio
2008-08-01 14:36 . 2008-08-01 14:36 376,320 --a------ C:\Windows\System32\winsrv.dll
2008-08-01 14:36 . 2008-08-01 14:36 49,664 --a------ C:\Windows\System32\csrsrv.dll
2008-08-01 14:34 . 2008-08-01 14:34 1,060,920 --a------ C:\Windows\System32\drivers\ntfs.sys
2008-08-01 14:34 . 2008-08-01 14:34 41,984 --a------ C:\Windows\System32\drivers\monitor.sys
2008-08-01 14:33 . 2008-08-01 14:33 414,208 --a------ C:\Windows\System32\msscp.dll
2008-08-01 14:33 . 2008-08-01 14:33 374,456 --a------ C:\Windows\System32\mcupdate_GenuineIntel.dll
2008-08-01 14:31 . 2008-08-01 14:31 3,504,696 --a------ C:\Windows\System32\ntkrnlpa.exe
2008-08-01 14:31 . 2008-08-01 14:31 3,470,392 --a------ C:\Windows\System32\ntoskrnl.exe
2008-08-01 14:31 . 2008-08-01 14:31 21,560 --a------ C:\Windows\System32\drivers\atapi.sys
2008-08-01 14:30 . 2008-08-01 14:30 1,191,936 --a------ C:\Windows\System32\msxml3.dll
2008-08-01 14:30 . 2008-08-01 14:30 211,000 --a------ C:\Windows\System32\drivers\volsnap.sys
2008-08-01 14:30 . 2008-08-01 14:30 154,624 --a------ C:\Windows\System32\drivers\nwifi.sys
2008-08-01 14:30 . 2008-08-01 14:30 109,624 --a------ C:\Windows\System32\drivers\ataport.sys
2008-08-01 14:30 . 2008-08-01 14:30 104,448 --a------ C:\Windows\System32\DWWIN.EXE
2008-08-01 14:30 . 2008-08-01 14:30 45,112 --a------ C:\Windows\System32\drivers\pciidex.sys
2008-08-01 14:30 . 2008-08-01 14:30 17,464 --a------ C:\Windows\System32\drivers\intelide.sys
2008-08-01 14:30 . 2008-08-01 14:30 15,928 --a------ C:\Windows\System32\drivers\pciide.sys
2008-08-01 14:30 . 2008-08-01 14:30 2,048 --a------ C:\Windows\System32\msxml3r.dll
2008-08-01 14:29 . 2008-08-01 14:29 803,328 --a------ C:\Windows\System32\drivers\tcpip.sys
2008-08-01 14:29 . 2008-08-01 14:29 337,408 --a------ C:\Windows\System32\intl.cpl
2008-08-01 14:29 . 2008-08-01 14:29 216,632 --a------ C:\Windows\System32\drivers\netio.sys
2008-08-01 14:29 . 2008-08-01 14:29 167,424 --a------ C:\Windows\System32\tcpipcfg.dll
2008-08-01 14:29 . 2008-08-01 14:29 166,912 --a------ C:\Windows\System32\lpksetup.exe
2008-08-01 14:29 . 2008-08-01 14:29 25,600 --a------ C:\Windows\System32\LangCleanupSysprepAction.dll
2008-08-01 14:29 . 2008-08-01 14:29 24,064 --a------ C:\Windows\System32\netcfg.exe
2008-08-01 14:29 . 2008-08-01 14:29 23,552 --a------ C:\Windows\System32\lpremove.exe
2008-08-01 14:29 . 2008-08-01 14:29 22,016 --a------ C:\Windows\System32\netiougc.exe
2008-08-01 14:29 . 2008-08-01 14:29 10,240 --a------ C:\Windows\System32\MUILanguageCleanup.dll
2008-08-01 14:26 . 2008-08-01 14:26 2,027,008 --a------ C:\Windows\System32\win32k.sys
2008-08-01 14:26 . 2008-08-01 14:26 223,232 --a------ C:\Windows\System32\WMASF.DLL
2008-08-01 14:26 . 2008-08-01 14:26 9,728 --a------ C:\Windows\System32\LAPRXY.DLL
2008-08-01 14:26 . 2008-08-01 14:26 2,048 --a------ C:\Windows\System32\asferror.dll
2008-08-01 14:25 . 2008-08-01 14:25 2,605,568 --a------ C:\Windows\System32\SLsvc.exe
2008-08-01 14:25 . 2008-08-01 14:25 566,784 --a------ C:\Windows\System32\SLCommDlg.dll
2008-08-01 14:25 . 2008-08-01 14:25 351,232 --a------ C:\Windows\System32\SLUI.exe
2008-08-01 14:25 . 2008-08-01 14:25 296,448 --a------ C:\Windows\System32\gdi32.dll
2008-08-01 14:25 . 2008-08-01 14:25 268,288 --a------ C:\Windows\System32\mcbuilder.exe
2008-08-01 14:25 . 2008-08-01 14:25 223,232 --a------ C:\Windows\System32\SLC.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-08-02 13:03 54,784 ----a-w C:\Windows\system32\drivers\i8042prt.sys
2008-08-02 13:03 495,160 ----a-w C:\Windows\system32\drivers\Wdf01000.sys
2008-08-02 13:03 35,384 ----a-w C:\Windows\system32\drivers\WdfLdr.sys
2008-08-02 13:03 35,384 ----a-w C:\Windows\system32\drivers\kbdclass.sys
2008-08-02 13:03 34,360 ----a-w C:\Windows\system32\drivers\mouclass.sys
2008-08-02 13:03 19,968 ----a-w C:\Windows\system32\drivers\sermouse.sys
2008-08-01 12:57 --------- d-----w C:\Program Files\Microsoft Games
2008-08-01 12:46 174 --sha-w C:\Program Files\desktop.ini
2008-08-01 12:41 --------- d-----w C:\Program Files\Windows Sidebar
2008-08-01 12:41 --------- d-----w C:\Program Files\Windows Mail
2008-08-01 12:41 --------- d-----w C:\Program Files\Windows Defender
2008-08-01 12:41 --------- d-----w C:\Program Files\Windows Calendar
2008-08-01 12:39 70,144 ----a-w C:\Windows\system32\drivers\pacer.sys
2008-08-01 12:39 619,008 ----a-w C:\Windows\system32\drivers\dxgkrnl.sys
2008-08-01 12:39 61,952 ----a-w C:\Windows\system32\drivers\wanarp.sys
2008-08-01 12:39 48,640 ----a-w C:\Windows\system32\drivers\ndproxy.sys
2008-08-01 12:39 20,480 ----a-w C:\Windows\system32\drivers\ndistapi.sys
2008-08-01 12:38 258,232 ----a-w C:\Windows\system32\drivers\acpi.sys
2008-08-01 12:32 63,488 ----a-w C:\Windows\system32\drivers\mpsdrv.sys
2008-08-01 12:32 23,040 ----a-w C:\Windows\system32\drivers\tunnel.sys
2008-08-01 12:32 15,360 ----a-w C:\Windows\system32\drivers\TUNMP.SYS
2008-08-01 12:24 320,000 ----a-w C:\Windows\system32\drivers\csc.sys
2008-08-01 12:22 537,600 ----a-w C:\Windows\AppPatch\AcLayers.dll
2008-08-01 12:22 449,536 ----a-w C:\Windows\AppPatch\AcSpecfc.dll
2008-08-01 12:22 2,560 ----a-w C:\Windows\AppPatch\AcRes.dll
2008-08-01 12:22 2,144,256 ----a-w C:\Windows\AppPatch\AcGenral.dll
2008-08-01 12:22 173,056 ----a-w C:\Windows\AppPatch\AcXtrnal.dll
2008-08-01 12:19 52,736 ----a-w C:\Windows\AppPatch\iebrshim.dll
2008-07-31 22:03 112,144 ----a-w C:\Windows\system32\drivers\kl1.sys
2008-07-31 21:31 --------- d-sh--w C:\ProgramData\Preferiti
2008-07-31 21:31 --------- d-sh--w C:\ProgramData\Modelli
2008-07-31 21:31 --------- d-sh--w C:\ProgramData\Menu Avvio
2008-07-31 21:31 --------- d-sh--w C:\ProgramData\Documenti
2008-07-31 21:31 --------- d-sh--w C:\ProgramData\Dati applicazioni
2008-07-31 21:31 --------- d-sh--w C:\Program Files\File comuni
.

((((((((((((((((((((((((((((((((((((( Punti Reg Caricati ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Nota* i valori vuoti & legittimi/default non sono visualizzati.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"EPSON Stylus DX4000 Series"="C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE" [2006-09-21 04:01 139264]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DeltaIITaskbarApp"="C:\Windows\system32\DeltaIITray.exe" [2008-03-03 10:13 236040]
"TrueImageMonitor.exe"="C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe" [2008-04-09 20:11 2595792]
"AcronisTimounterMonitor"="C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe" [2008-04-09 20:23 909208]
"Acronis Scheduler2 Service"="C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe" [2008-04-09 20:14 136472]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 04:27 144784]

C:\Users\maurizio\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Stardock ObjectDock.lnk - C:\Program Files\Stardock\ObjectDock\ObjectDock.exe [2008-08-02 08:19:34 3581680]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=C:\PROGRA~1\KASPER~1\KASPER~1.0\r3hook.dll,C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 relog_ap

[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\DomainProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\FirewallRules]
"{BDB70D27-2DF3-434F-B5D1-5427836EB5EA}"= UDP:C:\Windows\System32\mpxa.exe:mpxa
"{F3E87E1B-0BEA-4ED4-BF29-7CEFBB015F91}"= TCP:C:\Windows\System32\mpxa.exe:mpxa
"{CA328AB9-9EFF-409D-9884-03A0B2290CE2}"= TCP:6004|C:\Program Files\Microsoft Office\Office12\outlook.exe:Microsoft Office Outlook

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\PublicProfile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\RestrictedServices\Static\System]
"DFSR-1"= RPort=5722|UDP:%SystemRoot%\system32\svchost.exe|Svc=DFSR:Allow inbound TCP traffic|

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\StandardProfile]
"EnableFirewall"= 0 (0x0)

R0 pavboot;pavboot;C:\Windows\system32\drivers\pavboot.sys [2008-06-19 17:24]
R0 tdrpman;Acronis Try&Decide and Restore Points filter;C:\Windows\system32\DRIVERS\tdrpman.sys [2008-08-02 22:40]
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;C:\Windows\system32\DRIVERS\klim6.sys [2007-04-04 14:59]
R2 TryAndDecideService;Acronis Try And Decide Service;C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe [2008-04-09 21:42]
R2 UxTuneUp;TuneUp Theme Extension;C:\Windows\System32\svchost.exe [2006-11-02 11:45]
R3 DELTAII;Service for M-Audio Delta Driver (WDM);C:\Windows\system32\DRIVERS\deltaII.sys [2008-03-03 10:13]
R3 yukonwlh;Driver Miniport NDIS6.0 per controller Marvell Yukon Ethernet;C:\Windows\system32\DRIVERS\yk60x86.sys [2006-11-02 09:30]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\Windows\System32\TuneUpDefragService.exe [2008-08-01 22:57]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

*Newly Created Service* - PAVBOOT

[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{7070D8E0-650A-46b3-B03C-9497582E6A74}]
%SystemRoot%\system32\soundschemes.exe /AddRegistration
.
Contenuto della cartella 'Scheduled Tasks'

2008-08-05 C:\Windows\Tasks\Verifica e correzione automatica.job
- C:\Program Files\TuneUp Utilities 2008\OneClickStarter.exe [2008-06-20 09:27]
.
- - - - ORFÇOS REMOVIDOS - - - -

ShellExecuteHooks-{9160B539-1B91-409A-98BA-985C2349FEEB} - C:\Windows\system32\gebyAtqq.dll


.
------- Supplementary Scan -------
.
FireFox -: Profile - C:\Users\maurizio\AppData\Roaming\Mozilla\Firefox\Profiles\ozah354s.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.it/


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-08-05 08:50:51
Windows 6.0.6000 NTFS

scansione processi nascosti ...

scansione entrate autostart nascoste ...

Scansione files nascosti ...

Scansione completata con successo
Files nascosti: 0

**************************************************************************
.
--------------------- DLLs Carregadas Sob os Processos em Execu‡Æo ---------------------

PROCESS: C:\Windows\Explorer.exe
-> C:\Program Files\Stardock\ObjectDock\DockShellHook.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Windows\System32\audiodg.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Windows\System32\WUDFHost.exe
C:\Windows\System32\conime.exe
C:\Windows\System32\dllhost.exe
.
**************************************************************************
.
Ora fine scansione: 2008-08-05 8:52:31 - machine was rebooted
ComboFix-quarantined-files.txt 2008-08-05 06:52:21

Pre-Run: 119,299,469,312 byte disponibili
Post-Run: 119,112,245,248 byte disponibili

271 --- E O F --- 2008-08-03 13:03:31



===========================================================================



Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9.04.03, on 05/08/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16681)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\conime.exe
C:\Windows\System32\DeltaIITray.exe
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Windows\Explorer.exe
C:\Windows\system32\notepad.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Internet Explorer\ieuser.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\taskeng.exe
F:\Programmi piccoli e utili\HiJack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [DeltaIITaskbarApp] C:\Windows\system32\DeltaIITray.exe
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [EPSON Stylus DX4000 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "C:\Windows\TEMP\E_S5485.tmp" /EF "HKCU"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVIZIO DI RETE')
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitd...can8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.m...ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E580B69D-99F8-49A9-8F0D-61455C42CA8A}: NameServer = 88.149.128.12,88.149.128.22
O17 - HKLM\System\CS1\Services\Tcpip\..\{E580B69D-99F8-49A9-8F0D-61455C42CA8A}: NameServer = 88.149.128.12,88.149.128.22
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\r3hook.dll,C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: Acronis Try And Decide Service (TryAndDecideService) - Unknown owner - C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe

--
End of file - 4951 bytes
  • 0

#4
Thunderbird1988
Posted 05 August 2008 - 02:18 AM

Thunderbird1988

    Member 2k

  • Member
  • PipPipPipPipPip
  • 2,416 posts
Hello brufolo,

I strongly recommand you to uninstall emule en utorrent. These programs are P2P programs. The problem with this kind of software is that the use of it can cause infections easily. Also the use of it is illegal in many countries due to copyrightinfrigments.

Please download Malwarebytes' Anti-Malware from Here or Here

Double Click mbam-setup.exe to install the application.
  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
  • Copy&Paste the entire report and a new Hijackthislog in your next reply.
Extra Note:
If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediatly.

Thunderbird1988
  • 0

#5
brufolo
Posted 05 August 2008 - 03:07 AM

brufolo

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts
Hi Thunderbird1988

These are the logs :



Malwarebytes' Anti-Malware 1.24
Versione del database: 1026
Windows 6.0.6000

11.01.16 05/08/2008
mbam-log-8-5-2008 (11-01-16).txt

Tipo di scansione: Scansione rapida
Elementi scansionati: 34427
Tempo trascorso: 1 minute(s), 43 second(s)

Processi delle memoria infetti: 0
Moduli della memoria infetti: 0
Chiavi di registro infette: 1
Valori di registro infetti: 0
Elementi dato del registro infetti: 0
Cartelle infette: 0
File infetti: 0

Processi delle memoria infetti:
(Nessun elemento malevolo rilevato)










Moduli della memoria infetti:
(Nessun elemento malevolo rilevato)

Chiavi di registro infette:
HKEY_CLASSES_ROOT\fdkowvbp.bmtk (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Valori di registro infetti:
(Nessun elemento malevolo rilevato)

Elementi dato del registro infetti:
(Nessun elemento malevolo rilevato)

Cartelle infette:
(Nessun elemento malevolo rilevato)

File infetti:
(Nessun elemento malevolo rilevato)

=============================================================


HJT

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11.05.23, on 05/08/2008
Platform: Windows Vista (WinNT 6.00.1904)
MSIE: Internet Explorer v7.00 (7.00.6000.16681)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\system32\taskeng.exe
C:\Windows\system32\conime.exe
C:\Windows\System32\DeltaIITray.exe
C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe
C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Windows\Explorer.exe
C:\Windows\system32\notepad.exe
C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Windows\system32\NOTEPAD.EXE
C:\Windows\System32\mobsync.exe
F:\Emule\emule.exe
C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe
C:\Windows\system32\NOTEPAD.EXE
F:\Programmi piccoli e utili\HiJack This\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.it/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft....k/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft....k/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft....k/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll
O4 - HKLM\..\Run: [DeltaIITaskbarApp] C:\Windows\system32\DeltaIITray.exe
O4 - HKLM\..\Run: [TrueImageMonitor.exe] C:\Program Files\Acronis\TrueImageHome\TrueImageMonitor.exe
O4 - HKLM\..\Run: [AcronisTimounterMonitor] C:\Program Files\Acronis\TrueImageHome\TimounterMonitor.exe
O4 - HKLM\..\Run: [Acronis Scheduler2 Service] "C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe"
O4 - HKCU\..\Run: [EPSON Stylus DX4000 Series] C:\Windows\system32\spool\DRIVERS\W32X86\3\E_FATIBEE.EXE /FU "C:\Windows\TEMP\E_S5485.tmp" /EF "HKCU"
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'SERVIZIO LOCALE')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'SERVIZIO DI RETE')
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\PROGRA~1\Java\JRE16~1.0_0\bin\ssv.dll
O9 - Extra button: Web Anti-Virus - {1F460357-8A94-4D71-9CA3-AA4ACF32ED8E} - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\SCIEPlgn.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\Windows\bdoscandel.exe
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O13 - Gopher Prefix:
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitd...can8/oscan8.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.syma...n/bin/cabsa.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.m...ash/swflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E580B69D-99F8-49A9-8F0D-61455C42CA8A}: NameServer = 88.149.128.12,88.149.128.22
O17 - HKLM\System\CS1\Services\Tcpip\..\{E580B69D-99F8-49A9-8F0D-61455C42CA8A}: NameServer = 88.149.128.12,88.149.128.22
O20 - AppInit_DLLs: C:\PROGRA~1\KASPER~1\KASPER~1.0\r3hook.dll,C:\PROGRA~1\KASPER~1\KASPER~1.0\adialhk.dll,
O23 - Service: Acronis Scheduler2 Service (AcrSch2Svc) - Acronis - C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe
O23 - Service: Kaspersky Internet Security 7.0 (AVP) - Kaspersky Lab - C:\Program Files\Kaspersky Lab\Kaspersky Internet Security 7.0\avp.exe
O23 - Service: Acronis Try And Decide Service (TryAndDecideService) - Unknown owner - C:\Program Files\Common Files\Acronis\Fomatik\TrueImageTryStartService.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe

--
End of file - 5046 bytes
  • 0

#6
Thunderbird1988
Posted 05 August 2008 - 11:43 AM

Thunderbird1988

    Member 2k

  • Member
  • PipPipPipPipPip
  • 2,416 posts
Hello brufolo,

Your logs seems to be clean now. How is it running?

Thunderbird1988
  • 0

#7
brufolo
Posted 05 August 2008 - 03:21 PM

brufolo

    New Member

  • Topic Starter
  • Member
  • Pip
  • 5 posts
Everythings work like a charm now. Thanks a lot Thunder. :)
  • 0

#8
Thunderbird1988
Posted 06 August 2008 - 06:23 AM

Thunderbird1988

    Member 2k

  • Member
  • PipPipPipPipPip
  • 2,416 posts
Hello brufolo,

Follow these steps to uninstall Combofix and tools used in the removal of malware
  • Click START then RUN
  • Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
    Posted Image

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
  • Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable and re-enable system restore to make sure there are no infected files found in a restore point.

    You can find instructions on how to enable and reenable system restore here:

    Managing Windows Millenium System Restore

    or

    Windows XP System Restore Guide

    Reenable system restore with instructions from tutorial above

  • Make your Internet Explorer more secure - This can be done by following these simple instructions:
    • From within Internet Explorer click on the Tools menu and then click on Options.
    • Click once on the Security tab
    • Click once on the Internet icon so it becomes highlighted.
    • Click once on the Custom Level button.
      • Change the Download signed ActiveX controls to Prompt
      • Change the Download unsigned ActiveX controls to Disable
      • Change the Initialize and script ActiveX controls not marked as safe to Disable
      • Change the Installation of desktop items to Prompt
      • Change the Launching programs and files in an IFRAME to Prompt
      • Change the Navigate sub-frames across different domains to Prompt
      • When all these settings have been made, click on the OK button.
      • If it prompts you as to whether or not you want to save the settings, press the Yes button.
    • Next press the Apply button and then the OK to exit the Internet Properties page.
  • Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

    See this link for a listing of some online & their stand-alone antivirus programs:

    Virus, Spyware, and Malware Protection and Removal Resources

  • Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

  • Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.

    For a tutorial on Firewalls and a listing of some available ones see the link below:

    Understanding and Using Firewalls

  • Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

  • Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.

    A tutorial on installing & using this product can be found here:

    Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers

  • Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.

    A tutorial on installing & using this product can be found here:

    Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer

  • Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

    A tutorial on installing & using this product can be found here:

    Using SpywareBlaster to protect your computer from Spyware and Malware

  • Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
Follow this list and your potential for being infected again will reduce dramatically.

here are some additional utilities that will enhance your safety


Thunderbird1988
  • 0

#9
Thunderbird1988
Posted 06 August 2008 - 06:23 AM

Thunderbird1988

    Member 2k

  • Member
  • PipPipPipPipPip
  • 2,416 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :)

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0
Back to Virus, Spyware, Malware Removal · Next Unread Topic →




Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

  1. Geeks to Go Community
  2. → Security
  3. → Virus, Spyware, Malware Removal

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP