Incident Status Location
Adware:Adware/Transponder No disinfected C:\WINDOWS\system32\DrPMon.dll
Virus:Trj/Imiserv.D Disinfected Operating system
Adware:Adware/Kingporn No disinfected C:\WINDOWS\system32\commcoss.dll
Adware:Adware/Apropos No disinfected C:\Program Files\CxtPls\cxtpls.dll
Adware:Adware/Apropos No disinfected C:\Program Files\CxtPls\proxystub.dll
Adware:Adware/Transponder No disinfected c:\windows\system32\mzdnef.exe
Adware:Adware/Apropos No disinfected C:\Program Files\CxtPls\CxtPls.exe
Adware:Adware/Apropos No disinfected C:\Program Files\CxtPls\WinGenerics.dll
Spyware:Spyware/SafeSurf No disinfected C:\WINDOWS\system32\netsync.exe
Adware:Adware/IEPlugin No disinfected C:\WINDOWS\wupdt.exe
Adware:Adware/Apropos No disinfected C:\WINDOWS\system32\svcathlp.exe
Adware:Adware/Apropos No disinfected C:\PROGRA~1\AUTOUP~1\AUTOUP~1.EXE
Adware:Adware/Transponder No disinfected c:\windows\system32\mzdnef.exe
Adware:Adware/Apropos No disinfected C:\WINDOWS\system32\STOCPU~1.EXE
Adware:Adware/eZula No disinfected Windows Registry
Adware:Adware/SaveNow No disinfected C:\DOCUME~1\Maxwell\LOCALS~1\Temp\atf
Adware:Adware/MyWay No disinfected C:\Program Files\MyWay
Adware:Adware/PurityScan No disinfected Windows Registry
Adware:Adware/KeenValue No disinfected C:\Program Files\Common Files\Updater
Spyware:Spyware/BetterInet No disinfected Windows Registry
Adware:Adware/SAHAgent No disinfected C:\WINDOWS\system32\ritsacnk.dat
Spyware:Spyware/Searchcentrix No disinfected Windows Registry
Adware:Adware/BookedSpace No disinfected C:\WINDOWS\bsx32
Adware:Adware/WinTools No disinfected Windows Registry
Spyware:Spyware/TVMedia No disinfected C:\Documents and Settings\Maxwell\Application Data\tvm*.dll
Adware:Adware/DealHelper No disinfected Windows Registry
Adware:Adware/IEPlugin No disinfected C:\WINDOWS\systb.dll
Adware:Adware/Fizzle No disinfected C:\Program Files\FwBarTemp
Adware:Adware/WUpd No disinfected Windows Registry
Adware:Adware/Kingporn No disinfected C:\WINDOWS\system32\commcoss.dll
Adware:Adware/Transponder No disinfected C:\WINDOWS\nail.exe
Adware:Adware/Pacimedia No disinfected C:\Documents and Settings\Maxwell\Favorites\1111\1111.url
Adware:Adware/NetPals No disinfected C:\Documents and Settings\All Users\Documents\My Videos\Movies\ablemp3.exe[wu1345rd.exe]
Adware:Adware/NetPals No disinfected C:\Documents and Settings\All Users\Documents\Programs\ablemp3.exe[wu1345rd.exe]
Spyware:Spyware/TVMedia No disinfected C:\Documents and Settings\Maxwell\Application Data\tvmcwrd.dll
Spyware:Spyware/TVMedia No disinfected C:\Documents and Settings\Maxwell\Application Data\tvmdmns.dll
Spyware:Spyware/TVMedia No disinfected C:\Documents and Settings\Maxwell\Application Data\tvmknwrd.dll
Adware:Adware/Pacimedia No disinfected C:\Documents and Settings\Maxwell\Favorites\1111\1111.url
Adware:Adware/Apropos No disinfected C:\Program Files\AutoUpdate\AutoUpdate.exe
Adware:Adware/Apropos No disinfected C:\Program Files\CxtPls\CxtPls.dll
Adware:Adware/Apropos No disinfected C:\Program Files\CxtPls\CxtPls.exe
Adware:Adware/Apropos No disinfected C:\Program Files\CxtPls\ProxyStub.dll
Adware:Adware/Apropos No disinfected C:\Program Files\CxtPls\uninstaller.exe
Adware:Adware/Apropos No disinfected C:\Program Files\CxtPls\WinGenerics.dll
Possible Virus. No disinfected C:\Program Files\GameSpy Arcade\fpupdate.exe
Adware:Adware/WinAD No disinfected C:\Program Files\Preview AdService\PrevAdComm.dll
Spyware:Spyware/TrackCookie No disinfected C:\Program Files\WeirdOnTheWeb\weirdontheweb.exe
Adware:Adware/Transponder No disinfected C:\RECYCLER\S-1-5-21-1530549576-2833596330-583063143-1007\Dc14.exe
Adware:Adware/Transponder No disinfected C:\WINDOWS\kzpggjt.exe
Adware:Adware/Transponder No disinfected C:\WINDOWS\Nail.exe
Adware:Adware/Transponder No disinfected C:\WINDOWS\svcproc.exe
Virus:Trj/Imiserv.D Disinfected C:\WINDOWS\systb.dll
Adware:Adware/SaveNow No disinfected C:\WINDOWS\SYSTEM32\ap2nqrd4.dat
Adware:Adware/WUpd No disinfected C:\WINDOWS\SYSTEM32\ap9h4qmo.ini
Adware:Adware/Envolo No disinfected C:\WINDOWS\SYSTEM32\auto_update_uninstall.exe
Adware:Adware/Apropos No disinfected C:\WINDOWS\SYSTEM32\auto_update_uninstall.log
Adware:Adware/SaveNow No disinfected C:\WINDOWS\SYSTEM32\baur5s9q.dat
Adware:Adware/BookedSpace No disinfected C:\WINDOWS\SYSTEM32\bs51-eginwl51-vb.exe
Adware:Adware/Kingporn No disinfected C:\WINDOWS\SYSTEM32\COMMCOSS.DLL
Adware:Adware/Transponder No disinfected C:\WINDOWS\SYSTEM32\DrPMon.dll
Adware:Adware/VirtualBouncer No disinfected C:\WINDOWS\SYSTEM32\INNERADINSTALL.LOG
Adware:Adware/Transponder No disinfected C:\WINDOWS\SYSTEM32\mzdnef.exe
Spyware:Spyware/SafeSurf No disinfected C:\WINDOWS\SYSTEM32\netsync.exe
Adware:Adware/SaveNow No disinfected C:\WINDOWS\SYSTEM32\q10pvbrv.dat
Adware:Adware/WUpd No disinfected C:\WINDOWS\SYSTEM32\q17i9a4j.ini
Adware:Adware/SAHAgent No disinfected C:\WINDOWS\SYSTEM32\ritsacnk.dat
Adware:Adware/Apropos No disinfected C:\WINDOWS\SYSTEM32\stocpures.exe
Adware:Adware/Apropos No disinfected C:\WINDOWS\SYSTEM32\svcathlp.exe
Possible Virus. No disinfected C:\WINDOWS\SYSTEM32\thinInstLYRS43ez.dll
Adware:Adware/SAHAgent No disinfected C:\WINDOWS\SYSTEM32\xmlparse.dll
Adware:Adware/SAHAgent No disinfected C:\WINDOWS\SYSTEM32\xmltok.dll
Adware:Adware/IEPlugin No disinfected C:\WINDOWS\wupdt.exe
and here is what I got from hijackthis
Logfile of HijackThis v1.99.1
Scan saved at 7:40:11 PM, on 5/21/2005
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.exe
C:\Program Files\Creative\SBAudigy2\Surround Mixer\CTSysVol.exe
C:\Program Files\Common Files\Dell\EUSW\Support.exe
C:\PROGRA~1\mcafee.com\agent\McAgent.exe
C:\WINDOWS\system32\svcathlp.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\WINDOWS\system32\stocpures.exe
C:\WINDOWS\System32\CTsvcCDA.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
c:\windows\system32\pxnsbbs.exe
C:\Program Files\CxtPls\CxtPls.exe
C:\Program Files\Windows Media Player\wmplayer.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\GetRight\GetRight.exe
C:\Program Files\GetRight\GetRight.exe
C:\DOCUME~1\Maxwell\LOCALS~1\Temp\Rar$EX00.813\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =
http://www.dell.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://websearch.drs...esearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =
http://websearch.drs...esearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =
http://websearch.drs...esearch.cgi?id=
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =
http://websearch.drs...esearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
http://websearch.drs...esearch.cgi?id=
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
http://websearch.drs...esearch.cgi?id=
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =
websearch.drsnsrch.com/q.cgi?q=
R3 - Default URLSearchHook is missing
F2 - REG:system.ini: Shell=Explorer.exe C:\WINDOWS\Nail.exe
O2 - BHO: (no name) - {016235BE-59D4-4CEB-ADD5-E2378282A1D9} -
C:\Program Files\CxtPls\cxtpls.dll
O2 - BHO: Band Class - {01F44A8A-8C97-4325-A378-76E68DC4AB2E} -
C:\WINDOWS\systb.dll (file missing)
O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-
7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0
\ycomp5_5_7_0.dll
O2 - BHO: MyWay Search Assistant BHO - {04079851-5845-4dea-848C-
3ECD647AA554} - C:\Program Files\MyWay\SrchAstt\1.bin\MYSRCHAS.DLL (file
missing)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-
784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0
\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: RsyncHlpr Class - {16B238D5-80DE-47CE-8F17-B3ECE2C2248D} -
C:\WINDOWS\system32\rsyncmon.dll
O2 - BHO: bho2gr Class - {31FF080D-12A3-439A-A2EF-4BA95A3148E8} -
C:\Program Files\GetRight\xx2gr.dll
O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
O2 - BHO: ohb - {9ADE0443-2AB2-4B23-A3F8-AC520773DE12} -
C:\WINDOWS\system32\nsj14.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-
CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {EFF80427-F837-4B74-8834-BAF18E0553FD} -
c:\PROGRA~1\System\Misc\kazbh7.dll
O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
O3 - Toolbar: McAfee VirusScan - {BA52B914-B692-46c4-B683-905236F6F655} -
c:\progra~1\mcafee.com\vso\mcvsshl.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} -
C:\Program Files\Yahoo!\Companion\Installs\cpn0\ycomp5_5_7_0.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} -
c:\program files\google\googletoolbar2.dll
O3 - Toolbar: (no name) - {2CDE1A7D-A478-4291-BF31-E1B4C16F92EB} - (no
file)
O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy2\Surround
Mixer\CTSysVol.exe
O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common
Files\Dell\EUSW\Support.exe
O4 - HKLM\..\Run: [MSConfig]
C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1
\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\McAgent.exe
O4 - HKLM\..\Run: [RSync] C:\WINDOWS\system32\netsync.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -
atboottime
O4 - HKLM\..\Run: [AutoLoaderAproposClient] "C:\DOCUME~1
\Maxwell\LOCALS~1\Temp\cxtpls_loader.exe" /HideUninstall /HideDir
/PC=CP.DEF3 /ForSupportedBrowsers /ShowLegalNote=nonbranded
O4 - HKLM\..\Run: [3F2R34Q] svcathlp.exe
O4 - HKLM\..\Run: [ozeusqw] c:\windows\system32\pxnsbbs.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe"
/background
O4 - HKCU\..\Run: [Iot5RQc4g] stocpures.exe
O4 - Global Startup: strings.exe
O8 - Extra context menu item: &Google Search - res://c:\program
files\google\GoogleToolbar2.dll/cmsearch.html
O8 - Extra context menu item: Backward Links - res://c:\program
files\google\GoogleToolbar2.dll/cmbacklinks.html
O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program
files\google\GoogleToolbar2.dll/cmcache.html
O8 - Extra context menu item: Download with GetRight - C:\Program
Files\GetRight\GRdownload.htm
O8 - Extra context menu item: Open with GetRight Browser - C:\Program
Files\GetRight\GRbrowse.htm
O8 - Extra context menu item: Similar Pages - res://c:\program
files\google\GoogleToolbar2.dll/cmsimilar.html
O8 - Extra context menu item: Translate into English - res://c:\program
files\google\GoogleToolbar2.dll/cmtrans.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} -
C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-
00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} -
C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E
-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01113300-3E00-11D2-8470-0060089874ED} (Support.com
Configuration Class) - https://install.char...bin/tgctlcm.cab
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus
scanner) - http://security.syma...bin/AvSniff.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet
Download Control Class) -
http://www.fileplane...DC_1_0_0_44.cab
O16 - DPF: {4ED9DDF0-7479-4BBE-9335-5A1EDB1D8A21} (McAfee.com
Operating System Class) - http://download.mcaf...ed/mcinsctl/en-
us/4,0,0,84/mcinsctl.cab
O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} (RdxIE Class) -
http://software-dl.r...ip/RdxIE601.cab
O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} -
http://a1540.g.akama...om/mickey/us/wi
n/QuickTimeInstaller.exe
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI
Utility Class) -
http://security.syma...n/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) -
http://a840.g.akamai...o.com/housecall
/xscan53.cab
O16 - DPF: {80DD2229-B8E4-4C77-B72F-F22972D723EA} (AvxScanOnline
Control) - http://www.bitdefend...bitdefender.cab
O16 - DPF: {87067F04-DE4C-4688-BC3C-4FCF39D609E7} -
http://download.webs...12/QDow_AS2.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer
Class) - http://www.pandasoft.../as5/asinst.cab
O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) -
http://www.ravantivi...n/ravonline.cab
O16 - DPF: {BB21F850-63F4-4EC9-BF9D-565BD30C9AE9} (ASquaredScanForm
Element) - http://www.windowsec...scan/axscan.cab
O16 - DPF: {BCC0FF27-31D9-4614-A68E-C18E1ADA4389} (DwnldGroupMgr
Class) - http://download.mcaf...red/mcgdmgr/en-
us/1,0,0,16/mcgdmgr.cab
O16 - DPF: {FF0C042C-98E9-4C36-B2EC-E21FDFDCEF75} -
http://download.reds...rsinstaller.cab
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd -
C:\WINDOWS\System32\CTsvcCDA.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program
Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program
Files\ewido\security suite\ewidoguard.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program
Files\iPod\bin\iPodService.exe
O23 - Service: McAfee.com McShield (McShield) - Unknown owner -
c:\PROGRA~1\mcafee.com\vso\mcshield.exe
O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee,
Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe
O23 - Service: McAfee.com VirusScan Online Realtime Engine (MCVSRte) -
McAfee, Inc - c:\PROGRA~1\mcafee.com\vso\mcvsrte.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel® Corporation - C:\Program
Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation -
C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner -
C:\WINDOWS\svcproc.exe (file missing)
please help me out here, maybe I missed something I don't know.
anyways thanks