Jump to content

Welcome to Geeks to Go - Register now for FREE

Geeks To Go is a helpful hub, where thousands of volunteer geeks quickly serve friendly answers and support. Check out the forums and get free advice from the experts. Register now to gain access to all of our features, it's FREE and only takes one minute. Once registered and logged in, you will be able to create topics, post replies to existing threads, give reputation to your fellow members, get your own private messenger, post status updates, manage your profile and so much more.

Create Account How it Works
Photo

Lost my hard drive space [RESOLVED]


  • This topic is locked This topic is locked

#1
Wave Man

Wave Man

    New Member

  • Member
  • Pip
  • 7 posts
Hello,

I am sorry I cannot be more descriptive with the type of infection, but that is all I really know about it. I installed some game programs off the internet, and as soon as I did, my computer was filled with malware.

There were many adware programs, but running Adware and Spybot seemed to get rid of most of them, although there are still some occasional popups.
However, my worst problem is that I have lost virtually all of my hard drive space. I had around 13 gigabytes of room left, and slowly over the next couple days the amount went down and down until now I have only a few megabytes of free space. I have found a few random folders that were empty have now been filled with thousands of junk .zip files. One folder has 9 gigabytes of junk.

I ran all of the programs listed in the start topic before I lost all of my space, and for a while, it appeared to be fine again. All of my free space was back, but it did not take long for it to be going down again, until now when I have no free space.
I am running Windows 2000.

I have ran a Hijack This scan, and this is the log:
Logfile of HijackThis v1.99.1
Scan saved at 5:33:10 PM, on 9/25/2005
Platform: Windows 2000 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 (5.00.2920.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\CTSvcCDA.EXE
C:\WINNT\System32\svchost.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\FSI\F-Prot\fpavupdm.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\UAService7.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\FSI\F-Prot\F-Sched.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\winsupdater\winsupdater.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
C:\WINNT\System32\msiexec.exe
C:\DOCUME~1\herb\LOCALS~1\Temp\0aug.exe
C:\WINNT\Explorer.exe
C:\Program Files\FSI\F-Prot\F-StopW.exe
C:\Program Files\LimeWire\LimeWire 4.1.5 Pro\LimeWire.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ws1.appswebse...=10244&ttid=104
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
O1 - Hosts: 217.116.231.7 aimtoday.aol.com
O1 - Hosts: 216.39.69.102 view.atdmt.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Shorty - {11A4CA8C-A8B9-49c2-A6D3-3F64C9EEBAE6} - C:\Program Files\DNS\Catcher.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Internet Explorer Web Content Catcher - {FFF4E223-7019-4ce7-BE03-D7D3C8CCE884} - C:\Program Files\DNS\Catcher.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: (no name) - {9A9C9B68-F908-4AAB-8D0C-10EA8997F37E} - (no file)
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [hpfsched] C:\WINNT\hpfsched.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [FRISK FP-Scheduler] C:\Program Files\FSI\F-Prot\F-Sched.exe STARTUP
O4 - HKLM\..\Run: [F-StopW] C:\Program Files\FSI\F-Prot\F-StopW.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SrchfstUpdate] C:\WINNT\srchupdt.exe
O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
O4 - HKLM\..\Run: [winsupdater] C:\Program Files\winsupdater\winsupdater.exe /auto
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [] winlog.exe
O4 - HKLM\..\RunServices: [] winlog.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [180ClientStubInstall] "C:\WINNT\stubinstaller6282.exe"
O4 - HKCU\..\Run: [services32] C:\Program Files\Common Files\Windows\mc-58-12-0000137.exe
O4 - HKCU\..\Run: [DNS] C:\Program Files\Common Files\mc-58-12-0000137.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: *.media-motor.net
O15 - Trusted Zone: *.popuppers.com
O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)
O16 - DPF: YExplorer1_8US.CAB - http://photos.groups...plorer1_8us.cab
O16 - DPF: {7149E79C-DC19-4C5E-A53C-A54DDF75EEE9} (IObjSafety.DemoCtl) - http://cabs.media-mo...abs/winupds.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft...free/asinst.cab
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://www.wildtange...iker/wtinst.cab
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\system32\CTSvcCDA.EXE
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: F-Prot Antivirus Update Monitor - FRISK Software - C:\Program Files\FSI\F-Prot\fpavupdm.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: System Startup Service (SvcProc) - Unknown owner - c:\winnt\SvcProc.exe (file missing)
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINNT\system32\UAService7.exe


Thank you for your time.
  • 0

Advertisements


#2
Buckeye_Sam

Buckeye_Sam

    Malware Expert

  • Member
  • PipPipPipPipPipPipPipPip
  • 10,019 posts
Hi and welcome to GeeksToGo! My name is Sam and I will be helping you. :tazz:

I apologize for the delay getting to your log, the helpers here are very busy.
If you still need help, please post a fresh Hijack log, in this thread, so I can help you with your Malware Problems.

If you have resolved this issue please let us know.
  • 0

#3
Wave Man

Wave Man

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
Unforetunately, things haven't improved too much. Ewido did take care of one file called sevices32.dll, I believe, but that's all that has changed.

This is the new log:

Logfile of HijackThis v1.99.1
Scan saved at 1:38:52 AM, on 9/30/2005
Platform: Windows 2000 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 (5.00.2920.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\CTSvcCDA.EXE
C:\WINNT\System32\svchost.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\FSI\F-Prot\fpavupdm.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\UAService7.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.exe
C:\Program Files\FSI\F-Prot\F-Sched.exe
C:\Program Files\FSI\F-Prot\F-StopW.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
C:\WINNT\System32\msiexec.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ws1.appswebse...=10244&ttid=104
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
O1 - Hosts: 217.116.231.7 aimtoday.aol.com
O1 - Hosts: 216.39.69.102 view.atdmt.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: Shorty - {11A4CA8C-A8B9-49c2-A6D3-3F64C9EEBAE6} - C:\Program Files\DNS\Catcher.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Internet Explorer Web Content Catcher - {FFF4E223-7019-4ce7-BE03-D7D3C8CCE884} - C:\Program Files\DNS\Catcher.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [hpfsched] C:\WINNT\hpfsched.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [FRISK FP-Scheduler] C:\Program Files\FSI\F-Prot\F-Sched.exe STARTUP
O4 - HKLM\..\Run: [F-StopW] C:\Program Files\FSI\F-Prot\F-StopW.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SrchfstUpdate] C:\WINNT\srchupdt.exe
O4 - HKLM\..\Run: [winsupdater] C:\Program Files\winsupdater\winsupdater.exe /auto
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [] winlog.exe
O4 - HKLM\..\RunServices: [] winlog.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [180ClientStubInstall] "C:\WINNT\stubinstaller6282.exe"
O4 - HKCU\..\Run: [services32] C:\Program Files\Common Files\Windows\mc-58-12-0000140.exe
O4 - HKCU\..\Run: [DNS] C:\Program Files\Common Files\mc-58-12-0000140.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)
O16 - DPF: YExplorer1_8US.CAB - http://photos.groups...plorer1_8us.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft...free/asinst.cab
O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://www.wildtange...iker/wtinst.cab
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\system32\CTSvcCDA.EXE
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: F-Prot Antivirus Update Monitor - FRISK Software - C:\Program Files\FSI\F-Prot\fpavupdm.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINNT\system32\UAService7.exe

Thank you again for your help and time.
  • 0

#4
Buckeye_Sam

Buckeye_Sam

    Malware Expert

  • Member
  • PipPipPipPipPipPipPipPip
  • 10,019 posts
Please follow these steps:
  • Please make sure that you can View Hidden Files
    • Click Start -> My Computer
    • Select Tools -> Folder options
    • Select the View tab and make sure that 'Show hidden files and folders' (or 'Show all files') is enabled.
    • Also make sure that 'Display the contents of system folders' is checked.
    • For more info on how to show hidden files click here.


  • Run Hijackthis again, click scan, and Put a checkmark next to each of these. Then close all other windows--you should only see HijackThis on your Desktop--and click the Fix Checked button.


    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://ws1.appswebse...=10244&ttid=104
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
    O2 - BHO: Shorty - {11A4CA8C-A8B9-49c2-A6D3-3F64C9EEBAE6} - C:\Program Files\DNS\Catcher.dll
    O2 - BHO: Internet Explorer Web Content Catcher - {FFF4E223-7019-4ce7-BE03-D7D3C8CCE884} - C:\Program Files\DNS\Catcher.dll
    O4 - HKLM\..\Run: [SrchfstUpdate] C:\WINNT\srchupdt.exe
    O4 - HKLM\..\Run: [winsupdater] C:\Program Files\winsupdater\winsupdater.exe /auto
    O4 - HKLM\..\Run: [] winlog.exe
    O4 - HKLM\..\RunServices: [] winlog.exe
    O4 - HKCU\..\Run: [180ClientStubInstall] "C:\WINNT\stubinstaller6282.exe"
    O4 - HKCU\..\Run: [services32] C:\Program Files\Common Files\Windows\mc-58-12-0000140.exe
    O4 - HKCU\..\Run: [DNS] C:\Program Files\Common Files\mc-58-12-0000140.exe
    O15 - Trusted Zone: http://awbeta.net-nucleus.com (HKLM)
    O16 - DPF: {AB29A544-D6B4-4E36-A1F8-D3E34FC7B00A} - http://www.wildtange...iker/wtinst.cab



  • Please reboot your computer in SafeMode by doing the following:
    • Restart your computer
    • After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
    • Instead of Windows loading as normal, a menu should appear
    • Select the first option, to run Windows in Safe Mode.
    • If you have trouble getting into Safe mode go here for more info.



  • Once in Safe mode, delete these files or directories (Do not be concerned if they do not exist):


    winlog.exe
    C:\WINNT\stubinstaller6282.exe
    C:\WINNT\srchupdt.exe
    C:\Program Files\winsupdater <-- delete this folder
    C:\Program Files\DNS <-- delete this folder
    C:\Program Files\Common Files\Windows\mc-58-12-0000140.exe
    C:\Program Files\Common Files\mc-58-12-0000140.exe
Reboot your computer to go back to normal mode.


Please run Panda Online Virus Scan
  • You must allow the active-x control to run when asked.
  • There may be files that this scan will not remove.
  • Please include that information in your next post.

Reboot and post a new hijackthis log and the info from your virus scan.
  • 0

#5
Wave Man

Wave Man

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
Ok, I did all of the steps you listed. I ran Panda Active Scan and it disinfected 20874 virus and detected 20876, so there are two left.

I also ran Hijack This again and this is the new log:

Logfile of HijackThis v1.99.1
Scan saved at 3:46:38 PM, on 9/30/2005
Platform: Windows 2000 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 (5.00.2920.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\CTSvcCDA.EXE
C:\WINNT\System32\svchost.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\FSI\F-Prot\fpavupdm.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\UAService7.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.exe
C:\Program Files\FSI\F-Prot\F-Sched.exe
C:\Program Files\FSI\F-Prot\F-StopW.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
C:\WINNT\System32\msiexec.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
O1 - Hosts: 217.116.231.7 aimtoday.aol.com
O1 - Hosts: 216.39.69.102 view.atdmt.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: LinkTracker Class - {8B6DA27E-7F64-4694-8F8F-DC87AB8C6B22} - C:\WINNT\System32\qlink32.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: YourSiteBar - {86227D9C-0EFE-4f8a-AA55-30386A3F5686} - C:\Program Files\YourSiteBar\ysb.dll (file missing)
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [hpfsched] C:\WINNT\hpfsched.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [FRISK FP-Scheduler] C:\Program Files\FSI\F-Prot\F-Sched.exe STARTUP
O4 - HKLM\..\Run: [F-StopW] C:\Program Files\FSI\F-Prot\F-StopW.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [SurfAccuracy] C:\Program Files\SurfAccuracy\SAcc.exe
O4 - HKLM\..\Run: [Power Scan] C:\Program Files\Power Scan\powerscan.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DNS] C:\Program Files\Common Files\mc-58-12-0000140.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: YExplorer1_8US.CAB - http://photos.groups...plorer1_8us.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft...free/asinst.cab
O18 - Filter: text/html - {3551784B-E99A-474f-B782-3EC814442918} - C:\WINNT\System32\qlink32.dll
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\system32\CTSvcCDA.EXE
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: F-Prot Antivirus Update Monitor - FRISK Software - C:\Program Files\FSI\F-Prot\fpavupdm.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINNT\system32\UAService7.exe

Thank you again for all your help. I really appreciate it.
  • 0

#6
Buckeye_Sam

Buckeye_Sam

    Malware Expert

  • Member
  • PipPipPipPipPipPipPipPip
  • 10,019 posts
Did you save the log from Panda? It would helpful to see the log.
  • 0

#7
Wave Man

Wave Man

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
Yes and here it is:



Adware:adware/searchresults No disinfected C:\WINNT\System32\qlink32.dll
Spyware:spyware/dyfuca No disinfected C:\Documents and Settings\herb\Local Settings\Temp\cfout.txt
Adware:adware/comet No disinfected C:\WINNT\DOWNLOADED PROGRAM FILES\cc.inf
Adware:adware/igetnet No disinfected C:\WINNT\SYSTEM\rules.dat
Adware:adware/superspider No disinfected C:\WINNT\SYSTEM32\a.exe
Adware:adware/searchresults No disinfected C:\WINNT\SYSTEM32\qlink32.dll
Adware:adware/ipinsight No disinfected C:\WINNT\alchem.ini
Adware:adware/sahagent No disinfected C:\WINNT\unstall.exe
Adware:adware/powerscan No disinfected C:\Documents and Settings\herb\Start Menu\Programs\Power Scan
Adware:adware/flashtrack No disinfected C:\PROGRAM FILES\Ftk
Adware:adware/wupd No disinfected C:\PROGRAM FILES\Media Pass
Adware:adware/surfaccuracy No disinfected C:\PROGRAM FILES\SurfAccuracy
Adware:adware/winad No disinfected C:\PROGRAM FILES\Winad Client
Adware:adware/maxifiles No disinfected C:\PROGRAM FILES\COMMON FILES\InetGet
Adware:adware/ist.yoursitebar No disinfected Windows Registry
Adware:Adware/Maxifiles No disinfected C:\ab.exe[mc-58-12-0000137.exe]
Adware:Adware/IST.ISTBar No disinfected C:\ab.exe[to.exe]
Adware:Adware/IST.SideFind No disinfected C:\Documents and Settings\herb\Local Settings\Temporary Internet Files\Content.IE5\K6YQXDKF\sidefind[1].exe
Adware:Adware/Maxifiles No disinfected C:\Program Files\Common Files\InetGet\mc-58-12-0000137.exe
Adware:Adware/Maxifiles No disinfected C:\Program Files\Common Files\InetGet\mc-58-12-0000140.exe.tcf
Adware:Adware/FlashTrack No disinfected C:\Program Files\Common Files\Java\ftkclean.exe
Adware:Adware/Maxifiles No disinfected C:\Program Files\Creative\Creative NOMAD Jukebox Zen Xtra\NOMAD Explorer\a.exe
Adware:Adware/Maxifiles No disinfected C:\Program Files\Creative\Creative NOMAD Jukebox Zen Xtra\NOMAD Explorer\a.exe[mc-58-12-0000140.exe]
Adware:Adware/IST.ISTBar No disinfected C:\Program Files\Creative\Creative NOMAD Jukebox Zen Xtra\NOMAD Explorer\a.exe[al.exe]
Virus:Eicar.Mod No disinfected C:\Program Files\FSI\F-Prot\fpav-help.chm[prob-scan-ok.html]
Adware:Adware/FlashTrack No disinfected C:\Program Files\Ftk\ftkclean.exe
Adware:Adware/FlashTrack No disinfected C:\Program Files\Ftk\Ftkcpy_inst.exe.tcf
Virus:Eicar.Mod No disinfected C:\Program Files\InstallShield Installation Information\{9FD12630-1991-46F5-8479-92DE1EAE87DA}\data1.cab[fpav-help.chm][prob-scan-ok.html]
Adware:Adware/KeenValue No disinfected C:\Program Files\Kazaa\PerfectNavUninstall.exe
Adware:Adware/SurfAccuracy No disinfected C:\Program Files\SurfAccuracy\SAccU.exe
Adware:Adware/IPInsight No disinfected C:\WINNT\inf\alchem.inf
Adware:Adware/IGetNet No disinfected C:\WINNT\system\Install_All.DLL
Adware:Adware/IGetNet No disinfected C:\WINNT\system\RSP001.DLL
Adware:Adware/IGetNet No disinfected C:\WINNT\system\Update_com.DLL
Adware:Adware/Maxifiles No disinfected C:\WINNT\system32\a.exe
Adware:Adware/Maxifiles No disinfected C:\WINNT\system32\a.exe[mc-58-12-0000140.exe]
Adware:Adware/IST.ISTBar No disinfected C:\WINNT\system32\a.exe[al.exe]
Spyware:Spyware/LinkReplacer No disinfected C:\WINNT\system32\PreUninstallQL.exe
It found two viruses that were not taken care of and 37 or so spyware.
It looks like I have most of my hard drive space, at least for now, so something has improved. Right now there are only 200 and some megabytes of junk files in the one folder, but I think they are still coming back.
Thanks.
  • 0

#8
Buckeye_Sam

Buckeye_Sam

    Malware Expert

  • Member
  • PipPipPipPipPipPipPipPip
  • 10,019 posts
Please download and install Cleanup 4.0

Now run CleanUp
IMPORTANT!
CleanUp deletes EVERYTHING out of your temp/temporary folders, it does not make backups.
If you have any documents or programs that are saved in any Temporary Folders, please make a backup of these before running CleanUp


Running CleanUp
  • Start CleanUp by double-clicking the icon on your desktop (or from the Start > All Programs menu).
  • When CleanUp starts go to the Options button (right side of CleanUp screen)
  • Move the arrow down to "Custom CleanUp!"
  • Now place a checkmark next to the following (Make sure nothing else is checked!):
    • Delete Cookies
      This is optional, if you leave the box checked it will remove all of your cookies, at this point removing cookies is a good idea
    • Empty Recycle Bins
    • Delete Prefetch files
    • Cleanup! All Users
  • Click OK
  • Then click on the CleanUp button. This will take a short while, let it do its thing.
  • When asked to reboot system select No
  • Close CleanUp

==============


Download the Pocket Killbox.

Unzip the contents of KillBox.zip to a convenient location and then double-click on KillBox.exe to launch the program.
  • Highlight the lines below and press the Ctrl key and the C key at the same time to copy them to the clipboard:

    • C:\WINNT\System32\qlink32.dll
      C:\WINNT\DOWNLOADED PROGRAM FILES\cc.inf
      C:\WINNT\SYSTEM\rules.dat
      C:\WINNT\SYSTEM32\a.exe
      C:\WINNT\alchem.ini
      C:\WINNT\unstall.exe
      C:\ab.exe
      C:\Program Files\Common Files\InetGet\mc-58-12-0000137.exe
      C:\Program Files\Common Files\InetGet\mc-58-12-0000140.exe.tcf
      C:\Program Files\Common Files\Java\ftkclean.exe
      C:\Program Files\Creative\Creative NOMAD Jukebox Zen Xtra\NOMAD Explorer\a.exe
      C:\Program Files\FSI\F-Prot\fpav-help.chm
      C:\Program Files\Ftk\ftkclean.exe
      C:\Program Files\Ftk\Ftkcpy_inst.exe.tcf
      C:\Program Files\Kazaa\PerfectNavUninstall.exe
      C:\Program Files\SurfAccuracy\SAccU.exe
      C:\WINNT\inf\alchem.inf
      C:\WINNT\system\Install_All.DLL
      C:\WINNT\system\RSP001.DLL
      C:\WINNT\system\Update_com.DLL
      C:\WINNT\system32\a.exe
      C:\WINNT\system32\PreUninstallQL.exe

  • Now go to the Killbox application and click on the File menu and then the Paste from Clipboard menu item. In the Full Path of File to Delete box you should see the first file. If you dropdown that box you should see the rest of them. Make sure that they are all there.
  • Click on the Delete on Reboot option and then click on the red circle with a white 'X' in to to delete the files. Killbox will tell you that all listed files will be deleted on next reboot, click YES. When it asks if you would like to Reboot now, click YES. If you get a "PendingFileRenameOperations Registry Data has been Removed by External Process!" message then just restart manually.
Your system will reboot now.


============


Delete these folders, if present:

C:\Documents and Settings\herb\Start Menu\Programs\Power Scan
C:\PROGRAM FILES\Ftk
C:\PROGRAM FILES\Media Pass
C:\PROGRAM FILES\SurfAccuracy
C:\PROGRAM FILES\Winad Client
C:\PROGRAM FILES\COMMON FILES\InetGet


=============


Please download WebRoot SpySweeper from HERE (It's a 2 week trial):
  • Click the Free Trial link on the right - next to "SpySweeper for Home Computers" to download the program.
  • Double-click the file to install it as follows:
    • Click "Next", read the agreement, Click "Next"
    • Choose "Custom" click "Next".
    • Leave the default installation directoy as it is, then click "Next".
    • UNcheck "Run SpySweeper at Windows Startup" and "Add Sweep for Spyware to Windows Explorer Context Menu". Click "Next".
    • On the following screen you can leave the e-mail address field blank, if you wish. Click "Next".
    • Finally, click "Install"
  • Once the program is installed, it will open.
  • It will prompt you to update to the latest definitions, click Yes.
    Disable SpySweeper Shields
    • Click Shields on the left.
    • Click Internet Explorer and uncheck all items.
    • Click Windows System and uncheck all items.
    • Click Startup Programs and uncheck all items.
  • Once the definitions are installed and shields disabled, click Sweep Now on the left side.
  • Click the Start button.
  • When it's done scanning, click the Next button.
  • Make sure everything has a check next to it, then click the Next button.
  • It will remove all of the items found.
  • Click Session Log in the upper right corner, copy everything in that window.
  • Click the Summary tab and click Finish.
  • Paste the contents of the session log you copied into your next reply.
Also post a new hijackthis log.
  • 0

#9
Wave Man

Wave Man

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
Here is the Spy Sweeper session log:

5:59 PM: |··· Start of Session, Sunday, October 02, 2005 ···|
5:59 PM: Spy Sweeper started
5:59 PM: Sweep initiated using definitions version 547
5:59 PM: Starting Memory Sweep
6:01 PM: Memory Sweep Complete, Elapsed Time: 00:01:48
6:01 PM: Starting Registry Sweep
6:01 PM: Found Adware: cws-aboutblank
6:01 PM: HKCR\protocols\filter\text/html\ (2 subtraces) (ID = 114343)
6:01 PM: HKLM\software\classes\protocols\filter\text/html\ (2 subtraces) (ID = 115907)
6:01 PM: Found Adware: ist software
6:01 PM: HKU\S-1-5-21-448539723-1078145449-1060284298-1003\software\ist\ (3 subtraces) (ID = 129108)
6:01 PM: Found Adware: linkmaker
6:01 PM: HKLM\software\classes\typelib\{423550e9-2f83-4678-9929-c1774088b180}\ (9 subtraces) (ID = 129743)
6:01 PM: HKCR\typelib\{423550e9-2f83-4678-9929-c1774088b180}\ (9 subtraces) (ID = 129750)
6:01 PM: Found Adware: maxifiles
6:01 PM: HKCR\shorty.gopher\ (5 subtraces) (ID = 134839)
6:01 PM: HKCR\shorty.gopher.1\ (3 subtraces) (ID = 134840)
6:01 PM: HKLM\software\classes\shorty.gopher\ (5 subtraces) (ID = 134843)
6:01 PM: HKLM\software\classes\shorty.gopher.1\clsid\ (1 subtraces) (ID = 134844)
6:01 PM: HKLM\software\classes\shorty.gopher.1\ (3 subtraces) (ID = 134845)
6:01 PM: Found Adware: powerscan
6:01 PM: HKU\S-1-5-21-448539723-1078145449-1060284298-1003\software\powerscan\ (1 subtraces) (ID = 136823)
6:01 PM: HKLM\software\microsoft\windows\currentversion\run\ || power scan (ID = 136825)
6:01 PM: HKLM\software\microsoft\windows\currentversion\uninstall\power scan\ (2 subtraces) (ID = 136826)
6:01 PM: Found Trojan Horse: rbot
6:01 PM: HKLM\software\krypton\ (6 subtraces) (ID = 139241)
6:01 PM: Found Adware: media-motor
6:01 PM: HKCR\clsid\{7149e79c-dc19-4c5e-a53c-a54ddf75eee9}\ (27 subtraces) (ID = 140032)
6:01 PM: HKLM\software\classes\clsid\{7149e79c-dc19-4c5e-a53c-a54ddf75eee9}\inprocserver32\ (2 subtraces) (ID = 140081)
6:01 PM: HKLM\software\classes\clsid\{7149e79c-dc19-4c5e-a53c-a54ddf75eee9}\miscstatus\ (3 subtraces) (ID = 140082)
6:01 PM: HKLM\software\classes\clsid\{7149e79c-dc19-4c5e-a53c-a54ddf75eee9}\progid\ (1 subtraces) (ID = 140083)
6:01 PM: HKLM\software\classes\clsid\{7149e79c-dc19-4c5e-a53c-a54ddf75eee9}\toolboxbitmap32\ (1 subtraces) (ID = 140084)
6:01 PM: HKLM\software\classes\clsid\{7149e79c-dc19-4c5e-a53c-a54ddf75eee9}\typelib\ (1 subtraces) (ID = 140085)
6:01 PM: HKLM\software\classes\clsid\{7149e79c-dc19-4c5e-a53c-a54ddf75eee9}\version\ (1 subtraces) (ID = 140086)
6:01 PM: HKLM\software\classes\typelib\{466c63ac-f26e-49f1-861a-e07da768a46a}\ (9 subtraces) (ID = 140131)
6:01 PM: HKLM\software\mm\ (1 subtraces) (ID = 140211)
6:01 PM: HKCR\typelib\{466c63ac-f26e-49f1-861a-e07da768a46a}\ (9 subtraces) (ID = 140223)
6:01 PM: Found Adware: search fast communicator toolbar
6:01 PM: HKU\S-1-5-21-448539723-1078145449-1060284298-1003\software\communicator toolbar\ (10 subtraces) (ID = 140688)
6:01 PM: HKU\S-1-5-21-448539723-1078145449-1060284298-1003\software\microsoft\internet explorer\toolbar\webbrowser\ || {4e7bd74f-2b8d-469e-8dbc-a42eb79cb428} (ID = 140689)
6:01 PM: Found Adware: shopathomeselect
6:01 PM: HKLM\software\ || test (ID = 141678)
6:01 PM: Found Trojan Horse: trojan downloader matcash
6:01 PM: HKU\S-1-5-21-448539723-1078145449-1060284298-1003\software\microsoft\windows\currentversion\run\ || dns (ID = 144713)
6:01 PM: Found Adware: winad
6:01 PM: HKCR\mediapassx.installer\ (3 subtraces) (ID = 147160)
6:01 PM: HKLM\software\classes\mediapassx.installer\ (3 subtraces) (ID = 147174)
6:01 PM: HKLM\software\media pass\ (4 subtraces) (ID = 147183)
6:01 PM: Found Adware: ist yoursitebar
6:01 PM: HKCR\clsid\{86227d9c-0efe-4f8a-aa55-30386a3f5686}\ (14 subtraces) (ID = 147831)
6:01 PM: HKCR\interface\{03b800f9-2536-4441-8cda-2a3e6d15b4f8}\ (8 subtraces) (ID = 147832)
6:01 PM: HKCR\interface\{dfbcc1eb-b149-487e-80c1-cc1562021542}\ (8 subtraces) (ID = 147835)
6:01 PM: HKLM\software\classes\clsid\{86227d9c-0efe-4f8a-aa55-30386a3f5686}\ (14 subtraces) (ID = 147837)
6:01 PM: HKLM\software\classes\interface\{03b800f9-2536-4441-8cda-2a3e6d15b4f8}\ (8 subtraces) (ID = 147838)
6:01 PM: HKLM\software\classes\interface\{dfbcc1eb-b149-487e-80c1-cc1562021542}\ (8 subtraces) (ID = 147841)
6:01 PM: HKLM\software\classes\typelib\{4ee12b71-aa5e-45ec-8666-2db3ad3fdf44}\ (9 subtraces) (ID = 147842)
6:01 PM: HKLM\software\classes\ysb.ysbobj.1\ (3 subtraces) (ID = 147846)
6:01 PM: HKLM\software\classes\ysb.ysbobj\ (5 subtraces) (ID = 147847)
6:01 PM: HKLM\software\microsoft\internet explorer\toolbar\ || {86227d9c-0efe-4f8a-aa55-30386a3f5686} (ID = 147852)
6:01 PM: HKU\S-1-5-21-448539723-1078145449-1060284298-1003\software\microsoft\internet explorer\toolbar\webbrowser\ || {86227d9c-0efe-4f8a-aa55-30386a3f5686} (ID = 147853)
6:01 PM: HKLM\software\microsoft\windows\currentversion\uninstall\yoursitebar\ (5 subtraces) (ID = 147859)
6:01 PM: HKLM\software\yoursitebar\ (21 subtraces) (ID = 147860)
6:01 PM: HKCR\typelib\{4ee12b71-aa5e-45ec-8666-2db3ad3fdf44}\ (9 subtraces) (ID = 147861)
6:01 PM: HKCR\ysb.ysbobj.1\ (3 subtraces) (ID = 147865)
6:01 PM: HKCR\ysb.ysbobj\ (5 subtraces) (ID = 147866)
6:01 PM: Found Adware: surf accuracy
6:01 PM: HKLM\software\sacc\ (2 subtraces) (ID = 203068)
6:01 PM: HKLM\software\microsoft\windows\currentversion\run\ || surfaccuracy (ID = 203069)
6:01 PM: HKLM\software\microsoft\windows\currentversion\uninstall\sacc\ (2 subtraces) (ID = 203070)
6:01 PM: Found Adware: quicklink search toolbar
6:01 PM: HKCR\clsid\{8b6da27e-7f64-4694-8f8f-dc87ab8c6b22}\ (8 subtraces) (ID = 359437)
6:01 PM: HKLM\software\classes\clsid\{8b6da27e-7f64-4694-8f8f-dc87ab8c6b22}\ (8 subtraces) (ID = 359440)
6:01 PM: HKCR\quicklinks.linktracker.1\ (3 subtraces) (ID = 359448)
6:01 PM: HKCR\quicklinks.linktracker\ (3 subtraces) (ID = 359449)
6:01 PM: HKCR\quicklinks.quicklinksfilter.1\ (3 subtraces) (ID = 359450)
6:01 PM: HKCR\quicklinks.quicklinksfilter\ (3 subtraces) (ID = 359451)
6:01 PM: HKLM\software\classes\quicklinks.linktracker.1\ (3 subtraces) (ID = 359452)
6:01 PM: HKLM\software\classes\quicklinks.linktracker\ (3 subtraces) (ID = 359453)
6:01 PM: HKLM\software\classes\quicklinks.quicklinksfilter.1\ (3 subtraces) (ID = 359454)
6:01 PM: HKLM\software\classes\quicklinks.quicklinksfilter\ (3 subtraces) (ID = 359455)
6:01 PM: HKLM\software\microsoft\windows\currentversion\explorer\browser helper objects\{8b6da27e-7f64-4694-8f8f-dc87ab8c6b22}\ (ID = 359456)
6:01 PM: HKLM\software\microsoft\windows\currentversion\uninstall\quick links\ (2 subtraces) (ID = 359457)
6:01 PM: HKLM\software\ql\ (4 subtraces) (ID = 359458)
6:01 PM: Found Adware: cydoor
6:01 PM: HKU\WRSS_Profile_S-1-5-21-448539723-1078145449-1060284298-1002\software\cydoor\ (602 subtraces) (ID = 639126)
6:01 PM: HKU\WRSS_Profile_S-1-5-21-448539723-1078145449-1060284298-1002\software\cydoor services\ (12 subtraces) (ID = 639128)
6:01 PM: HKCR\clsid\{3551784b-e99a-474f-b782-3ec814442918}\ (10 subtraces) (ID = 727328)
6:01 PM: HKLM\software\classes\clsid\{3551784b-e99a-474f-b782-3ec814442918}\ (10 subtraces) (ID = 727357)
6:01 PM: Found Adware: abetterinternet
6:01 PM: HKLM\software\microsoft\windows\currentversion\uninstall\bsto-1\ (7 subtraces) (ID = 746835)
6:01 PM: HKCR\iecatcher.iewebcatcher\ (5 subtraces) (ID = 829231)
6:01 PM: HKCR\iecatcher.iewebcatcher.1\ (3 subtraces) (ID = 829237)
6:01 PM: HKCR\typelib\{fff24f28-3ae2-46cd-aebe-2f625133a1ca}\ (9 subtraces) (ID = 829253)
6:01 PM: HKLM\software\classes\typelib\{fff24f28-3ae2-46cd-aebe-2f625133a1ca}\ (9 subtraces) (ID = 829282)
6:01 PM: HKLM\software\classes\iecatcher.iewebcatcher\ (5 subtraces) (ID = 829292)
6:01 PM: HKLM\software\classes\iecatcher.iewebcatcher.1\ (3 subtraces) (ID = 829298)
6:01 PM: Registry Sweep Complete, Elapsed Time:00:00:09
6:01 PM: Starting Cookie Sweep
6:01 PM: Found Spy Cookie: yieldmanager cookie
6:01 PM: herb@ad.yieldmanager[1].txt (ID = 3751)
6:01 PM: Found Spy Cookie: addynamix cookie
6:01 PM: herb@ads.addynamix[1].txt (ID = 2062)
6:01 PM: Found Spy Cookie: advertising cookie
6:01 PM: herb@advertising[1].txt (ID = 2175)
6:01 PM: Found Spy Cookie: centrport net cookie
6:01 PM: herb@centrport[1].txt (ID = 2374)
6:01 PM: Found Spy Cookie: servedby advertising cookie
6:01 PM: herb@servedby.advertising[1].txt (ID = 3335)
6:01 PM: Found Spy Cookie: trafficmp cookie
6:01 PM: herb@trafficmp[2].txt (ID = 3581)
6:01 PM: Found Spy Cookie: adserver cookie
6:01 PM: herb@z1.adserver[1].txt (ID = 2142)
6:01 PM: Cookie Sweep Complete, Elapsed Time: 00:00:01
6:01 PM: Starting File Sweep
6:01 PM: c:\program files\power scan (ID = -2147480461)
6:01 PM: Found Adware: hungryhands
6:01 PM: c:\winnt\winskw (5 subtraces) (ID = -2147480862)
6:01 PM: c:\program files\quick links (2 subtraces) (ID = -2147478145)
6:02 PM: bkqkmq.exe (ID = 151212)
6:02 PM: mc-58-12-0000140.exe.tcf (ID = 114256)
6:02 PM: m67m.inf (ID = 144896)
6:02 PM: Warning: Failed to read file "c:\winnt\downloaded program files\mm81.ocx". System Error. Code: 5.
Access is denied
6:03 PM: preuninstallql.exe (ID = 131326)
6:03 PM: m67m.inf (ID = 144896)
6:03 PM: m67m.inf (ID = 144896)
6:03 PM: jau5055.dat (ID = 62535)
6:03 PM: mc-58-12-0000137.exe (ID = 114256)
6:03 PM: saccu.exe (ID = 156655)
6:03 PM: Found Adware: flashtrack
6:03 PM: ftkclean.exe (ID = 112746)
6:04 PM: Warning: Failed to read file "c:\winnt\downloaded program files\conflict.2\mm81.ocx". System Error. Code: 5.
Access is denied
6:04 PM: ftkcpy_inst.exe.tcf (ID = 112748)
6:04 PM: Found Adware: igetnet
6:04 PM: install_all.dll (ID = 63457)
6:05 PM: unstall.exe (ID = 133210)
6:05 PM: qlink32.dll (ID = 153756)
6:06 PM: Found Adware: ignkeys
6:06 PM: rsp001.dll (ID = 63475)
6:17 PM: mc-58-12-0000140.exe.tcf (ID = 156269)
6:17 PM: update_com.dll (ID = 63476)
6:17 PM: mc-58-12-0000140.exe3510.tcf (ID = 156269)
6:17 PM: Warning: Failed to read file "c:\recycler\
6:17 PM: mc-58-12-0000140.exe (ID = 156275)
6:17 PM: backup-20050930-121732-540.dll (ID = 156267)
6:17 PM: Warning: Failed to read file "c:\winnt\downloaded program files\conflict.1\mm81.ocx". System Error. Code: 5.
Access is denied
6:17 PM: backup-20050930-121732-141.dll (ID = 156267)
6:17 PM: mc-58-12-0000137.exe (ID = 156275)
6:17 PM: uninst.exe (ID = 73428)
6:17 PM: alchem.inf (ID = 83109)
6:17 PM: rules.dat (ID = 63478)
6:17 PM: power scan.lnk (ID = 72676)
6:17 PM: Found Adware: comet cursor
6:17 PM: cc.inf (ID = 53467)
6:17 PM: Found Adware: twain-tech
6:17 PM: wininit.ini (ID = 81900)
6:17 PM: ydn5055.dat (ID = 62547)
6:17 PM: File Sweep Complete, Elapsed Time: 00:15:48
6:17 PM: Full Sweep has completed. Elapsed time 00:17:50
6:17 PM: Traces Found: 1091
6:20 PM: Removal process initiated
6:20 PM: Quarantining All Traces: cws-aboutblank
6:20 PM: Quarantining All Traces: ist software
6:20 PM: Quarantining All Traces: linkmaker
6:20 PM: Quarantining All Traces: maxifiles
6:20 PM: Quarantining All Traces: powerscan
6:20 PM: Quarantining All Traces: rbot
6:20 PM: Quarantining All Traces: media-motor
6:20 PM: Quarantining All Traces: search fast communicator toolbar
6:20 PM: Quarantining All Traces: shopathomeselect
6:20 PM: Quarantining All Traces: trojan downloader matcash
6:20 PM: Quarantining All Traces: winad
6:20 PM: Quarantining All Traces: ist yoursitebar
6:20 PM: Quarantining All Traces: surf accuracy
6:20 PM: Quarantining All Traces: quicklink search toolbar
6:20 PM: Quarantining All Traces: cydoor
6:20 PM: Quarantining All Traces: abetterinternet
6:20 PM: Quarantining All Traces: yieldmanager cookie
6:20 PM: Quarantining All Traces: addynamix cookie
6:20 PM: Quarantining All Traces: advertising cookie
6:20 PM: Quarantining All Traces: centrport net cookie
6:20 PM: Quarantining All Traces: servedby advertising cookie
6:20 PM: Quarantining All Traces: trafficmp cookie
6:20 PM: Quarantining All Traces: adserver cookie
6:20 PM: Quarantining All Traces: hungryhands
6:20 PM: Quarantining All Traces: flashtrack
6:20 PM: Quarantining All Traces: igetnet
6:20 PM: Quarantining All Traces: ignkeys
6:20 PM: Quarantining All Traces: comet cursor
6:20 PM: Quarantining All Traces: twain-tech
6:21 PM: Removal process completed. Elapsed time 00:01:29
********
5:58 PM: |··· Start of Session, Sunday, October 02, 2005 ···|
5:58 PM: Spy Sweeper started
5:58 PM: Sweep initiated using definitions version 547
5:58 PM: Starting Memory Sweep
5:58 PM: Sweep Canceled
5:58 PM: Memory Sweep Complete, Elapsed Time: 00:00:06
5:58 PM: Traces Found: 0
5:59 PM: |··· End of Session, Sunday, October 02, 2005 ···|
********
5:56 PM: |··· Start of Session, Sunday, October 02, 2005 ···|
5:56 PM: Spy Sweeper started
5:56 PM: Messenger service has been disabled.
5:58 PM: |··· End of Session, Sunday, October 02, 2005 ···|


And here is another Hijack This log:

Logfile of HijackThis v1.99.1
Scan saved at 6:24:35 PM, on 10/2/2005
Platform: Windows 2000 (WinNT 5.00.2195)
MSIE: Internet Explorer v5.00 (5.00.2920.0000)

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\csrss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\CTSvcCDA.EXE
C:\WINNT\System32\svchost.exe
C:\Program Files\ewido\security suite\ewidoctrl.exe
C:\Program Files\ewido\security suite\ewidoguard.exe
C:\Program Files\FSI\F-Prot\fpavupdm.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\UAService7.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\WINNT\System32\mspmspsv.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.exe
C:\WINNT\System32\msiexec.exe
C:\Program Files\FSI\F-Prot\F-Sched.exe
C:\Program Files\FSI\F-Prot\F-StopW.EXE
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
C:\Program Files\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
O1 - Hosts: 217.116.231.7 aimtoday.aol.com
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [hpfsched] C:\WINNT\hpfsched.exe
O4 - HKLM\..\Run: [LoadQM] loadqm.exe
O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_02\bin\jusched.exe
O4 - HKLM\..\Run: [FRISK FP-Scheduler] C:\Program Files\FSI\F-Prot\F-Sched.exe STARTUP
O4 - HKLM\..\Run: [F-StopW] C:\Program Files\FSI\F-Prot\F-StopW.EXE
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [THGuard] "C:\Program Files\TrojanHunter 4.2\THGuard.exe"
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: Symantec Fax Starter Edition Port.lnk = C:\Program Files\Microsoft Office\Office\1033\OLFSNT40.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_02\bin\npjpi150_02.dll
O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O16 - DPF: YExplorer1_8US.CAB - http://photos.groups...plorer1_8us.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai...all/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://www.pandasoft...free/asinst.cab
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINNT\system32\CTSvcCDA.EXE
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido\security suite\ewidoguard.exe
O23 - Service: F-Prot Antivirus Update Monitor - FRISK Software - C:\Program Files\FSI\F-Prot\fpavupdm.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Unknown owner - C:\WINNT\system32\UAService7.exe
  • 0

#10
Buckeye_Sam

Buckeye_Sam

    Malware Expert

  • Member
  • PipPipPipPipPipPipPipPip
  • 10,019 posts
Your log looks pretty good. How are things working on your end?
  • 0

#11
Wave Man

Wave Man

    New Member

  • Topic Starter
  • Member
  • Pip
  • 7 posts
Well, things seem to be working pretty good. I got all of my hard drive space back and everything is running a lot smoother. I don't know if there are still any junk files or not. It seems like I have lost a little bit of space again, but I haven't added anything new.
  • 0

#12
Buckeye_Sam

Buckeye_Sam

    Malware Expert

  • Member
  • PipPipPipPipPipPipPipPip
  • 10,019 posts
I would definitely defragment your hard drive now after recovering all of that space. I'll keep this thread open for a couple weeks in case something pops back up.

Now that you are clean, please follow these simple steps in order to keep your computer clean and secure:
  • Disable and Enable System Restore. - If you are using Windows ME or XP then you should disable and reenable system restore to make sure there are no infected files found in a restore point left over from what we have just cleaned.

    You can find instructions on how to enable and reenable system restore here:

    Managing Windows Millenium System Restore

    or

    Windows XP System Restore Guide

    Renable system restore with instructions from tutorial above

  • Make your Internet Explorer more secure - This can be done by following these simple instructions:
    • From within Internet Explorer click on the Tools menu and then click on Options.
    • Click once on the Security tab
    • Click once on the Internet icon so it becomes highlighted.
    • Click once on the Custom Level button.
      • Change the Download signed ActiveX controls to Prompt
      • Change the Download unsigned ActiveX controls to Disable
      • Change the Initialize and script ActiveX controls not marked as safe to Disable
      • Change the Installation of desktop items to Prompt
      • Change the Launching programs and files in an IFRAME to Prompt
      • Change the Navigate sub-frames across different domains to Prompt
      • When all these settings have been made, click on the OK button.
      • If it prompts you as to whether or not you want to save the settings, press the Yes button.
    • Next press the Apply button and then the OK to exit the Internet Properties page.
  • Use an AntiVirus Software - It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future.

    See this link for a listing of some online & their stand-alone antivirus programs:

    Virus, Spyware, and Malware Protection and Removal Resources

  • Update your AntiVirus Software - It is imperitive that you update your Antivirus software at least once a week (Even more if you wish). If you do not update your antivirus software then it will not be able to catch any of the new variants that may come out.

  • Use a Firewall - I can not stress how important it is that you use a Firewall on your computer. Without a firewall your computer is succeptible to being hacked and taken over. I am very serious about this and see it happen almost every day with my clients. Simply using a Firewall in its default configuration can lower your risk greatly.

    For a tutorial on Firewalls and a listing of some available ones see the link below:

    Understanding and Using Firewalls

  • Visit Microsoft's Windows Update Site Frequently - It is important that you visit http://www.windowsupdate.com regularly. This will ensure your computer has always the latest security updates available installed on your computer. If there are new updates to install, install them immediately, reboot your computer, and revisit the site until there are no more critical updates.

  • Install Spybot - Search and Destroy - Install and download Spybot - Search and Destroy with its TeaTimer option. This will provide realtime spyware & hijacker protection on your computer alongside your virus protection. You should also scan your computer with program on a regular basis just as you would an antivirus software.

    A tutorial on installing & using this product can be found here:

    Using Spybot - Search & Destroy to remove Spyware , Malware, and Hijackers

  • Install Ad-Aware - Install and download Ad-Aware. ou should also scan your computer with program on a regular basis just as you would an antivirus software in conjunction with Spybot.

    A tutorial on installing & using this product can be found here:

    Using Ad-aware to remove Spyware, Malware, & Hijackers from Your Computer

  • Install SpywareBlaster - SpywareBlaster will added a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

    A tutorial on installing & using this product can be found here:

    Using SpywareBlaster to protect your computer from Spyware and Malware

  • Update all these programs regularly - Make sure you update all the programs I have listed regularly. Without regular updates you WILL NOT be protected when new malicious programs are released.
Follow this list and your potential for being infected again will reduce dramatically.

:tazz: :)
  • 0

#13
Buckeye_Sam

Buckeye_Sam

    Malware Expert

  • Member
  • PipPipPipPipPipPipPipPip
  • 10,019 posts
Since this issue appears to be resolved ... this Topic has been closed. Glad we could help. :tazz:

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.
  • 0






Similar Topics

0 user(s) are reading this topic

0 members, 0 guests, 0 anonymous users

As Featured On:

Microsoft Yahoo BBC MSN PC Magazine Washington Post HP