[BerlinMassive]

Hi everyone!
I did everything like it says in the "do this before posting" topic, but cant get the SP1 installed... it says there are some files missing or something when i try to install it...
anyway, here's my log:

Logfile of HijackThis v1.99.1
Scan saved at 14:46:33, on 01.10.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
e:\Programme\ewido\security suite\ewidoctrl.exe
e:\Programme\ewido\security suite\ewidoguard.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe
C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\Dokumente und Einstellungen\Massive\Desktop\HijackThis.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [THGuard] "E:\Programme\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{86E43F81-8E54-45B7-9576-06C814B8E787}: NameServer = 217.237.151.33 217.237.149.225
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - e:\Programme\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - e:\Programme\ewido\security suite\ewidoguard.exe
O23 - Service: Defragmentation Management Handler (FAT Defragmentation) - Unknown owner - C:\WINDOWS\System32\dfrgfat32.exe (file missing)
O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: spool - Unknown owner - C:\WINDOWS\spoollv.exe (file missing)
O23 - Service: Windows Spooler (winspool32) - Unknown owner - C:\WINDOWS\spool.exe (file missing)



Thx in advance!

p.s.:
i unchecked pokapoka, slsys and mrno4236.exe in the msconfig and they stay unchecked after i reboot... does this mean i dont need to worry?

[Advertisements]

Welcome to GTG.

Please check those entries back in msconfig. Only uncheck those you know are ok to keep and don't want to startup. The bad ones MUST be checked so HijackThis can detect it and tell us about it. So check them back and then restart. Run a new HijackThis scan and post that new log here. I will take a look at it.

[greyknight17]

Welcome to GTG.

Please check those entries back in msconfig. Only uncheck those you know are ok to keep and don't want to startup. The bad ones MUST be checked so HijackThis can detect it and tell us about it. So check them back and then restart. Run a new HijackThis scan and post that new log here. I will take a look at it.

[BerlinMassive]

checked everything and scanned again...

Logfile of HijackThis v1.99.1
Scan saved at 14:11:45, on 02.10.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
e:\Programme\ewido\security suite\ewidoctrl.exe
e:\Programme\ewido\security suite\ewidoguard.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe
C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Programme\VIAudioi\SBADeck\ADeck.exe
C:\Programme\Java\jre1.5.0_04\bin\jusched.exe
C:\Programme\QuickTime\qttask.exe
E:\Programme\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programme\iPod\bin\iPodService.exe
C:\Dokumente und Einstellungen\Massive\Desktop\HijackThis.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [THGuard] "E:\Programme\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AudioDeck] C:\Programme\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [System service70] C:\WINDOWS\\\etb\\pokapoka70.exe
O4 - HKLM\..\Run: [Syga432te Pe432rsonal Firewall] MrNo4236.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [MS System Security] mswin32.pif
O4 - HKLM\..\Run: [iTunesHelper] "E:\Programme\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Generic Host Process9 System Backup] scvhost9.exe
O4 - HKCU\..\Run: [Windows Update 32] slsys.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{86E43F81-8E54-45B7-9576-06C814B8E787}: NameServer = 217.237.151.33 217.237.149.225
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - e:\Programme\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - e:\Programme\ewido\security suite\ewidoguard.exe
O23 - Service: Defragmentation Management Handler (FAT Defragmentation) - Unknown owner - C:\WINDOWS\System32\dfrgfat32.exe (file missing)
O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: spool - Unknown owner - C:\WINDOWS\spoollv.exe (file missing)
O23 - Service: Windows Spooler (winspool32) - Unknown owner - C:\WINDOWS\spool.exe (file missing)



thanx

[greyknight17]

Please print out or copy this page to Notepad. Make sure to work through the fixes in the exact order it is mentioned below. If there's anything that you don't understand, ask your question(s) before proceeding with the fixes. You should 'not' have any open browsers when you are following the procedures below.

Please download Ewido Security Suite at http://www.ewido.net/en/download/.

1. Install Ewido Security Suite.
2. When installing, under 'Additional Options' uncheck:
* Install background guard
* Install scan via context menu
3. Launch Ewido, there should be an icon on your desktop, double click it.
4. The program will now open to the main screen.
5. When you run Ewido for the first time, you will get a warning 'Database could not be found!'. Click OK. We will fix this in a moment.
6. You will need to update Ewido to the latest definition files.
* On the left hand side of the main screen click update.
* Then click on Start Update.
7. The update will start and a progress bar will show the updates being installed. The status bar at the bottom will display 'Update successful'.
8. Exit Ewido. DO NOT scan yet.

If you are having problems with the updater, you can go to http://www.ewido.net...wnload/updates/ to update manually.

Download CleanUp! http://cleanup.stevengould.org/ (Alternate Link if main link don't work - http://www.greyknigh...spy/CleanUp.exe ) and install it. Don't run it yet.

Restart your computer and boot into Safe Mode by hitting the F8 key repeatedly until a menu shows up (and choose Safe Mode from the list). In some systems, this may be the F5 key, so try that if F8 doesn't work.

Download LQFix http://users.telenet...tools/LQfix.exe and click on Install. Go to your Desktop and open up the LQfix folder. Double click on ClickThis.bat to run it.

CleanUp! deletes EVERYTHING out of your temp/temporary folders, it does not make backups. If you have any documents or programs that are saved in any Temporary Folders, please make a backup of these before running CleanUp!. Run CleanUp! and click on the Options button. Uncheck 'Scan local drives for temporary files'. Also uncheck those two Newsgroup entries if you don't want to delete them. Click OK and then click on the CleanUp! button. Let it run. After it's done, choose Yes to logoff.

Now open Ewido and do a scan on your system.

* Click on scanner
* Click on Complete System Scan and the scan will begin.
* NOTE: During some scans with Ewido it is finding cases of false positives.
o You will need to step through the process of cleaning files one-by-one.
o If Ewido detects a file you KNOW to be legitimate, select none as the action.
o Do NOT select 'Perform action on all infections'
o If you are unsure of any entry found, select none for now as the action.
* Once the scan has completed, there will be a button located on the bottom of the screen named Save report
* Click Save report.
* Save the report .txt file to your desktop or a location where you can find it easily.

Run a scan in HijackThis. Check each of the following and hit 'Fix checked' (after checking them) if they still exist (make sure not to miss any):

O4 - HKLM\..\Run: [System service70] C:\WINDOWS\\\etb\\pokapoka70.exe
O4 - HKLM\..\Run: [Syga432te Pe432rsonal Firewall] MrNo4236.exe
O4 - HKLM\..\Run: [MS System Security] mswin32.pif
O4 - HKLM\..\Run: [Generic Host Process9 System Backup] scvhost9.exe
O4 - HKCU\..\Run: [Windows Update 32] slsys.exe
O23 - Service: Defragmentation Management Handler (FAT Defragmentation) - Unknown owner - C:\WINDOWS\System32\dfrgfat32.exe (file missing)
O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe (file missing)
O23 - Service: spool - Unknown owner - C:\WINDOWS\spoollv.exe (file missing)
O23 - Service: Windows Spooler (winspool32) - Unknown owner - C:\WINDOWS\spool.exe (file missing)

Locate and delete the following:

MrNo4236.exe
mswin32.pif
scvhost9.exe
slsys.exe
C:\WINDOWS\System32\dfrgfat32.exe
C:\WINDOWS\System32\hwclock.exe
C:\WINDOWS\spoollv.exe
C:\WINDOWS\spool.exe

Restart your computer. Post the logs for HijackThis and Ewido.

[BerlinMassive]

hi!

first of all, i cant do much under safe mode, cause i cant get an internet connection there...
second: when i run lqfix (clickthis.bat) i get a message "LQfirst.bfu and/or LQsecond.bfu NOT PRESENT! Please post this at the forum"

should i continue with the steps u told me anyways?

thx for the help!

Edited by BerlinMassive, 02 October 2005 - 09:11 AM.

[greyknight17]

OK, for LQfix, does it run the command prompt (black window with white text) automatically? Make sure you allow the program to go online if you have a firewall prompting for access.

Try downloading it and running it again.

After that's done, boot into Safe Mode and continue with the other steps.

[BerlinMassive]

Logfile of HijackThis v1.99.1
Scan saved at 18:30:07, on 02.10.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
e:\Programme\ewido\security suite\ewidoctrl.exe
e:\Programme\ewido\security suite\ewidoguard.exe
C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe
C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Programme\VIAudioi\SBADeck\ADeck.exe
C:\Programme\Java\jre1.5.0_04\bin\jusched.exe
C:\Programme\QuickTime\qttask.exe
E:\Programme\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Programme\iPod\bin\iPodService.exe
C:\Programme\Windows NT\Zubehör\WORDPAD.EXE
C:\Programme\Mozilla Firefox\firefox.exe
C:\Dokumente und Einstellungen\Massive\Desktop\HijackThis.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [THGuard] "E:\Programme\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AudioDeck] C:\Programme\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "E:\Programme\iTunes\iTunesHelper.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{86E43F81-8E54-45B7-9576-06C814B8E787}: NameServer = 217.237.151.33 217.237.149.225
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - e:\Programme\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - e:\Programme\ewido\security suite\ewidoguard.exe
O23 - Service: Defragmentation Management Handler (FAT Defragmentation) - Unknown owner - C:\WINDOWS\System32\dfrgfat32.exe (file missing)
O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe
O23 - Service: Windows Spooler (winspool32) - Unknown owner - C:\WINDOWS\spool.exe (file missing)


---------------------------------------------------------
ewido security suite - Scan Report
---------------------------------------------------------

+ Erstellt am: 18:00:48, 02.10.2005
+ Report-Checksumme: 300E8BD3

+ Scanergebnis:

:mozilla.12:C:\Dokumente und Einstellungen\Massive\Anwendungsdaten\Mozilla\Firefox\Profiles\6b250zls.default\cookies.txt -> Spyware.Cookie.Adition : Gesäubert mit Backup
:mozilla.15:C:\Dokumente und Einstellungen\Massive\Anwendungsdaten\Mozilla\Firefox\Profiles\6b250zls.default\cookies.txt -> Spyware.Cookie.Valueclick : Gesäubert mit Backup
:mozilla.18:C:\Dokumente und Einstellungen\Massive\Anwendungsdaten\Mozilla\Firefox\Profiles\6b250zls.default\cookies.txt -> Spyware.Cookie.Valueclick : Gesäubert mit Backup
:mozilla.19:C:\Dokumente und Einstellungen\Massive\Anwendungsdaten\Mozilla\Firefox\Profiles\6b250zls.default\cookies.txt -> Spyware.Cookie.Adition : Gesäubert mit Backup
:mozilla.23:C:\Dokumente und Einstellungen\Massive\Anwendungsdaten\Mozilla\Firefox\Profiles\6b250zls.default\cookies.txt -> Spyware.Cookie.Ivwbox : Gesäubert mit Backup
:mozilla.24:C:\Dokumente und Einstellungen\Massive\Anwendungsdaten\Mozilla\Firefox\Profiles\6b250zls.default\cookies.txt -> Spyware.Cookie.Falkag : Gesäubert mit Backup
:mozilla.25:C:\Dokumente und Einstellungen\Massive\Anwendungsdaten\Mozilla\Firefox\Profiles\6b250zls.default\cookies.txt -> Spyware.Cookie.Falkag : Gesäubert mit Backup
:mozilla.26:C:\Dokumente und Einstellungen\Massive\Anwendungsdaten\Mozilla\Firefox\Profiles\6b250zls.default\cookies.txt -> Spyware.Cookie.Falkag : Gesäubert mit Backup
:mozilla.27:C:\Dokumente und Einstellungen\Massive\Anwendungsdaten\Mozilla\Firefox\Profiles\6b250zls.default\cookies.txt -> Spyware.Cookie.Falkag : Gesäubert mit Backup
:mozilla.28:C:\Dokumente und Einstellungen\Massive\Anwendungsdaten\Mozilla\Firefox\Profiles\6b250zls.default\cookies.txt -> Spyware.Cookie.Falkag : Gesäubert mit Backup
:mozilla.29:C:\Dokumente und Einstellungen\Massive\Anwendungsdaten\Mozilla\Firefox\Profiles\6b250zls.default\cookies.txt -> Spyware.Cookie.Falkag : Gesäubert mit Backup
:mozilla.38:C:\Dokumente und Einstellungen\Massive\Anwendungsdaten\Mozilla\Firefox\Profiles\6b250zls.default\cookies.txt -> Spyware.Cookie.Advertising : Gesäubert mit Backup
:mozilla.39:C:\Dokumente und Einstellungen\Massive\Anwendungsdaten\Mozilla\Firefox\Profiles\6b250zls.default\cookies.txt -> Spyware.Cookie.Advertising : Gesäubert mit Backup
:mozilla.40:C:\Dokumente und Einstellungen\Massive\Anwendungsdaten\Mozilla\Firefox\Profiles\6b250zls.default\cookies.txt -> Spyware.Cookie.Advertising : Gesäubert mit Backup
:mozilla.41:C:\Dokumente und Einstellungen\Massive\Anwendungsdaten\Mozilla\Firefox\Profiles\6b250zls.default\cookies.txt -> Spyware.Cookie.Advertising : Gesäubert mit Backup
:mozilla.42:C:\Dokumente und Einstellungen\Massive\Anwendungsdaten\Mozilla\Firefox\Profiles\6b250zls.default\cookies.txt -> Spyware.Cookie.Advertising : Gesäubert mit Backup
:mozilla.43:C:\Dokumente und Einstellungen\Massive\Anwendungsdaten\Mozilla\Firefox\Profiles\6b250zls.default\cookies.txt -> Spyware.Cookie.Advertising : Gesäubert mit Backup
:mozilla.45:C:\Dokumente und Einstellungen\Massive\Anwendungsdaten\Mozilla\Firefox\Profiles\6b250zls.default\cookies.txt -> Spyware.Cookie.Falkag : Gesäubert mit Backup
:mozilla.46:C:\Dokumente und Einstellungen\Massive\Anwendungsdaten\Mozilla\Firefox\Profiles\6b250zls.default\cookies.txt -> Spyware.Cookie.Falkag : Gesäubert mit Backup
:mozilla.47:C:\Dokumente und Einstellungen\Massive\Anwendungsdaten\Mozilla\Firefox\Profiles\6b250zls.default\cookies.txt -> Spyware.Cookie.Falkag : Gesäubert mit Backup
:mozilla.48:C:\Dokumente und Einstellungen\Massive\Anwendungsdaten\Mozilla\Firefox\Profiles\6b250zls.default\cookies.txt -> Spyware.Cookie.Falkag : Gesäubert mit Backup
:mozilla.49:C:\Dokumente und Einstellungen\Massive\Anwendungsdaten\Mozilla\Firefox\Profiles\6b250zls.default\cookies.txt -> Spyware.Cookie.Falkag : Gesäubert mit Backup
:mozilla.50:C:\Dokumente und Einstellungen\Massive\Anwendungsdaten\Mozilla\Firefox\Profiles\6b250zls.default\cookies.txt -> Spyware.Cookie.Falkag : Gesäubert mit Backup
:mozilla.56:C:\Dokumente und Einstellungen\Massive\Anwendungsdaten\Mozilla\Firefox\Profiles\6b250zls.default\cookies.txt -> Spyware.Cookie.Doubleclick : Gesäubert mit Backup
:mozilla.67:C:\Dokumente und Einstellungen\Massive\Anwendungsdaten\Mozilla\Firefox\Profiles\6b250zls.default\cookies.txt -> Spyware.Cookie.Atdmt : Gesäubert mit Backup
:mozilla.72:C:\Dokumente und Einstellungen\Massive\Anwendungsdaten\Mozilla\Firefox\Profiles\6b250zls.default\cookies.txt -> Spyware.Cookie.Mediaplex : Gesäubert mit Backup
:mozilla.73:C:\Dokumente und Einstellungen\Massive\Anwendungsdaten\Mozilla\Firefox\Profiles\6b250zls.default\cookies.txt -> Spyware.Cookie.Mediaplex : Gesäubert mit Backup
:mozilla.83:C:\Dokumente und Einstellungen\Massive\Anwendungsdaten\Mozilla\Firefox\Profiles\6b250zls.default\cookies.txt -> Spyware.Cookie.2o7 : Gesäubert mit Backup
:mozilla.84:C:\Dokumente und Einstellungen\Massive\Anwendungsdaten\Mozilla\Firefox\Profiles\6b250zls.default\cookies.txt -> Spyware.Cookie.2o7 : Gesäubert mit Backup
:mozilla.85:C:\Dokumente und Einstellungen\Massive\Anwendungsdaten\Mozilla\Firefox\Profiles\6b250zls.default\cookies.txt -> Spyware.Cookie.2o7 : Gesäubert mit Backup
:mozilla.86:C:\Dokumente und Einstellungen\Massive\Anwendungsdaten\Mozilla\Firefox\Profiles\6b250zls.default\cookies.txt -> Spyware.Cookie.2o7 : Gesäubert mit Backup
:mozilla.133:C:\Dokumente und Einstellungen\Massive\Anwendungsdaten\Mozilla\Firefox\Profiles\6b250zls.default\cookies.txt -> Spyware.Cookie.Adition : Gesäubert mit Backup
:mozilla.138:C:\Dokumente und Einstellungen\Massive\Anwendungsdaten\Mozilla\Firefox\Profiles\6b250zls.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Gesäubert mit Backup
:mozilla.139:C:\Dokumente und Einstellungen\Massive\Anwendungsdaten\Mozilla\Firefox\Profiles\6b250zls.default\cookies.txt -> Spyware.Cookie.Adserver : Gesäubert mit Backup
:mozilla.140:C:\Dokumente und Einstellungen\Massive\Anwendungsdaten\Mozilla\Firefox\Profiles\6b250zls.default\cookies.txt -> Spyware.Cookie.Adserver : Gesäubert mit Backup
:mozilla.141:C:\Dokumente und Einstellungen\Massive\Anwendungsdaten\Mozilla\Firefox\Profiles\6b250zls.default\cookies.txt -> Spyware.Cookie.Yieldmanager : Gesäubert mit Backup
:mozilla.160:C:\Dokumente und Einstellungen\Massive\Anwendungsdaten\Mozilla\Firefox\Profiles\6b250zls.default\cookies.txt -> Spyware.Cookie.Hitbox : Gesäubert mit Backup
:mozilla.164:C:\Dokumente und Einstellungen\Massive\Anwendungsdaten\Mozilla\Firefox\Profiles\6b250zls.default\cookies.txt -> Spyware.Cookie.Hitbox : Gesäubert mit Backup


::Report Ende



couldnt locate any of those files u told me... (MrNo4236.exe
mswin32.pif
scvhost9.exe
slsys.exe
C:\WINDOWS\System32\dfrgfat32.exe
C:\WINDOWS\System32\hwclock.exe
C:\WINDOWS\spoollv.exe
C:\WINDOWS\spool.exe) using the windows search...

i also couldnt find:
O4 - HKLM\..\Run: [System service70] C:\WINDOWS\\\etb\\pokapoka70.exe

and

O23 - Service: Hardware Clock Driver (hwclock) - Unknown owner - C:\WINDOWS\System32\hwclock.exe (file missing)
O23 - Service: Windows Spooler (winspool32) - Unknown owner - C:\WINDOWS\spool.exe (file missing)

keep showing up in hjt, even if i check and fix them...

thx in advance...



p.s.
for explanation:
gesäubert mit backup = cleaned with backup

[greyknight17]

Go to Start->Run and type in notepad and hit OK. Then copy and paste the following into Notepad:

sc stop FAT Defragmentation
sc delete FAT Defragmentation
sc stop hwclock
sc delete hwclock
sc stop winspool32
sc delete winspool32
del delete.bat

Save the file as "delete.bat". Make sure to save it with the quotes. Double click on it.

Go into HijackThis->Config->Misc Tools->Delete an NT service and type in FAT Defragmentation and hit OK. Do the same thing for hwclock and winspool32.

Restart and post a new HijackThis log.

[BerlinMassive]

tried to do that...
i saved the "delete.bat" on my desktop and ran it, but the little black box tells me after every line "the specified service is not an installed service"
do i have to save the "delete.bat" to a different location than my desktop?

"Go into HijackThis->Config->Misc Tools->Delete an NT service and type in FAT Defragmentation and hit OK. Do the same thing for hwclock and winspool32."
Tried that too, but HJT said, for FAT Defragmentation:"The Service FAT Defragmentation is enabled and/or running. Disable it first, using HijackThis itself (from the scan results) or the Services.msc window" so I tried doing so, but couldnt get it done...

for hwclock and winspool32, I got "Service 'hwclock/winspool32' was not found in the Registry. Make sure you entered the short name of the service., vbExclamation" and dont know what to make of that...


anyway, here's my log:

Logfile of HijackThis v1.99.1
Scan saved at 20:34:03, on 04.10.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
e:\Programme\ewido\security suite\ewidoctrl.exe
e:\Programme\ewido\security suite\ewidoguard.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Programme\VIAudioi\SBADeck\ADeck.exe
C:\Programme\Java\jre1.5.0_04\bin\jusched.exe
C:\Programme\QuickTime\qttask.exe
C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe
E:\Programme\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programme\iPod\bin\iPodService.exe
C:\Dokumente und Einstellungen\Massive\Desktop\HijackThis.exe
C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\notepad.exe
E:\Programme\Trillian\trillian.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [THGuard] "E:\Programme\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AudioDeck] C:\Programme\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "E:\Programme\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll
O17 - HKLM\System\CCS\Services\Tcpip\..\{86E43F81-8E54-45B7-9576-06C814B8E787}: NameServer = 217.237.151.33 217.237.149.225
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - e:\Programme\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - e:\Programme\ewido\security suite\ewidoguard.exe
O23 - Service: Defragmentation Management Handler (FAT Defragmentation) - Unknown owner - C:\WINDOWS\System32\dfrgfat32.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe



thx a lot so far dude!

[greyknight17]

Let's see if this will do the job:

Go to Start->Run and type in regedit and hit OK. Go to File->Export and save the registry somewhere as a backup. Close the Registry Editor now. Go to Start->Run and type in notepad and hit OK. Then copy and paste the following into Notepad:

REGEDIT4
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Enum\Root\FAT Defragmentation]
[-HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\FAT Defragmentation]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Enum\Root\FAT Defragmentation]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\FAT Defragmentation]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Enum\Root\FAT Defragmentation]
[-HKEY_LOCAL_MACHINE\SYSTEM\ControlSet003\Services\FAT Defragmentation]

Save the file as "delete.reg". Make sure to save it with the quotes. Double click on it and choose Yes to merge it. You may delete the file afterwards.

Restart and post a new HijackThis log.

[BerlinMassive]

whoa, looks like it worked!!
not quite sure though... here's the log:

Logfile of HijackThis v1.99.1
Scan saved at 00:38:37, on 05.10.2005
Platform: Windows XP SP1 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
e:\Programme\ewido\security suite\ewidoctrl.exe
C:\WINDOWS\Explorer.EXE
e:\Programme\ewido\security suite\ewidoguard.exe
C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe
C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Programme\Kerio\Personal Firewall 4\kpf4gui.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Programme\VIAudioi\SBADeck\ADeck.exe
C:\Programme\Java\jre1.5.0_04\bin\jusched.exe
C:\Programme\QuickTime\qttask.exe
C:\Dokumente und Einstellungen\Massive\Desktop\HijackThis.exe
E:\Programme\iTunes\iTunesHelper.exe
C:\WINDOWS\System32\ctfmon.exe
C:\Programme\iPod\bin\iPodService.exe

O3 - Toolbar: &Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINDOWS\System32\msdxm.ocx
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [THGuard] "E:\Programme\TrojanHunter 4.2\THGuard.exe"
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AudioDeck] C:\Programme\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programme\Java\jre1.5.0_04\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "E:\Programme\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\ctfmon.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.5.0_04\bin\npjpi150_04.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: ewido security suite control - ewido networks - e:\Programme\ewido\security suite\ewidoctrl.exe
O23 - Service: ewido security suite guard - ewido networks - e:\Programme\ewido\security suite\ewidoguard.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programme\iPod\bin\iPodService.exe
O23 - Service: Kerio Personal Firewall 4 (KPF4) - Kerio Technologies - C:\Programme\Kerio\Personal Firewall 4\kpf4ss.exe

[greyknight17]

That did it

Your log is clean.

To help prevent future spyware installations/infections, please read the Anti-Spyware Tutorial and use the tools provided.

Are there any problems now? If not, you should be set to go.

[BerlinMassive]

rock n roll, dude! thx a bunch, seriously! other boards just told me that my pc was helplessly screwed, there'd be no way to save it, except completely formating it!
rock on, dude!

greetz from Germany!
BerlinMassive

[greyknight17]

Since this issue appears to be resolved ... this Topic has been closed. Glad we could help.

If you're the topic starter, and need this topic reopened, please contact a staff member with the address of the thread.

Everyone else please begin a New Topic.