Jump to content

HJT log.. Pleasssseeee help!


Recommended Posts

Hi guys,

 

I was organising my favs folder and clicked on a link that I have not visited for almost a year.. and you guessed it.. I was swamped with popups and several things all happening at the same time!

 

My Task Manager was disabled, Windows Firewall turned off, "Members Club" icon added to the desktop and so on..

 

So far I have run the following progs..

 

AdAware x 5 times

SpyBot SD x 5 times

Panda Active Scan x 4 times

TrendMicro online scan x 3 times

Microsoft Malicious Software Removal Tool

SpyWare Doctor x 5 times

Registry Mechanic x 5 times

CCleaner x 4 times

AntiVir x 3 times

 

All the progs found nasties, about 15-20 different virus or trojans except for the Microsoft tool.

 

I think I got most of the problems fixed apart from the following..

 

I have an instance of iexplore.exe showing in Task Manager as soon as I boot up.. I have not started Internet Explorer and the pc is not even connected to the net at this point.

 

This instance of iexplore.exe is running under "SYSTEM" User Name, where as any IE that I start runs under my User Name.. Phil

I think this instance of IE is running as a downloader or something as my net connection is now painfully slow!!

 

I have run HJT and i notice this line

 

F3 - REG:win.ini: run=,

 

could this be the problem?

 

Here is the full HJT log.

 

 

Logfile of HijackThis v1.99.1

Scan saved at 17:59:40, on 15/01/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Spyware Doctor\sdhelp.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\alg.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\taskmgr.exe

C:\HJT\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bbc.co.uk/

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = webcache.dsl.pipex.com:3128

F3 - REG:win.ini: run=,

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll

O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll

O3 - Toolbar: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - (no file)

O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll

O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)

O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKCU\..\Run: [skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html

O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html

O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html

O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html

O8 - Extra context menu item: Linked Ima&ges - C:\Program Files\IEimage\IEimage.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll

O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O9 - Extra button: Linked Images - {D8980DE8-9D4C-4fb0-8FB4-95B1FA4125AD} - C:\Program Files\IEimage\IEimage.htm

O9 - Extra 'Tools' menuitem: Linked Ima&ges - {D8980DE8-9D4C-4fb0-8FB4-95B1FA4125AD} - C:\Program Files\IEimage\IEimage.htm

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O15 - Trusted Zone: http://download.windowsupdate.com

O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab

O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab

O16 - DPF: {0D6709DD-4ED8-40CA-B459-2757AEEF7BEE} (Dldrv2 Control) - http://download.gigabyte.com.tw/object/Dldrv.ocx

O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB

O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://eu-housecall.trendmicro-europe.com/...ivex/hcImpl.cab

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay102.hotmail.msn.com/resources/MsnPUpld.cab

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} -

O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://pestpatrol.com/pestscan/pestscan.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab

O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} -

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1094503925781

O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://eu-housecall.trendmicro-europe.com/...ivex/hcImpl.cab

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...StatsClient.cab

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} -

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {9CCE3B43-4DE0-4236-A84E-108CA848EE6A} (WebCam Control) - http://webcamnow.com/fs5/ax/ActiveXWebCam.cab

O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab

O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab

O16 - DPF: {AE9DCB17-F804-11D2-A44A-0020182C1446} (IntraLaunch.MainControl) - file://E:\SuperCD\IntraLaunch.CAB

O16 - DPF: {BF6BBE9A-0656-4598-A0CD-32DAC03959B5} (Image Uploader 3.0 Control) - http://www.jessopsphotoexpress.com/wpp/jes...opcuploader.cab

O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab

O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/...759/mcfscan.cab

O16 - DPF: {EFAEF0E4-F044-4D57-9900-1C3FF18524C9} (AV Class) - http://www.pcpitstop.com/antivirus/PitPav.cab

O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{A83F928D-3140-4999-82F7-5A401457BC7D}: NameServer = 62.241.162.200,62.241.163.200

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs:

O20 - Winlogon Notify: partnershipreg - C:\Documents and Settings\All Users\Documents\Settings\partnership.dll

O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe

 

I would be greatful if anyone could have a look at this for me..

 

:pullhair: ...if only I had the hair to pull!!!

 

Many thanks,

Phil

Link to post
Share on other sites

Hiya Trogan,

 

Many thanks for helping me.. is it bad??

 

Here is the log from FindAWF

 

 

Find AWF report by noahdfear ©2006

 

 

21504 byte files found

~~~~~~~~~~~~~

 

 

 

21504 byte files sorted with strings

~~~~~~~~~~~~~~~~~~~~~

 

 

 

25600 byte files found

~~~~~~~~~~~~~

 

 

 

25600 byte files sorted with strings

~~~~~~~~~~~~~~~~~~~~~

 

 

 

26450 byte files found

~~~~~~~~~~~~~

 

 

 

26450 byte files sorted with strings

~~~~~~~~~~~~~~~~~~~~~

 

 

 

bak folders found

~~~~~~~~~~~

 

 

Directory of C:\PROGRA~1\SPYBOT~1\BAK

 

31/05/2005 00:04 1,415,824 TeaTimer.exe

1 File(s) 1,415,824 bytes

 

Directory of C:\WINDOWS\SYSTEM32\BAK

 

04/10/2001 10:22 32,768 Starter.Exe

1 File(s) 32,768 bytes

 

Directory of C:\PROGRA~1\PANICW~1\POP-UP~1\BAK

 

29/04/2003 09:40 524,288 PSFree.exe

1 File(s) 524,288 bytes

 

Directory of C:\PROGRA~1\CREATIVE\MEDIAS~1\DETECTOR\BAK

 

02/12/2004 17:23 102,400 CTDetect.exe

1 File(s) 102,400 bytes

 

Directory of C:\PROGRA~1\JAVA\J2RE14~1.2_0\BIN\BAK

 

19/08/2003 16:23 32,873 jusched.exe

1 File(s) 32,873 bytes

 

 

Duplicate files of bak directory contents

~~~~~~~~~~~~~~~~~~~~~~~

 

1415824 31 May 2005 "C:\Program Files\Spybot - Search & Destroy\bak\TeaTimer.exe"

405504 19 Jan 2003 "C:\Program Files\CodeStuff\Starter\Starter.exe"

32768 4 Oct 2001 "C:\WINDOWS\system32\bak\Starter.Exe"

32768 4 Oct 2001 "C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\starter.exe"

524288 29 Apr 2003 "C:\Program Files\Panicware\Pop-Up Stopper Free Edition\bak\PSFree.exe"

102400 2 Dec 2004 "C:\Program Files\Creative\MediaSource\Detector\bak\CTDetect.exe"

32873 19 Aug 2003 "C:\Program Files\Java\j2re1.4.2_01\bin\bak\jusched.exe"

 

 

end of report

 

 

Cheers,

Phil

Link to post
Share on other sites

No probs Trogan,

 

Also I am in the process of running BitDefender online scan..

 

It has found a few problems.. here is its report,

 

Scanned File

Status

 

C:\Documents and Settings\Phil\UGf3elt.exe

Infected with: Trojan.Agent.AHH

 

C:\Documents and Settings\Phil\UGf3elt.exe

Deleted

 

C:\System Volume Information\_restore{38211ADF-EBD0-41B3-923B-273BCC089601}\RP4\A0002106.exe

Infected with: Trojan.Agent.AHH

 

C:\System Volume Information\_restore{38211ADF-EBD0-41B3-923B-273BCC089601}\RP4\A0002106.exe

Deleted

 

Again, many thanks for helping me with this :-)

Edited by StarBear
Link to post
Share on other sites

Hi Phil! Apologies again for the delay.

 

Please do the following...

 

1. You may wish to Print or Save the following instructions, as the internet will not be available once in Safe Mode!

 

Please download AVG Anti-Spyware to your Desktop or to your usual Download Folder.

http://www.ewido.net/en/download/

  • Install AVG Anti-Spyware by double clicking the installer.
  • Follow the prompts. Make sure that Launch AVG Anti-Spyware is checked.
  • On the main screen under Your Computer's security.
    • Click on Change state next to Resident shield. It should now change to inactive.
    • Click on Change state next to Automatic updates. It should now change to inactive.
    • Next to Last Update, click on Update now. (You will need an active internet connection to perform this)
    • Wait until you see the Update succesfull message.
  • Right-click the AVG Anti-Spyware Tray Icon and uncheck Start with Windows.
  • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
If you are having problems with the updater, you can use this link to manually update ewido.

AVG Anti-Spyware manual updates.

Download the Full database to your Desktop or to your usual Download Folder and install it by double clicking the file. Make sure that AVG Anti-Spyware is closed before installing the update.

 

2. Download these files to your Desktop. Right-click and select Save Links As (in Firefox) or Save Target As (in IE) to download them.

Don't do anything with them yet!

 

3. Open Notepad!

Copy and Paste everything from the Quote box into Notepad:

 

if exist "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" del /q "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"

copy /y "C:\Program Files\Spybot - Search & Destroy\bak\TeaTimer.exe" "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"

 

if exist "C:\WINDOWS\system32\Starter.Exe" del /q "C:\WINDOWS\system32\Starter.Exe"

copy /y "C:\WINDOWS\system32\bak\Starter.Exe" "C:\WINDOWS\system32\Starter.Exe"

 

if exist "C:\Program Files\Panicware\Pop-Up Stopper Free Edition\PSFree.exe" del /q "C:\Program Files\Panicware\Pop-Up Stopper Free Edition\PSFree.exe"

copy /y "C:\Program Files\Panicware\Pop-Up Stopper Free Edition\bak\PSFree.exe" "C:\Program Files\Panicware\Pop-Up Stopper Free Edition\PSFree.exe"

 

if exist "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" del /q "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe"

copy /y "C:\Program Files\Creative\MediaSource\Detector\bak\CTDetect.exe" "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe"

 

if exist "C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe" del /q "C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe"

copy /y "C:\Program Files\Java\j2re1.4.2_01\bin\bak\jusched.exe" "C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe"

Go to File > Save As

Save File name as "Fix.bat" (including quotes)

Save the file to your Desktop

 

Don't do anything with this yet!

 

4. Open HijackThis

- Click the Do a system scan only button

- Check the following entries (below)

 

F3 - REG:win.ini: run=,

 

O16 - DPF: {AE9DCB17-F804-11D2-A44A-0020182C1446} (IntraLaunch.MainControl) - file://E:\SuperCD\IntraLaunch.CAB

 

O20 - AppInit_DLLs:

O20 - Winlogon Notify: partnershipreg - C:\Documents and Settings\All Users\Documents\Settings\partnership.dll

 

- Close ALL open windows (especially Internet Explorer!)

- Click Fix Checked

Close HiajckThis

 

5. Reboot your computer in Safe Mode.

  • If the computer is running, shut down Windows, and then turn off the power.
  • Wait 30 seconds, and then turn the computer on.
  • Start tapping the F8 key. The Windows Advanced Options Menu appears. If you begin tapping the F8 key too soon, some computers display a "keyboard error" message. To resolve this, restart the computer and try again.
  • Ensure that the Safe Mode option is selected.
  • Press Enter. The computer then begins to start in Safe mode.
  • Login on your usual account.
6. Once in Safe Mode, find and delete the following File:

 

C:\Documents and Settings\All Users\Documents\Settings\partnership.dll <-- This file

 

7. Next, locate Fix.bat on your Desktop and double-click it. A black box will open and close quickly - that is normal!

 

8. Close ALL open Windows / Programs / Folders. Please start AVG Anti-Spyware and run a full scan.

  • Click on Scanner on the toolbar.
  • Click on the Settings tab.
    • Under How to act?
      • Click on Recommended Action and choose Quarantine from the popup menu.
    • Under How to scan?
      • All checkboxes should be ticked.
    • Under Possibly unwanted software:
      • All checkboxes should be ticked.
    • Under Reports:
      • Select Automatically generate report after every scan and uncheck Only if threats were found.
    • Under What to scan?
      • Select Scan every file.
  • Click on the Scan tab.
  • Click on Complete System Scan to start the scan process.
  • Let the program scan the machine.
  • When the scan has finished, follow the instructions below.

    IMPORTANT : Don't click on the "Save Scan Report" button before you did hit the "Apply all Actions" button.

    • Make sure that Set all elements to: shows Quarantine (1), if not click on the link and choose Quarantine from the popup menu. (2)
    • At the bottom of the window click on the Apply all Actions button. (3)

      Posted Image

  • When done, click the Save Scan Report button. (4)
    • Click the Save Report as button.
    • Save the report to your Desktop.
  • Right-click the AVG Anti-Spyware Tray Icon and select Exit. Confirm by clicking Yes.
Reboot back into Normal Mode

 

9. Locate the two files you downloaded earlier...

 

For DelDomains.inf..

  • Right-click on DelDomains.inf, and choose Install.
  • You may not see any noticeable changes or prompts; this is normal.
  • You will have to re-immunize with SpywareBlaster, IE-SPYAD, and/or Spybot - Search & Destroy after doing this.
For ResetProtocolDefaults.reg...
  • Locate ResetProtocolDefaults.reg which should be on your desktop.
  • Right-click and select: Merge.
  • OK the prompt.
10. Run FindAWF once more

 

11. Please post the following...

 

1) AVG anti-spyware log

2) FindAWF log

3) New HijackThis log

Link to post
Share on other sites

Thanks Trogan..

Wow.. I hope I dont get this wrong!!

 

I had major problems deleting the "partnership.dll" file. I kept getting a file in use error.

I did a google and found this link really usefull.. and it used HJT to delete the file!!

 

:spam:/2005/06/windox-xp-error-cannot-delete-file.html" target="_blank">http://labnol.:spam:/2005/06/windox-...elete-file.html

 

So I was then able to follow the rest of your instructions.. and thank you for being so complete in them!

 

 

Here are the new logs.. fingers crossed!

 

AVG

 

---------------------------------------------------------

AVG Anti-Spyware - Scan Report

---------------------------------------------------------

 

+ Created at: 18:00:30 17/01/2007

 

+ Scan result:

 

 

 

HKU\.DEFAULT\Software\Internet Security -> Adware.Generic : Cleaned with backup (quarantined).

HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0D045BAA-4BD3-4C94-BE8B-21536BD6BD9F} -> Adware.Generic : Cleaned with backup (quarantined).

HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{67982BB7-0F95-44C5-92DC-E3AF3DC19D6D} -> Adware.Generic : Cleaned with backup (quarantined).

HKU\S-1-5-18\Software\Internet Security -> Adware.Generic : Cleaned with backup (quarantined).

HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0D045BAA-4BD3-4C94-BE8B-21536BD6BD9F} -> Adware.Generic : Cleaned with backup (quarantined).

HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{67982BB7-0F95-44C5-92DC-E3AF3DC19D6D} -> Adware.Generic : Cleaned with backup (quarantined).

C:\WINDOWS\system32\dgflibxxx.dll -> Downloader.Vidlo.ab : Cleaned with backup (quarantined).

C:\Program Files\paintshoppro8\PSPCRK.EXE -> Not-A-Virus.VirTool.Win32.AvSpoffer.a : Cleaned with backup (quarantined).

C:\Program Files\paintshoppro8\paint.shop.pro.8.00.CRACK.exe/pspcrk.exe -> Not-A-Virus.VirTool.Win32.AvSpoffer.a : Cleaned with backup (quarantined).

C:\Documents and Settings\Phil\Cookies\[email protected][2].txt -> TrackingCookie.2o7 : Cleaned.

C:\Documents and Settings\Phil\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Cleaned.

C:\Documents and Settings\Phil\Local Settings\Temp\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Cleaned.

C:\Documents and Settings\Phil\Local Settings\Temp\Cookies\[email protected][1].txt -> TrackingCookie.Adtech : Cleaned.

C:\Documents and Settings\Phil\Cookies\[email protected][1].txt -> TrackingCookie.Advertising : Cleaned.

C:\Documents and Settings\Phil\Cookies\[email protected][1].txt -> TrackingCookie.Doubleclick : Cleaned.

C:\Documents and Settings\Phil\Local Settings\Temp\Cookies\[email protected][1].txt -> TrackingCookie.Doubleclick : Cleaned.

C:\Documents and Settings\Phil\Cookies\[email protected][2].txt -> TrackingCookie.Mediaplex : Cleaned.

C:\Documents and Settings\Phil\Local Settings\Temp\Cookies\[email protected][2].txt -> TrackingCookie.Mediaplex : Cleaned.

C:\Documents and Settings\Phil\Cookies\[email protected][2].txt -> TrackingCookie.Statcounter : Cleaned.

C:\Documents and Settings\Phil\Local Settings\Temp\Cookies\[email protected][1].txt -> TrackingCookie.Tacoda : Cleaned.

C:\Documents and Settings\Phil\Cookies\[email protected][1].txt -> TrackingCookie.Tradedoubler : Cleaned.

C:\Program Files\Adobe\Photoshop CS\Adobe.Photoshop.CS.v8.0.Activation.Keygen.zip/adobe_cs_keygen.exe -> Worm.Delf.bd : Cleaned with backup (quarantined).

C:\Program Files\Adobe\Photoshop CS\adobe_cs_keygen.exe -> Worm.Delf.bd : Cleaned with backup (quarantined).

C:\Program Files\PhotoShope\Adobe Photoshop CS v8.0 (Activation Keygen by Midnight).exe -> Worm.Delf.bd : Cleaned with backup (quarantined).

 

 

::Report end

 

----------------------------------------------------------------------------------------------------------------------------

 

 

FindAWF.

 

Find AWF report by noahdfear ©2006

 

 

21504 byte files found

~~~~~~~~~~~~~

 

 

 

21504 byte files sorted with strings

~~~~~~~~~~~~~~~~~~~~~

 

 

 

25600 byte files found

~~~~~~~~~~~~~

 

 

 

25600 byte files sorted with strings

~~~~~~~~~~~~~~~~~~~~~

 

 

 

26450 byte files found

~~~~~~~~~~~~~

 

 

 

26450 byte files sorted with strings

~~~~~~~~~~~~~~~~~~~~~

 

 

 

bak folders found

~~~~~~~~~~~

 

 

Directory of C:\PROGRA~1\SPYBOT~1\BAK

 

31/05/2005 00:04 1,415,824 TeaTimer.exe

1 File(s) 1,415,824 bytes

 

Directory of C:\WINDOWS\SYSTEM32\BAK

 

04/10/2001 10:22 32,768 Starter.Exe

1 File(s) 32,768 bytes

 

Directory of C:\PROGRA~1\PANICW~1\POP-UP~1\BAK

 

29/04/2003 09:40 524,288 PSFree.exe

1 File(s) 524,288 bytes

 

Directory of C:\PROGRA~1\CREATIVE\MEDIAS~1\DETECTOR\BAK

 

02/12/2004 17:23 102,400 CTDetect.exe

1 File(s) 102,400 bytes

 

Directory of C:\PROGRA~1\JAVA\J2RE14~1.2_0\BIN\BAK

 

19/08/2003 16:23 32,873 jusched.exe

1 File(s) 32,873 bytes

 

 

Duplicate files of bak directory contents

~~~~~~~~~~~~~~~~~~~~~~~

 

1415824 31 May 2005 "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"

1415824 31 May 2005 "C:\Program Files\Spybot - Search & Destroy\bak\TeaTimer.exe"

32768 4 Oct 2001 "C:\WINDOWS\system32\Starter.Exe"

405504 19 Jan 2003 "C:\Program Files\CodeStuff\Starter\Starter.exe"

32768 4 Oct 2001 "C:\WINDOWS\system32\bak\Starter.Exe"

32768 4 Oct 2001 "C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\starter.exe"

524288 29 Apr 2003 "C:\Program Files\Panicware\Pop-Up Stopper Free Edition\PSFree.exe"

524288 29 Apr 2003 "C:\Program Files\Panicware\Pop-Up Stopper Free Edition\bak\PSFree.exe"

102400 2 Dec 2004 "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe"

102400 2 Dec 2004 "C:\Program Files\Creative\MediaSource\Detector\bak\CTDetect.exe"

32873 19 Aug 2003 "C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe"

32873 19 Aug 2003 "C:\Program Files\Java\j2re1.4.2_01\bin\bak\jusched.exe"

 

 

end of report

 

----------------------------------------------------------------------------------------------------------------------

 

HJT

 

Logfile of HijackThis v1.99.1

Scan saved at 18:34:48, on 17/01/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\Spyware Doctor\sdhelp.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\WINDOWS\system32\notepad.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\NOTEPAD.EXE

C:\HJT\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =

 

http://www.bbc.co.uk/

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet

 

Settings,ProxyServer = webcache.dsl.pipex.com:3128

O2 - BHO: AcroIEHlprObj Class -

 

{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program

 

Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: Skype add-on (mastermind) -

 

{22BF413B-C6D2-4d91-82A9-A0F997BA588C} -

 

C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} -

 

C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: PCTools Site Guard -

 

{5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} -

 

C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll

O2 - BHO: PCTools Browser Monitor -

 

{B56A7D7D-6927-48C8-A975-17DF180C71AC} -

 

C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll

O3 - Toolbar: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6}

 

- (no file)

O3 - Toolbar: Easy-WebPrint -

 

{327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program

 

Files\Canon\Easy-WebPrint\Toolband.dll

O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} -

 

(no file)

O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer]

 

KHALMNPR.EXE

O8 - Extra context menu item: E&xport to Microsoft Excel -

 

res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: Easy-WebPrint Add To Print List -

 

res://C:\Program

 

Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html

O8 - Extra context menu item: Easy-WebPrint High Speed Print -

 

res://C:\Program

 

Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html

O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program

 

Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html

O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program

 

Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html

O8 - Extra context menu item: Linked Ima&ges - C:\Program

 

Files\IEimage\IEimage.htm

O9 - Extra button: (no name) -

 

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

 

Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll

O9 - Extra 'Tools' menuitem: Sun Java Console -

 

{08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program

 

Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll

O9 - Extra button: Spyware Doctor -

 

{2D663D1A-8670-49D9-A1A5-4C56B4E14E84} -

 

C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07}

 

- C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} -

 

%windir%\bdoscandel.exe (file missing)

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 -

 

{85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe

 

(file missing)

O9 - Extra button: Linked Images -

 

{D8980DE8-9D4C-4fb0-8FB4-95B1FA4125AD} - C:\Program

 

Files\IEimage\IEimage.htm

O9 - Extra 'Tools' menuitem: Linked Ima&ges -

 

{D8980DE8-9D4C-4fb0-8FB4-95B1FA4125AD} - C:\Program

 

Files\IEimage\IEimage.htm

O9 - Extra button: Messenger -

 

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

 

Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger -

 

{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program

 

Files\Messenger\msmsgs.exe

O12 - Plugin for .spop: C:\Program Files\Internet

 

Explorer\Plugins\NPDocBox.dll

O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers

 

Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab

O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall

 

Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab

O16 - DPF: {0D6709DD-4ED8-40CA-B459-2757AEEF7BEE} (Dldrv2

 

Control) - http://download.gigabyte.com.tw/object/Dldrv.ocx

O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop

 

Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB

O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro

 

ActiveX Scan Agent 6.6) -

 

http://eu-housecall.trendmicro-europe.com/.../html/native/x8

 

6/win32/activex/hcImpl.cab

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class)

 

- C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo

 

Upload Tool) -

 

http://by102fd.bay102.hotmail.msn.com/resources/MsnPUpld.cab

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} -

O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX

 

Control) - http://pestpatrol.com/pestscan/pestscan.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499}

 

(BDSCANONLINE Control) -

 

http://download.bitdefender.com/resources/scan8/oscan8.cab

O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} -

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C}

 

(WUWebControl Class) -

 

http://v5.windowsupdate.microsoft.com/v5co...rols/en/x86/cli

 

ent/wuweb_site.cab?1094503925781

O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro

 

ActiveX Scan Agent 6.5) -

 

http://eu-housecall.trendmicro-europe.com/.../html/native/x8

 

6/win32/activex/hcImpl.cab

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall

 

Control) -

 

http://a840.g.akamai.net/7/840/537/2004061...l.trendmicro.co

 

m/housecall/xscan53.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D}

 

(MessengerStatsClient Class) -

 

http://messenger.zone.msn.com/binary/Messe...StatsClient.cab

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} -

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan

 

Installer Class) -

 

http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {9CCE3B43-4DE0-4236-A84E-108CA848EE6A} (WebCam

 

Control) - http://webcamnow.com/fs5/ax/ActiveXWebCam.cab

O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline

 

Object) - http://www.ravantivirus.com/scan/ravonline.cab

O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial

 

cpcScan) - http://www.crucial.com/controls/cpcScanner.cab

O16 - DPF: {BF6BBE9A-0656-4598-A0CD-32DAC03959B5} (Image

 

Uploader 3.0 Control) -

 

http://www.jessopsphotoexpress.com/wpp/jes...express/app/opc

 

uploader.cab

O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec

 

RuFSI Registry Information Class) -

 

http://security.symantec.com/sscv6/SharedC...mon/bin/cabsa.c

 

ab

O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan

 

Class) -

 

http://download.mcafee.com/molbin/iss-loc/...,0,4759/mcfscan.

 

cab

O16 - DPF: {EFAEF0E4-F044-4D57-9900-1C3FF18524C9} (AV Class) -

 

http://www.pcpitstop.com/antivirus/PitPav.cab

O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat

 

Control 4.5) - http://chat.msn.com/bin/msnchat45.cab

O17 -

 

HKLM\System\CCS\Services\Tcpip\..\{A83F928D-3140-4999-82F7-5A401

 

457BC7D}: NameServer = 62.241.162.200,62.241.163.200

O18 - Protocol: skype4com -

 

{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} -

 

C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: partnershipreg - C:\Documents and Settings\All

 

Users\Documents\Settings\partnership.dll (file missing)

O23 - Service: AntiVir PersonalEdition Classic Scheduler

 

(AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir

 

PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) -

 

AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition

 

Classic\avguard.exe

O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s.

 

- C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology

 

Ltd - C:\WINDOWS\system32\CTsvcCDA.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA

 

Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research

 

Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe

 

------------------------------------------------------------------------------------------

 

I hope I done it right!!

 

Many thanks again Trogan,

 

Cheers Phil

Link to post
Share on other sites

Good job! :)

 

Two things I'd like you to do please.

 

First:

The latest HijackThis log is hard to read with all those spaces. Please create a new log, but when Notepad opens uncheck Word Wrap under the Format tab.

 

Second

Is this a new FindAWF log? It looks like the old one showing the infected files. Could you run a new scan so it can produce a new log please.

 

Post the new HijackThis log and FindAWF log back here.

Link to post
Share on other sites

Sorry Trogan!!

 

I ran FindAWF and I'm "fairly" sure I poseted the new log.. :blink:

but just incase i ran it again.. log is below HJT log.

 

here is the new HJT log

 

Logfile of HijackThis v1.99.1

Scan saved at 23:15:29, on 17/01/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\Spyware Doctor\sdhelp.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\alg.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\HJT\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bbc.co.uk/

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = webcache.dsl.pipex.com:3128

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll

O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll

O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)

O3 - Toolbar: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - (no file)

O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll

O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)

O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [regsrvc] C:\Program Files\Retina-X Studios\AceSpy\systune -min

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html

O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html

O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html

O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html

O8 - Extra context menu item: Linked Ima&ges - C:\Program Files\IEimage\IEimage.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll

O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O9 - Extra button: Linked Images - {D8980DE8-9D4C-4fb0-8FB4-95B1FA4125AD} - C:\Program Files\IEimage\IEimage.htm

O9 - Extra 'Tools' menuitem: Linked Ima&ges - {D8980DE8-9D4C-4fb0-8FB4-95B1FA4125AD} - C:\Program Files\IEimage\IEimage.htm

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab

O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab

O16 - DPF: {0D6709DD-4ED8-40CA-B459-2757AEEF7BEE} (Dldrv2 Control) - http://download.gigabyte.com.tw/object/Dldrv.ocx

O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB

O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://eu-housecall.trendmicro-europe.com/...ivex/hcImpl.cab

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay102.hotmail.msn.com/resources/MsnPUpld.cab

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} -

O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://pestpatrol.com/pestscan/pestscan.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab

O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} -

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1094503925781

O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://eu-housecall.trendmicro-europe.com/...ivex/hcImpl.cab

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...StatsClient.cab

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} -

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {9CCE3B43-4DE0-4236-A84E-108CA848EE6A} (WebCam Control) - http://webcamnow.com/fs5/ax/ActiveXWebCam.cab

O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab

O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab

O16 - DPF: {BF6BBE9A-0656-4598-A0CD-32DAC03959B5} (Image Uploader 3.0 Control) - http://www.jessopsphotoexpress.com/wpp/jes...opcuploader.cab

O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab

O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/...759/mcfscan.cab

O16 - DPF: {EFAEF0E4-F044-4D57-9900-1C3FF18524C9} (AV Class) - http://www.pcpitstop.com/antivirus/PitPav.cab

O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{A83F928D-3140-4999-82F7-5A401457BC7D}: NameServer = 62.241.162.200,62.241.163.200

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O20 - Winlogon Notify: partnershipreg - C:\Documents and Settings\All Users\Documents\Settings\partnership.dll (file missing)

O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe

 

--------------------------------------------------------------------------------------------------------------------------

 

FindAWF Log file.

 

 

Find AWF report by noahdfear ©2006

 

 

21504 byte files found

~~~~~~~~~~~~~

 

 

 

21504 byte files sorted with strings

~~~~~~~~~~~~~~~~~~~~~

 

 

 

25600 byte files found

~~~~~~~~~~~~~

 

 

 

25600 byte files sorted with strings

~~~~~~~~~~~~~~~~~~~~~

 

 

 

26450 byte files found

~~~~~~~~~~~~~

 

 

 

26450 byte files sorted with strings

~~~~~~~~~~~~~~~~~~~~~

 

 

 

bak folders found

~~~~~~~~~~~

 

 

Directory of C:\PROGRA~1\SPYBOT~1\BAK

 

31/05/2005 00:04 1,415,824 TeaTimer.exe

1 File(s) 1,415,824 bytes

 

Directory of C:\WINDOWS\SYSTEM32\BAK

 

04/10/2001 10:22 32,768 Starter.Exe

1 File(s) 32,768 bytes

 

Directory of C:\PROGRA~1\PANICW~1\POP-UP~1\BAK

 

29/04/2003 09:40 524,288 PSFree.exe

1 File(s) 524,288 bytes

 

Directory of C:\PROGRA~1\CREATIVE\MEDIAS~1\DETECTOR\BAK

 

02/12/2004 17:23 102,400 CTDetect.exe

1 File(s) 102,400 bytes

 

Directory of C:\PROGRA~1\JAVA\J2RE14~1.2_0\BIN\BAK

 

19/08/2003 16:23 32,873 jusched.exe

1 File(s) 32,873 bytes

 

 

Duplicate files of bak directory contents

~~~~~~~~~~~~~~~~~~~~~~~

 

1415824 31 May 2005 "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe"

1415824 31 May 2005 "C:\Program Files\Spybot - Search & Destroy\bak\TeaTimer.exe"

32768 4 Oct 2001 "C:\WINDOWS\system32\Starter.Exe"

405504 19 Jan 2003 "C:\Program Files\CodeStuff\Starter\Starter.exe"

32768 4 Oct 2001 "C:\WINDOWS\system32\bak\Starter.Exe"

32768 4 Oct 2001 "C:\WINDOWS\system32\ReinstallBackups\0002\DriverFiles\starter.exe"

524288 29 Apr 2003 "C:\Program Files\Panicware\Pop-Up Stopper Free Edition\PSFree.exe"

524288 29 Apr 2003 "C:\Program Files\Panicware\Pop-Up Stopper Free Edition\bak\PSFree.exe"

102400 2 Dec 2004 "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe"

102400 2 Dec 2004 "C:\Program Files\Creative\MediaSource\Detector\bak\CTDetect.exe"

32873 19 Aug 2003 "C:\Program Files\Java\j2re1.4.2_01\bin\jusched.exe"

32873 19 Aug 2003 "C:\Program Files\Java\j2re1.4.2_01\bin\bak\jusched.exe"

 

 

end of report

------------------------------------------------------------------------------------------------------------------------

 

I really hope I did post the wrong log before and that the little buggers ARE gone!

 

Many thanks for your time Trogan :-)

 

ps, where in london are you? I'm in sunny Camberwell ;-)

Link to post
Share on other sites

Hi Phil! I'm from West London...Acton. Heard of it?

 

You posted the correct log and doing everything correctly, thanks.

It looks like the infection has gone as it not showing in your HijackThis log.

 

Lets run another scan...

 

1. Open HijackThis

- Click the Do a system scan only button

- Check the following entries (below)

 

O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)

 

O3 - Toolbar: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - (no file)

O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)

 

O20 - Winlogon Notify: partnershipreg - C:\Documents and Settings\All Users\Documents\Settings\partnership.dll (file missing)

 

- Close ALL open windows (especially Internet Explorer!)

- Click Fix Checked

Close HiajckThis

 

2. Please do an online scan with Kaspersky WebScanner

 

Click on Kaspersky Online Scanner

 

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

  • The program will launch and then begin downloading the latest definition files:
  • Once the files have been downloaded click on NEXT

  • Now click on Scan Settings
  • In the scan settings make that the following are selected:
    • Scan using the following Anti-Virus database:
    Extended (if available otherwise Standard)

    • Scan Options:
    Scan Archives

    Scan Mail Bases

  • Click OK
  • Now under select a target to scan:Select My Computer
  • This will program will start and scan your system.
  • The scan will take a while so be patient and let it run.
  • Once the scan is complete it will display if your system has been infected.
    • Now click on the Save as Text button:
  • Save the file to your desktop.
3. I need to see another log from HijackThis.
  • Run Hijackthis.
  • Click on Open the Misc Tools section.
  • Next click on Open uninstall manager.
  • Press the Save list button.
  • Save the file to your desktop, with the default name of uninstall_list
  • Copy & Paste the entire contents of that file in your in your next post.
4. Please post the following...

 

1) Kaspersky log

2) Uninstall list

3) New HijackThis log

 

Some questions:

  • Do you know what this program is?

    O4 - HKLM\..\Run: [regsrvc] C:\Program Files\Retina-X Studios\AceSpy\systune -min

  • Do you have a Firewall?
  • How is the computer running at present?
Link to post
Share on other sites

Yup, I've heard of Acton... never been there though.. except passing through on the way to Heathrow!

And on a day like today there is no way I'd want to get on a plane lol!

 

 

I'll answer your questions first.

 

I dont know what the O4 - HKLM\..\Run: [regsrvc] C:\Program Files\Retina-X Studios\AceSpy\systune -min is, but I have a vague memory that it may have been a problem in the past, but I'm not certain of it.

 

I have windows Firewall.

 

The PC seems to be running ok, perhaps a tad slow...

 

Here are the new logs,

 

-------------------------------------------------------------------------------

KASPERSKY ONLINE SCANNER REPORT

Thursday, January 18, 2007 11:22:28 AM

Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)

Kaspersky Online Scanner version: 5.0.83.0

Kaspersky Anti-Virus database last update: 18/01/2007

Kaspersky Anti-Virus database records: 259304

-------------------------------------------------------------------------------

 

Scan Settings:

Scan using the following antivirus database: extended

Scan Archives: true

Scan Mail Bases: true

 

Scan Target - My Computer:

A:\

C:\

D:\

E:\

F:\

G:\

H:\

M:\

P:\

 

Scan Statistics:

Total number of scanned objects: 166323

Number of viruses found: 2

Number of infected objects: 3 / 0

Number of suspicious objects: 0

Duration of the scan process: 02:47:57

 

Infected Object Name / Virus Name / Last Action

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped

C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped

C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat Object is locked skipped

C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped

C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped

C:\Documents and Settings\Phil\Cookies\index.dat Object is locked skipped

C:\Documents and Settings\Phil\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped

C:\Documents and Settings\Phil\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped

C:\Documents and Settings\Phil\Local Settings\History\History.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Phil\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped

C:\Documents and Settings\Phil\ntuser.dat Object is locked skipped

C:\Documents and Settings\Phil\ntuser.dat.LOG Object is locked skipped

C:\Program Files\bs\bsplayer211[1].940_clip.exe/data0011 Infected: not-a-virus:AdTool.Win32.WhenU.a skipped

C:\Program Files\bs\bsplayer211[1].940_clip.exe NSIS: infected - 1 skipped

C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

C:\System Volume Information\_restore{38211ADF-EBD0-41B3-923B-273BCC089601}\RP4\A0002163.dll Infected: Trojan-Downloader.Win32.Vidlo.ab skipped

C:\System Volume Information\_restore{38211ADF-EBD0-41B3-923B-273BCC089601}\RP4\change.log Object is locked skipped

C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped

C:\WINDOWS\Sti_Trace.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped

C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped

C:\WINDOWS\system32\config\ACEEvent.evt Object is locked skipped

C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\default Object is locked skipped

C:\WINDOWS\system32\config\default.LOG Object is locked skipped

C:\WINDOWS\system32\config\SAM Object is locked skipped

C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped

C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\SECURITY Object is locked skipped

C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped

C:\WINDOWS\system32\config\software Object is locked skipped

C:\WINDOWS\system32\config\software.LOG Object is locked skipped

C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped

C:\WINDOWS\system32\config\system Object is locked skipped

C:\WINDOWS\system32\config\system.LOG Object is locked skipped

C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped

C:\WINDOWS\system32\h323log.txt Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped

C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped

C:\WINDOWS\Tasks\SCHEDLGU.TXT Object is locked skipped

C:\WINDOWS\wiadebug.log Object is locked skipped

C:\WINDOWS\wiaservc.log Object is locked skipped

D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

G:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

G:\System Volume Information\_restore{38211ADF-EBD0-41B3-923B-273BCC089601}\RP4\change.log Object is locked skipped

M:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

P:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped

 

Scan process completed.

 

----------------------------------------------------------------------------------------------------------------------------

 

Uninstall List

 

802.11g Pen Size Wireless USB 2.0 Adapter HW.32 V1.10

AC3Filter (remove only)

Acronis True Image

Ad-Aware SE Personal

Adobe Acrobat 5.0

Adobe Atmosphere Player for Acrobat and Adobe Reader

Adobe PageMaker 7.0

Adobe Reader 6.0

Adobe Type Manager 4.0

Ahead Nero Burning ROM

ArcSoft PhotoStudio 5.5

ATI - Software Uninstall Utility

ATI Catalyst Control Center

ATI Display Driver

ATI HYDRAVISION

Audacity 1.2.2

AVG Anti-Spyware 7.5

AVI/MPEG/ASF/WMV Splitter 2.31

Avi2Dvd 0.3.2 beta

AVIcodec (remove only)

Avira AntiVir PersonalEdition Classic

AviSynth 2.5

BJ Network Tool

Canon CanoScan Toolbox 4.9

Canon PhotoRecord

Canon PIXMA iP4000R

Canon ScanGear Starter

Canon Utilities Easy-PhotoPrint

Canon Utilities Easy-PrintToolBox

CCleaner (remove only)

CDex extraction audio

CD-LabelPrint

CodeStuff Starter

Corel Graphics Suite 11

Creative MediaSource

Creative Removable Disk Manager

Creative System Information

Creative Zen Vision M

Direct Show Ogg Vorbis Filter (remove only)

DivX

DivX Player

DivxToDVD 0.5.2b

DVB-T USB 2.0

DVD Decrypter (Remove Only)

Easy-WebPrint

eMule

EVEREST Ultimate Edition v3.01

ExtractNow

FinePixViewer Ver.4.1

FUJIFILM DS SERIAL TWAIN

FUJIFILM EZtouch Ver.3.3

FUJIFILM PICTURE SHUTTLE Ver.3.3

FUJIFILM USB Driver

Fujitsu FDX310 Modem

Google Earth

Google Video Player

Graph paper printer

GSpot Codec Information Appliance

HijackThis 1.99.1

HyperCam

HyperSnap-DX 4

ICUII

iDisk Utility for Windows

IEimage

IKEA Home Planner Office

ImageMixer VCD2 for FinePix

Intel A/V Codecs V2.0

Intel Indeo ® Video R3.2 32-bit Driver CODEC

iPod Updater 2004-08-06

IrfanView (remove only)

IsoBuster 1.5

iTunes

iVisit 3.5.4

IZArc 3.4.1.5

Jasc Paint Shop Pro 8

Java 2 Runtime Environment, SE v1.4.2_01

Kaspersky Online Scanner

LG UC35 Camera

Logitech SetPoint

Macromedia Flash Player 8

Macromedia Shockwave Player

Manual CanoScan LiDE 60

MediaLife

Microsoft .NET Framework 1.1

Microsoft Data Access Components KB870669

Microsoft Office XP Professional with FrontPage

MicroStaff WINASPI

mobile PhoneTools

MSN Messenger 7.0

Nic's XviD Decoder

NVIDIA Display Driver

NVIDIA Drivers

Opera

Opera 9.0

Panda ActiveScan

PC Pitstop Optimize 1.5

PCPitstop Panda AntiVirus Scan (remove only)

Pop-Up Stopper Free Edition

PowerArchiver

PowerDVD

Qlock 1.45

RAW FILE CONVERTER LE

RealPlayer

Registry Mechanic 5.0

Rename-It!

Security Task Manager 1.6e

Security Update for Windows XP (KB883939)

Security Update for Windows XP (KB890046)

Security Update for Windows XP (KB896358)

Security Update for Windows XP (KB896422)

Security Update for Windows XP (KB896428)

Shockwave

Skype 3.0

Skype add-on for IE

Skype Plugin Manager

SLD CODEC PACK 1.5.3

Soulseek Client 152

SoulSeek Client 156c

Sound Blaster PCI128 Drivers Online Help

Spybot - Search & Destroy 1.4

Spyware Doctor 4.0

StartupMonitor

StuffIt Standard

TaskSwitchXP

Tweakui Powertoy for Windows XP

Ulead MediaStudio Pro 6.0

Update for Windows XP (KB898461)

VideoLAN VLC media player 0.8.5

Virtual DJ - Atomix Productions

VobSub v2.23 (Remove Only)

Web Retriever

WheresJames Startup Manager 2.1

Winamp (remove only)

Windows Blaster Worm Removal Tool (KB833330)

Windows Installer 3.1 (KB893803)

Windows Media Format Runtime

Windows Media Player 10

Windows Media Player 10 Hotfix - KB895316

Windows XP Hotfix - KB834707

Windows XP Hotfix - KB867282

Windows XP Hotfix - KB873333

Windows XP Hotfix - KB873339

Windows XP Hotfix - KB885250

Windows XP Hotfix - KB885835

Windows XP Hotfix - KB885836

Windows XP Hotfix - KB885884

Windows XP Hotfix - KB886185

Windows XP Hotfix - KB887472

Windows XP Hotfix - KB887742

Windows XP Hotfix - KB888113

Windows XP Hotfix - KB888302

Windows XP Hotfix - KB890047

Windows XP Hotfix - KB890175

Windows XP Hotfix - KB890859

Windows XP Hotfix - KB890923

Windows XP Hotfix - KB891781

Windows XP Hotfix - KB893066

Windows XP Hotfix - KB893086

Windows XP Service Pack 2

WinISO 5.3

WinZip

XnView 1.74

XviD 1.1 final uninstall

 

-----------------------------------------------------------------------------------------------------------------------------

 

And the latest HJT log

 

Logfile of HijackThis v1.99.1

Scan saved at 11:26:29, on 18/01/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\Spyware Doctor\sdhelp.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\alg.exe

C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

C:\WINDOWS\explorer.exe

C:\HJT\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bbc.co.uk/

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = webcache.dsl.pipex.com:3128

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll

O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll

O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll

O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [regsrvc] C:\Program Files\Retina-X Studios\AceSpy\systune -min

O4 - HKCU\..\Run: [spybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html

O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html

O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html

O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html

O8 - Extra context menu item: Linked Ima&ges - C:\Program Files\IEimage\IEimage.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_01\bin\npjpi142_01.dll

O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O9 - Extra button: Linked Images - {D8980DE8-9D4C-4fb0-8FB4-95B1FA4125AD} - C:\Program Files\IEimage\IEimage.htm

O9 - Extra 'Tools' menuitem: Linked Ima&ges - {D8980DE8-9D4C-4fb0-8FB4-95B1FA4125AD} - C:\Program Files\IEimage\IEimage.htm

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab

O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab

O16 - DPF: {0D6709DD-4ED8-40CA-B459-2757AEEF7BEE} (Dldrv2 Control) - http://download.gigabyte.com.tw/object/Dldrv.ocx

O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cab

O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://eu-housecall.trendmicro-europe.com/...ivex/hcImpl.cab

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay102.hotmail.msn.com/resources/MsnPUpld.cab

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} -

O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://pestpatrol.com/pestscan/pestscan.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab

O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} -

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1094503925781

O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://eu-housecall.trendmicro-europe.com/...ivex/hcImpl.cab

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...StatsClient.cab

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} -

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {9CCE3B43-4DE0-4236-A84E-108CA848EE6A} (WebCam Control) - http://webcamnow.com/fs5/ax/ActiveXWebCam.cab

O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab

O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab

O16 - DPF: {BF6BBE9A-0656-4598-A0CD-32DAC03959B5} (Image Uploader 3.0 Control) - http://www.jessopsphotoexpress.com/wpp/jes...opcuploader.cab

O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab

O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/...759/mcfscan.cab

O16 - DPF: {EFAEF0E4-F044-4D57-9900-1C3FF18524C9} (AV Class) - http://www.pcpitstop.com/antivirus/PitPav.cab

O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{A83F928D-3140-4999-82F7-5A401457BC7D}: NameServer = 62.241.162.200,62.241.163.200

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe

 

-----------------------------------------------------------------------------------------------------------------------------

 

Thanks for all your help.

 

Cheers,

Phil

Link to post
Share on other sites

Hi Phil!

 

I dont know what the O4 - HKLM\..\Run: [regsrvc] C:\Program Files\Retina-X Studios\AceSpy\systune -min is, but I have a vague memory that it may have been a problem in the past, but I'm not certain of it.

In that case, it looks like it was installed without your intention. Lets remove it.

 

Please do the following...

 

1. Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.

This program is for XP and Windows 2000 only!

 

Double-click ATF Cleaner.exe to open it.

 

Under Main select the following:

  • Windows Temp
  • Current User Temp
  • All Users Temp
  • Temporary Internet Files
  • Prefetch
  • Java Cache
*The other boxes are optional*

Then click the Empty Selected button.

 

Exit on the Main menu to close the program.

 

2. Open HijackThis

- Click the Do a system scan only button

- Check the following entries (below)

 

O4 - HKLM\..\Run: [regsrvc] C:\Program Files\Retina-X Studios\AceSpy\systune -min

 

- Close ALL open windows (especially Internet Explorer!)

- Click Fix Checked

Close HiajckThis

 

3. Find and delete the following Folders in RED:

 

C:\Program Files\Retina-X Studios

C:\Program Files\bs

 

4. Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. Please follow these steps to remove older version Java components and update to the latest version...

 

Updating Java:

  • Download the latest version of Java Runtime Environment (JRE) 6 .
  • Click the "Download" button to the right.
  • Check the box that says: "Accept License Agreement."
  • The page will refresh.
  • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove the following...
    • Java 2 Runtime Environment, SE v1.4.2_01
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6-windows-i586.exe to install the newest version.
5. Download this file to your Desktop - combofix.exe

Double click combofix.exe & follow the prompts.

When finished, it shall produce a log for you. Post that log in your next reply

 

Note:

Do not mouseclick combofix's window whilst it's running. That may cause it to stall

 

6. Please post the ComboFix log, along with a new HijackThis log.

Link to post
Share on other sites

ok..

 

I've uninstalled and reinstalled the new java.

 

I was able to delete the bs folder, but I could not find the Retina-X Studios folder... do you have any ideas?

 

Here are the new logs,

 

Combo Fix,

 

"Phil" - 07-01-18 13:37:13 Service Pack 2

ComboFix 07-01-18 - Running from: "C:\Documents and Settings\Phil\Desktop"

 

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))

 

 

C:\INSTALL.LOG

C:\Documents and Settings\All Users\Documents\Settings

 

 

((((((((((((((((((((((((((((((( Files Created from 2006-12-18 to 2007-01-18 ))))))))))))))))))))))))))))))))))

 

 

2007-01-18 13:34 <DIR> d-------- C:\Program Files\Common Files\Java

2007-01-18 08:18 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab

2007-01-18 08:18 <DIR> d-------- C:\WINDOWS\LastGood

2007-01-17 11:55 32,768 --a------ C:\WINDOWS\system32\Starter.Exe

2007-01-17 10:01 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys

2007-01-16 22:00 <DIR> d-------- C:\WINDOWS\LastGood.Tmp

2007-01-15 15:11 <DIR> d-------- C:\Program Files\Common Files\Skype

2007-01-15 15:11 <DIR> d-------- C:\DOCUME~1\Phil\Application Data\Skype

2007-01-15 15:11 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\Skype

2007-01-15 15:10 <DIR> d-------- C:\Program Files\Skype

2007-01-15 15:09 20,155,344 --a------ C:\Program Files\SkypeSetup.exe

2007-01-14 20:28 32,768 --a------ C:\WINDOWS\system32\drivers\avgntdd.sys

2007-01-14 20:28 14,848 --a------ C:\WINDOWS\system32\drivers\avgntmgr.sys

2007-01-14 20:28 <DIR> d-------- C:\Program Files\AntiVir PersonalEdition Classic

2007-01-14 20:28 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\AntiVir PersonalEdition Classic

2007-01-14 20:23 <DIR> d-------- C:\Program Files\antivir

2007-01-14 15:14 <DIR> d-------- C:\Program Files\CCleaner

2007-01-14 15:11 455,304 --a------ C:\Program Files\ccsetup136_slim.exe

2007-01-14 05:14 <DIR> d--h----- C:\WINDOWS\PIF

2007-01-13 16:47 <DIR> d-------- C:\DOCUME~1\Phil\Application Data\Powermarks

2007-01-10 14:01 <DIR> d-------- C:\Program Files\Matrixworld.3d.screensaver

2007-01-09 23:21 <DIR> d-------- C:\WINDOWS\matrixfall

2007-01-09 23:04 <DIR> d-------- C:\Program Files\Kryptile ScreenSavers

2007-01-09 02:06 <DIR> d-------- C:\Program Files\MediaMonkey

2007-01-09 02:02 <DIR> d-------- C:\Program Files\media monkey

2007-01-06 23:58 <DIR> d-------- C:\Program Files\NewzToolz

2007-01-06 21:05 639,224 --a------ C:\WINDOWS\system32\drivers\sptd.sys

2007-01-06 20:37 <DIR> d-------- C:\Program Files\DAEMON Tools

2007-01-01 17:04 17,760,256 --a------ C:\WINDOWS\system32\TCMatrix.scr

 

 

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

 

Rootkit driver pe386 is present. A rootkit scan is required

 

2007-01-18 13:34 -------- d-------- C:\Program Files\java

2007-01-18 12:02 -------- d-------- C:\Program Files\icuii

2007-01-17 10:01 -------- d-------- C:\Program Files\grisoft

2007-01-16 22:25 -------- d-------- C:\Program Files\spyware doctor

2007-01-16 22:00 -------- d-------- C:\Program Files\ewido anti-spyware 4.0

2007-01-16 21:34 -------- d-------- C:\Program Files\registry mechanic

2007-01-15 21:03 243624 --a------ C:\DOCUME~1\Phil\Application Data\gdipfontcachev1.dat

2007-01-14 14:12 -------- d-------- C:\Program Files\trojan remover

2007-01-14 14:12 -------- d-------- C:\Program Files\process explorer

2007-01-14 14:12 -------- d-------- C:\Program Files\powerarchiver

2007-01-14 14:12 -------- d-------- C:\Program Files\izarc

2007-01-14 14:12 -------- d-------- C:\Program Files\avicodec

2007-01-10 02:24 -------- d-------- C:\Program Files\photodeluxe he 3.0

2007-01-08 17:43 -------- d-------- C:\Program Files\soulseek

2007-01-03 21:12 -------- d-------- C:\Program Files\wr

2007-01-03 14:48 -------- d-------- C:\Program Files\fish

2006-12-29 21:32 52431 --a------ C:\Program Files\wssr.zip

2006-12-29 02:23 -------- d-------- C:\Program Files\google

2006-12-22 12:24 -------- d-------- C:\DOCUME~1\Phil\Application Data\utorrent

2006-12-01 18:39 -------- d--h----- C:\Program Files\installshield installation information

2006-11-13 22:38 64263 --a------ C:\Program Files\ieimage.zip

2006-11-08 23:32 2420680 --a------ C:\Program Files\hypersnap-dx 4.zip

2006-10-22 21:03 737280 --a------ C:\WINDOWS\iun6002.exe

 

 

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

 

*Note* empty entries & legit default entries are not shown

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]

"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE"

"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"

"regsrvc"="C:\\Program Files\\Retina-X Studios\\AceSpy\\systune -min"

"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0\\bin\\jusched.exe\""

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]

"Installed"="1"

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]

"Installed"="1"

"NoChange"="1"

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]

"Installed"="1"

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]

"backup"="C:\\WINDOWS\\pss\\Adobe Gamma Loader.lnkCommon Startup"

"location"="Common Startup"

"command"="C:\\PROGRA~1\\COMMON~1\\Adobe\\CALIBR~1\\ADOBEG~1.EXE "

"item"="Adobe Gamma Loader"

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ATI CATALYST System Tray.lnk]

"backup"="C:\\WINDOWS\\pss\\ATI CATALYST System Tray.lnkCommon Startup"

"location"="Common Startup"

"command"="C:\\PROGRA~1\\ATITEC~1\\ATI.ACE\\CLI.exe SystemTray"

"item"="ATI CATALYST System Tray"

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]

"backup"="C:\\WINDOWS\\pss\\Logitech SetPoint.lnkCommon Startup"

"location"="Common Startup"

"command"="C:\\PROGRA~1\\Logitech\\SetPoint\\SetPoint.exe "

"item"="Logitech SetPoint"

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Perstray.lnk]

"backup"="C:\\WINDOWS\\pss\\Perstray.lnkCommon Startup"

"location"="Common Startup"

"item"="Perstray"

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Phil^Start Menu^Programs^Startup^RC.exe.lnk]

"backup"="C:\\WINDOWS\\pss\\RC.exe.lnkStartup"

"location"="Startup"

"command"="C:\\PROGRA~1\\DTV\\DVB-TU~1.0\\RC.exe "

"item"="RC.exe"

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eTrustPPAP]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="PPActiveDetection"

"hkey"="HKLM"

"inimapping"="0"

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PeerGuardian]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="PeerGuardian"

"hkey"="HKCU"

"inimapping"="0"

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="qttask"

"hkey"="HKLM"

"inimapping"="0"

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\regsrvc]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="systune -min"

"hkey"="HKLM"

"inimapping"="0"

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]

"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]

"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

 

 

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]

LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0

NetworkService REG_MULTI_SZ DnsCache\0\0

rpcss REG_MULTI_SZ RpcSs\0\0

imgsvc REG_MULTI_SZ StiSvc\0\0

termsvcs REG_MULTI_SZ TermService\0\0

HTTPFilter REG_MULTI_SZ HTTPFilter\0\0

DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0

 

 

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\P]

Shell\AutoRun\command P:\setupSNK.exe

 

 

 

~ ~ ~ ~ ~ ~ ~ ~ Hijackthis Backups ~ ~ ~ ~ ~ ~ ~ ~ ~ ~ ~

 

backup-20070118-125542-118

O4 - HKLM\..\Run: [regsrvc] C:\Program Files\Retina-X Studios\AceSpy\systune -min

backup-20070118-125432-954

O4 - HKLM\..\Run: [regsrvc] C:\Program Files\Retina-X Studios\AceSpy\systune -min

backup-20070118-081331-904

O20 - Winlogon Notify: partnershipreg - C:\Documents and Settings\All Users\Documents\Settings\partnership.dll (file missing)

backup-20070118-081331-925

O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)

backup-20070118-081331-267

O3 - Toolbar: (no name) - {0BF43445-2F28-4351-9252-17FE6E806AA0} - (no file)

backup-20070118-081331-872

O3 - Toolbar: (no name) - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - (no file)

backup-20070117-101215-933

O20 - Winlogon Notify: partnershipreg - C:\Documents and Settings\All Users\Documents\Settings\partnership.dll

backup-20070117-101107-129

O20 - Winlogon Notify: partnershipreg - C:\Documents and Settings\All Users\Documents\Settings\partnership.dll

backup-20070117-101042-102

O16 - DPF: {AE9DCB17-F804-11D2-A44A-0020182C1446} (IntraLaunch.MainControl) - file://E:\SuperCD\IntraLaunch.CAB

backup-20070117-101042-247

F3 - REG:win.ini: run=,

 

Contents of the 'Scheduled Tasks' folder

C:\WINDOWS\tasks\Symantec NetDetect.job

 

Completion time: 07-01-18 13:41:31

 

--------------------------------------------------------------------------------------------------------------------------

 

HJT log

 

Logfile of HijackThis v1.99.1

Scan saved at 14:11:57, on 18/01/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\Spyware Doctor\sdhelp.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\alg.exe

C:\HJT\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = webcache.dsl.pipex.com:3128

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL

O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll

O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll

O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)

O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll

O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [regsrvc] C:\Program Files\Retina-X Studios\AceSpy\systune -min

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html

O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html

O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html

O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html

O8 - Extra context menu item: Linked Ima&ges - C:\Program Files\IEimage\IEimage.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll

O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O9 - Extra button: Linked Images - {D8980DE8-9D4C-4fb0-8FB4-95B1FA4125AD} - C:\Program Files\IEimage\IEimage.htm

O9 - Extra 'Tools' menuitem: Linked Ima&ges - {D8980DE8-9D4C-4fb0-8FB4-95B1FA4125AD} - C:\Program Files\IEimage\IEimage.htm

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab

O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab

O16 - DPF: {0D6709DD-4ED8-40CA-B459-2757AEEF7BEE} (Dldrv2 Control) - http://download.gigabyte.com.tw/object/Dldrv.ocx

O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cab

O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://eu-housecall.trendmicro-europe.com/...ivex/hcImpl.cab

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay102.hotmail.msn.com/resources/MsnPUpld.cab

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} -

O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://pestpatrol.com/pestscan/pestscan.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab

O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} -

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1094503925781

O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://eu-housecall.trendmicro-europe.com/...ivex/hcImpl.cab

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...StatsClient.cab

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} -

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {9CCE3B43-4DE0-4236-A84E-108CA848EE6A} (WebCam Control) - http://webcamnow.com/fs5/ax/ActiveXWebCam.cab

O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab

O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab

O16 - DPF: {BF6BBE9A-0656-4598-A0CD-32DAC03959B5} (Image Uploader 3.0 Control) - http://www.jessopsphotoexpress.com/wpp/jes...opcuploader.cab

O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab

O16 - DPF: {CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA} (Java Plug-in 1.4.2_01) -

O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/...759/mcfscan.cab

O16 - DPF: {EFAEF0E4-F044-4D57-9900-1C3FF18524C9} (AV Class) - http://www.pcpitstop.com/antivirus/PitPav.cab

O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{A83F928D-3140-4999-82F7-5A401457BC7D}: NameServer = 62.241.162.200,62.241.163.200

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe

 

-----------------------------------------------------------------------------------------------------------------------------

 

Cheers,

Phil

Link to post
Share on other sites

Hi Phil! There is still some cleaning left to do as the ComboFix log shows some other infections, unfortunately. :(

 

I was able to delete the bs folder, but I could not find the Retina-X Studios folder... do you have any ideas?

It may not exist. No need to worry about it.

 

Please do the following...

 

1. Download RustBFix from one of the following locations...

 

http://www.uploads.ejvindh.net/rustbfix.exe

 

http://uploads.ejvindh.andymanchesta.com/Rustbfix.exe

 

...and save it to your desktop.

 

Double click on rustbfix.exe to run the tool. If a Rustock.b-infection is found, you will shortly hereafter be asked to reboot the computer. The reboot will probably take quite a while, and perhaps 2 reboots will be needed. But this will happen automatically. After the reboot 2 logfiles will open (%root%\avenger.txt & %root%\rustbfix\pelog.txt). Post the content of these logfiles along with a new HijackThis log in your next reply.

 

2. Open HijackThis

- Click the Do a system scan only button

- Check the following entries (below)

 

O4 - HKLM\..\Run: [regsrvc] C:\Program Files\Retina-X Studios\AceSpy\systune -min

 

O16 - DPF: {56336BCB-3D8A-11D6-A00B-0050DA18DE71} -

O16 - DPF: {CAFEEFAC-0014-0002-0001-ABCDEFFEDCBA} (Java Plug-in 1.4.2_01) -

 

- Close ALL open windows (especially Internet Explorer!)

- Click Fix Checked

Close HiajckThis

 

3. Find and delete the following Folders and Files in RED...

 

C:\Program Files\icuii

C:\Program Files\izarc

C:\Program Files\wr

C:\Program Files\fish

C:\Program Files\wssr.zip

C:\Program Files\ieimage.zip

C:\WINDOWS\iun6002.exe

 

Remove these, unless you know what they are:

 

C:\Program Files\MediaMonkey

C:\Program Files\media monkey

C:\Program Files\NewzToolz

 

4. Reboot the computer and rescan with ComboFix. It will create a new log.

 

5. Please post the following...

 

1) RustBFix logs

2) New ComboFix log

3) New HijackThis log

Link to post
Share on other sites

Ding ding.. next round! lol

 

Ok, of the following folders/files you asked me to delete, two of them belong to programs that I use quite regularly.

 

These being..

 

C:\Program Files\icuii

C:\Program Files\wr

 

Is there specfic issues with these 2 progs?

 

I deleted the others.

 

Here are the new logs.

 

----------------------------------------------------------------------------------------------------------------------------

 

Logfile of The Avenger version 1, by Swandog46

Running from registry key:

\Registry\Machine\System\CurrentControlSet\Services\ddmovxuq

 

*******************

 

Script file located at: \??\C:\Documents and Settings\ffgm^kjd.txt

Script file opened successfully.

 

Script file read successfully

 

Backups directory opened successfully at C:\Avenger

 

*******************

 

Beginning to process script file:

 

Driver PE386 unloaded successfully.

Program C:\Rustbfix\2run.bat successfully set up to run once on reboot.

 

Completed script processing.

 

*******************

 

Finished! Terminate.

 

-----------------------------------------------------------------------------------------------------------------------------

 

************************* Rustock.b-fix -- By ejvindh *************************

18/01/2007 23:46:15.32

 

******************* Pre-run Status of system *******************

 

Rootkit driver PE386 is found. Starting the unload-procedure....

 

Rustock.b-ADS attached to the System32-folder:

:lzx32.sys 70816

Total size: 70816 bytes.

Attempting to remove ADS...

system32: deleted 70816 bytes in 1 streams.

 

Looking for Rustock.b-files in the System32-folder:

No Rustock.b-files found in system32

 

 

******************* Post-run Status of system *******************

 

Rustock.b-driver on the system: NONE!

 

Rustock.b-ADS attached to the System32-folder:

No System32-ADS found.

 

Looking for Rustock.b-files in the System32-folder:

No Rustock.b-files found in system32

 

 

******************************* End of Logfile ********************************

 

----------------------------------------------------------------------------------------------------------------------------

 

ComboFix

 

"Phil" - 07-01-19 0:16:52 Service Pack 2

ComboFix 07-01-18 - Running from: "C:\Documents and Settings\Phil\Desktop"

 

((((((((((((((((((((((((((((((( Files Created from 2006-12-19 to 2007-01-19 ))))))))))))))))))))))))))))))))))

 

 

2007-01-18 23:51 <DIR> d-------- C:\avenger

2007-01-18 23:46 <DIR> d-------- C:\Rustbfix

2007-01-18 13:34 <DIR> d-------- C:\Program Files\Common Files\Java

2007-01-18 08:18 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab

2007-01-17 11:55 32,768 --a------ C:\WINDOWS\system32\Starter.Exe

2007-01-17 10:01 3,968 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys

2007-01-15 15:11 <DIR> d-------- C:\Program Files\Common Files\Skype

2007-01-15 15:11 <DIR> d-------- C:\DOCUME~1\Phil\Application Data\Skype

2007-01-15 15:11 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\Skype

2007-01-15 15:10 <DIR> d-------- C:\Program Files\Skype

2007-01-15 15:09 20,155,344 --a------ C:\Program Files\SkypeSetup.exe

2007-01-14 20:28 32,768 --a------ C:\WINDOWS\system32\drivers\avgntdd.sys

2007-01-14 20:28 14,848 --a------ C:\WINDOWS\system32\drivers\avgntmgr.sys

2007-01-14 20:28 <DIR> d-------- C:\Program Files\AntiVir PersonalEdition Classic

2007-01-14 20:28 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\Application Data\AntiVir PersonalEdition Classic

2007-01-14 20:23 <DIR> d-------- C:\Program Files\antivir

2007-01-14 15:14 <DIR> d-------- C:\Program Files\CCleaner

2007-01-14 15:11 455,304 --a------ C:\Program Files\ccsetup136_slim.exe

2007-01-14 05:14 <DIR> d--h----- C:\WINDOWS\PIF

2007-01-13 16:47 <DIR> d-------- C:\DOCUME~1\Phil\Application Data\Powermarks

2007-01-10 14:01 <DIR> d-------- C:\Program Files\Matrixworld.3d.screensaver

2007-01-09 23:21 <DIR> d-------- C:\WINDOWS\matrixfall

2007-01-09 23:04 <DIR> d-------- C:\Program Files\Kryptile ScreenSavers

2007-01-06 21:05 639,224 --a------ C:\WINDOWS\system32\drivers\sptd.sys

2007-01-06 20:37 <DIR> d-------- C:\Program Files\DAEMON Tools

2007-01-01 17:04 17,760,256 --a------ C:\WINDOWS\system32\TCMatrix.scr

 

 

(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))

 

 

2007-01-18 13:34 -------- d-------- C:\Program Files\java

2007-01-18 12:02 -------- d-------- C:\Program Files\icuii

2007-01-17 10:01 -------- d-------- C:\Program Files\grisoft

2007-01-16 22:25 -------- d-------- C:\Program Files\spyware doctor

2007-01-16 22:00 -------- d-------- C:\Program Files\ewido anti-spyware 4.0

2007-01-16 21:34 -------- d-------- C:\Program Files\registry mechanic

2007-01-15 21:03 243624 --a------ C:\DOCUME~1\Phil\Application Data\gdipfontcachev1.dat

2007-01-14 14:12 -------- d-------- C:\Program Files\trojan remover

2007-01-14 14:12 -------- d-------- C:\Program Files\process explorer

2007-01-14 14:12 -------- d-------- C:\Program Files\powerarchiver

2007-01-14 14:12 -------- d-------- C:\Program Files\avicodec

2007-01-10 02:24 -------- d-------- C:\Program Files\photodeluxe he 3.0

2007-01-08 17:43 -------- d-------- C:\Program Files\soulseek

2007-01-03 21:12 -------- d-------- C:\Program Files\wr

2006-12-29 02:23 -------- d-------- C:\Program Files\google

2006-12-22 12:24 -------- d-------- C:\DOCUME~1\Phil\Application Data\utorrent

2006-12-01 18:39 -------- d--h----- C:\Program Files\installshield installation information

2006-11-08 23:32 2420680 --a------ C:\Program Files\hypersnap-dx 4.zip

 

 

(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

 

*Note* empty entries & legit default entries are not shown

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]

"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE"

"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"

"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.6.0\\bin\\jusched.exe\""

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]

"Installed"="1"

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]

"Installed"="1"

"NoChange"="1"

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]

"Installed"="1"

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder]

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Gamma Loader.lnk]

"backup"="C:\\WINDOWS\\pss\\Adobe Gamma Loader.lnkCommon Startup"

"location"="Common Startup"

"command"="C:\\PROGRA~1\\COMMON~1\\Adobe\\CALIBR~1\\ADOBEG~1.EXE "

"item"="Adobe Gamma Loader"

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^ATI CATALYST System Tray.lnk]

"backup"="C:\\WINDOWS\\pss\\ATI CATALYST System Tray.lnkCommon Startup"

"location"="Common Startup"

"command"="C:\\PROGRA~1\\ATITEC~1\\ATI.ACE\\CLI.exe SystemTray"

"item"="ATI CATALYST System Tray"

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]

"backup"="C:\\WINDOWS\\pss\\Logitech SetPoint.lnkCommon Startup"

"location"="Common Startup"

"command"="C:\\PROGRA~1\\Logitech\\SetPoint\\SetPoint.exe "

"item"="Logitech SetPoint"

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Perstray.lnk]

"backup"="C:\\WINDOWS\\pss\\Perstray.lnkCommon Startup"

"location"="Common Startup"

"item"="Perstray"

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Phil^Start Menu^Programs^Startup^RC.exe.lnk]

"backup"="C:\\WINDOWS\\pss\\RC.exe.lnkStartup"

"location"="Startup"

"command"="C:\\PROGRA~1\\DTV\\DVB-TU~1.0\\RC.exe "

"item"="RC.exe"

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg]

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\eTrustPPAP]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="PPActiveDetection"

"hkey"="HKLM"

"inimapping"="0"

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PeerGuardian]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="PeerGuardian"

"hkey"="HKCU"

"inimapping"="0"

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="qttask"

"hkey"="HKLM"

"inimapping"="0"

 

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\regsrvc]

"key"="SOFTWARE\\Microsoft\\Windows\\CurrentVersion\\Run"

"item"="systune -min"

"hkey"="HKLM"

"inimapping"="0"

 

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]

"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="AVG Anti-Spyware 7.5"

 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]

"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

 

 

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]

LocalService REG_MULTI_SZ Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0

NetworkService REG_MULTI_SZ DnsCache\0\0

rpcss REG_MULTI_SZ RpcSs\0\0

imgsvc REG_MULTI_SZ StiSvc\0\0

termsvcs REG_MULTI_SZ TermService\0\0

HTTPFilter REG_MULTI_SZ HTTPFilter\0\0

DcomLaunch REG_MULTI_SZ DcomLaunch\0TermService\0\0

 

 

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\P]

Shell\AutoRun\command P:\setupSNK.exe

 

 

Contents of the 'Scheduled Tasks' folder

C:\WINDOWS\tasks\Symantec NetDetect.job

 

Completion time: 07-01-19 0:21:12

C:\ComboFix2.txt ... 07-01-18 13:41

 

-----------------------------------------------------------------------------------------------------------------------------

 

HJT

 

Logfile of HijackThis v1.99.1

Scan saved at 00:23:43, on 19/01/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\Spyware Doctor\sdhelp.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\Java\jre1.6.0\bin\jusched.exe

C:\HJT\HijackThis.exe

 

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = webcache.dsl.pipex.com:3128

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL

O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll (file missing)

O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll

O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)

O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll

O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html

O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html

O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html

O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html

O8 - Extra context menu item: Linked Ima&ges - C:\Program Files\IEimage\IEimage.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll (file missing)

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll (file missing)

O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O9 - Extra button: Linked Images - {D8980DE8-9D4C-4fb0-8FB4-95B1FA4125AD} - C:\Program Files\IEimage\IEimage.htm

O9 - Extra 'Tools' menuitem: Linked Ima&ges - {D8980DE8-9D4C-4fb0-8FB4-95B1FA4125AD} - C:\Program Files\IEimage\IEimage.htm

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab

O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab

O16 - DPF: {0D6709DD-4ED8-40CA-B459-2757AEEF7BEE} (Dldrv2 Control) - http://download.gigabyte.com.tw/object/Dldrv.ocx

O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cab

O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://eu-housecall.trendmicro-europe.com/...ivex/hcImpl.cab

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay102.hotmail.msn.com/resources/MsnPUpld.cab

O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://pestpatrol.com/pestscan/pestscan.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab

O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} -

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1094503925781

O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://eu-housecall.trendmicro-europe.com/...ivex/hcImpl.cab

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...StatsClient.cab

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} -

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {9CCE3B43-4DE0-4236-A84E-108CA848EE6A} (WebCam Control) - http://webcamnow.com/fs5/ax/ActiveXWebCam.cab

O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab

O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab

O16 - DPF: {BF6BBE9A-0656-4598-A0CD-32DAC03959B5} (Image Uploader 3.0 Control) - http://www.jessopsphotoexpress.com/wpp/jes...opcuploader.cab

O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab

O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/...759/mcfscan.cab

O16 - DPF: {EFAEF0E4-F044-4D57-9900-1C3FF18524C9} (AV Class) - http://www.pcpitstop.com/antivirus/PitPav.cab

O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{A83F928D-3140-4999-82F7-5A401457BC7D}: NameServer = 62.241.162.200,62.241.163.200

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe

 

-----------------------------------------------------------------------------------------------------------------------------

 

Cheers,

Phil

Link to post
Share on other sites

Hi Phil!

 

Ok, of the following folders/files you asked me to delete, two of them belong to programs that I use quite regularly.

 

These being..

 

C:\Program Files\icuii

C:\Program Files\wr

 

Is there specfic issues with these 2 progs?

No, thats fine. Thanks for letting me know.

 

Just a little left to do...

 

1. Backup Your Registry with ERUNT

  • Please use the following link and scroll down to ERUNT and download it.

    http://aumha.org/freeware/freeware.php

  • For version with the Installer:

    Use the setup program to install ERUNT on your computer

  • For the zipped version:

    Unzip all the files into a folder of your choice.

Click Erunt.exe to backup your registry to the folder of your choice.

 

Note: to restore your registry, go to the folder and start ERDNT.exe

 

2. Open Notepad!

Copy and Paste everything from the Quote box into Notepad:

 

REGEDIT4

 

[-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\regsrvc]

 

Go to File > Save As

Save File name as Fix.reg

Change Save as Type to All Files and save the file to your desktop.

 

Close Notepad, and double-click Fix.reg on your Desktop. When it asks if you want to merge the info to the registry, hit YES/OK

 

3. Reboot the computer and post a new HijackThis log. Let me know how things are too.

Link to post
Share on other sites

Hiya Trogan,

 

Here is the new HJT log.

 

I notice 2 things that I'm no to sure about..

 

1. O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime I dont have Quicktime... can I tick this box in HJT to get rid of this?

 

2. In Task Manager there was an instance of wuauclt.exe, but I always have autoupdates turned off. Would the changes we have been making turn this function on again?

 

----------------------------------------------------------------------------------------------------------------------------

 

Here is the latest HJT log (maybe the last one???? hehe)

 

Logfile of HijackThis v1.99.1

Scan saved at 11:40:40, on 19/01/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\Spyware Doctor\sdhelp.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\alg.exe

C:\Program Files\Java\jre1.6.0\bin\jusched.exe

C:\WINDOWS\system32\wuauclt.exe

C:\HJT\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bbc.co.uk/

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = webcache.dsl.pipex.com:3128

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL

O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll (file missing)

O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll

O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)

O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll

O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"

O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\erunt\AUTOBACK.EXE

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html

O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html

O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html

O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html

O8 - Extra context menu item: Linked Ima&ges - C:\Program Files\IEimage\IEimage.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll (file missing)

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll (file missing)

O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O9 - Extra button: Linked Images - {D8980DE8-9D4C-4fb0-8FB4-95B1FA4125AD} - C:\Program Files\IEimage\IEimage.htm

O9 - Extra 'Tools' menuitem: Linked Ima&ges - {D8980DE8-9D4C-4fb0-8FB4-95B1FA4125AD} - C:\Program Files\IEimage\IEimage.htm

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab

O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab

O16 - DPF: {0D6709DD-4ED8-40CA-B459-2757AEEF7BEE} (Dldrv2 Control) - http://download.gigabyte.com.tw/object/Dldrv.ocx

O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cab

O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://eu-housecall.trendmicro-europe.com/...ivex/hcImpl.cab

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay102.hotmail.msn.com/resources/MsnPUpld.cab

O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://pestpatrol.com/pestscan/pestscan.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab

O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} -

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1094503925781

O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://eu-housecall.trendmicro-europe.com/...ivex/hcImpl.cab

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...StatsClient.cab

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} -

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {9CCE3B43-4DE0-4236-A84E-108CA848EE6A} (WebCam Control) - http://webcamnow.com/fs5/ax/ActiveXWebCam.cab

O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab

O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab

O16 - DPF: {BF6BBE9A-0656-4598-A0CD-32DAC03959B5} (Image Uploader 3.0 Control) - http://www.jessopsphotoexpress.com/wpp/jes...opcuploader.cab

O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab

O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/...759/mcfscan.cab

O16 - DPF: {EFAEF0E4-F044-4D57-9900-1C3FF18524C9} (AV Class) - http://www.pcpitstop.com/antivirus/PitPav.cab

O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{A83F928D-3140-4999-82F7-5A401457BC7D}: NameServer = 62.241.162.200,62.241.163.200

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe

 

---------------------------------------------------------------------------------------------------------------------------

Cheers,

Phil

Link to post
Share on other sites

Hi Phil

 

1. O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime I dont have Quicktime... can I tick this box in HJT to get rid of this?

Yep, you can remove it. Delete the folder also.

 

2. In Task Manager there was an instance of wuauclt.exe, but I always have autoupdates turned off. Would the changes we have been making turn this function on again?

The things we have done should not caused that. I'm sure it will go away soon.

 

This line shows the Java file is missing. You might want to reinstall Java again.

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll (file missing)

 

Apart from that, your log is clean. Let me know how things are.

 

You can delete the Tools we downloaded.

Link to post
Share on other sites

Ok..

 

I got rid of quicktime and reinstalled Java....

 

I did another HJT log, here it is,

 

Logfile of HijackThis v1.99.1

Scan saved at 13:12:42, on 19/01/2007

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\csrss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

C:\Program Files\Spyware Doctor\sdhelp.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\WINDOWS\System32\alg.exe

C:\WINDOWS\system32\taskmgr.exe

C:\Program Files\Outlook Express\msimn.exe

G:\eMule\emule.exe

C:\Program Files\Internet Explorer\iexplore.exe

C:\WINDOWS\system32\msiexec.exe

C:\HJT\HijackThis.exe

 

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bbc.co.uk/

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = webcache.dsl.pipex.com:3128

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx

O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL

O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~2\tools\iesdsg.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0\bin\ssv.dll

O2 - BHO: PCTools Browser Monitor - {B56A7D7D-6927-48C8-A975-17DF180C71AC} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll

O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)

O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll

O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [sunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0\bin\jusched.exe"

O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\erunt\AUTOBACK.EXE

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000

O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_AddToList.html

O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_HSPrint.html

O8 - Extra context menu item: Easy-WebPrint Preview - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Preview.html

O8 - Extra context menu item: Easy-WebPrint Print - res://C:\Program Files\Canon\Easy-WebPrint\Resource.dll/RC_Print.html

O8 - Extra context menu item: Linked Ima&ges - C:\Program Files\IEimage\IEimage.htm

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0\bin\npjpi160.dll

O9 - Extra button: Spyware Doctor - {2D663D1A-8670-49D9-A1A5-4C56B4E14E84} - C:\PROGRA~1\SPYWAR~2\tools\iesdpb.dll

O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\PROGRA~1\Skype\Phone\IEPlugin\SKYPEI~1.DLL

O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)

O9 - Extra button: Linked Images - {D8980DE8-9D4C-4fb0-8FB4-95B1FA4125AD} - C:\Program Files\IEimage\IEimage.htm

O9 - Extra 'Tools' menuitem: Linked Ima&ges - {D8980DE8-9D4C-4fb0-8FB4-95B1FA4125AD} - C:\Program Files\IEimage\IEimage.htm

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll

O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab

O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab

O16 - DPF: {0D6709DD-4ED8-40CA-B459-2757AEEF7BEE} (Dldrv2 Control) - http://download.gigabyte.com.tw/object/Dldrv.ocx

O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - http://www.pcpitstop.com/pcpitstop/PCPitStop.CAB

O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/d...can_unicode.cab

O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://eu-housecall.trendmicro-europe.com/...ivex/hcImpl.cab

O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll

O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay102.hotmail.msn.com/resources/MsnPUpld.cab

O16 - DPF: {56393399-041A-4650-94C7-13DFCB1F4665} (PSFormX Control) - http://pestpatrol.com/pestscan/pestscan.cab

O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab

O16 - DPF: {62475759-9E84-458E-A1AB-5D2C442ADFDE} -

O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1094503925781

O16 - DPF: {6E5A37BF-FD42-463A-877C-4EB7002E68AE} (Trend Micro ActiveX Scan Agent 6.5) - http://eu-housecall.trendmicro-europe.com/...ivex/hcImpl.cab

O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061...all/xscan53.cab

O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/Messe...StatsClient.cab

O16 - DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} -

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {9CCE3B43-4DE0-4236-A84E-108CA848EE6A} (WebCam Control) - http://webcamnow.com/fs5/ax/ActiveXWebCam.cab

O16 - DPF: {A3009861-330C-4E10-822B-39D16EC8829D} (CRAVOnline Object) - http://www.ravantivirus.com/scan/ravonline.cab

O16 - DPF: {A90A5822-F108-45AD-8482-9BC8B12DD539} (Crucial cpcScan) - http://www.crucial.com/controls/cpcScanner.cab

O16 - DPF: {BF6BBE9A-0656-4598-A0CD-32DAC03959B5} (Image Uploader 3.0 Control) - http://www.jessopsphotoexpress.com/wpp/jes...opcuploader.cab

O16 - DPF: {C2FCEF52-ACE9-11D3-BEBD-00105AA9B6AE} (Symantec RuFSI Registry Information Class) - http://security.symantec.com/sscv6/SharedC...n/bin/cabsa.cab

O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/...759/mcfscan.cab

O16 - DPF: {EFAEF0E4-F044-4D57-9900-1C3FF18524C9} (AV Class) - http://www.pcpitstop.com/antivirus/PitPav.cab

O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab

O17 - HKLM\System\CCS\Services\Tcpip\..\{A83F928D-3140-4999-82F7-5A401457BC7D}: NameServer = 62.241.162.200,62.241.163.200

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL

O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\AntiVir PersonalEdition Classic\sched.exe

O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - AVIRA GmbH - C:\Program Files\AntiVir PersonalEdition Classic\avguard.exe

O23 - Service: AVG Anti-Spyware Guard - Anti-Malware Development a.s. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe

O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

O23 - Service: PC Tools Spyware Doctor (SDhelper) - PC Tools Research Pty Ltd - C:\Program Files\Spyware Doctor\sdhelp.exe

 

-----------------------------------------------------------------------------------------------------------------------------

 

Is this really the end?? hehe

 

Many, many thanks for all the time and help you have given me Trogan.. I owe you a big :b33r:

 

Cheers,

Phil

Link to post
Share on other sites

Hi Phil

 

Is this really the end?? hehe

 

Many, many thanks for all the time and help you have given me Trogan.. I owe you a big :b33r:

Your very welcome. We're almost at the end...

 

Quicktime is still showing in the log. Try removing it once more and let me know if it goes. Remove this orphaned entry too.

 

O2 - BHO: (no name) - {BDF3E430-B101-42AD-A544-FADC6B084872} - (no file)

 

Here are some tips for a clean and secure computer.

 

For XP users.

It's a good idea to Flush your System Restore points after ridding yourself of malware. You can clean this by doing the following:

  • Click Start | Help and Support | Undo changes to your computer with System Restore.
  • Click Create A Restore Point then click Next. Give it a name it and then click Create, then Close.
  • Close the Help and Support Center box.
  • Click Start | Run and type Cleanmgr
  • Select (C: ) then click OK.
  • Click the More Options tab.
  • Click Clean Up in the System Restore Section.
This will remove all previous restore points except the newly created one.

 

Make your Internet Explorer more secure

  • From within Internet Explorer click on the Tools menu and then click on Options.
  • Click on the Security tab
  • Click the Internet icon so it becomes highlighted.
  • Click on Default Level and click OK
  • Click on the Custom Level button.
    • Change the Download signed ActiveX controls to Prompt
    • Change the Download unsigned ActiveX controls to Disable
    • Change the Initialise and script ActiveX controls not marked as safe to Disable
    • Change the Installation of desktop items to Prompt
    • Change the Launching programs and files in an IFRAME to Prompt
    • Change the Navigate sub-frames across different domains to Prompt
    • Internet Explorer 7 users: Check all other items and make sure that they meet the (recommended) setting when applies.
    • When all these settings have been made, click on the OK button.
    • If it prompts you as to whether or not you want to save the
    settings, press the Yes button.
  • Next press the Apply button and then the OK to exit the Internet Properties page.
Take the time to check out the following links

 

Introduction to Internet Explorer 7

http://www.microsoft.com/windows/ie/default.mspx

 

Internet Explorer 7 features

http://www.microsoft.com/windows/ie/ie7/ab...es/default.mspx

 

Release Notes for Internet Explorer 7

http://msdn2.microsoft.com/en-us/ie/aa740486.aspx

These Release Notes give you information about installing Internet Explorer® 7 and contain information about known issues and possible workarounds for those issues.

 

Internet Explorer 7 Ressources - In Depth Articles - Known Issues ...

http://www.ie-vista.com/

 

Internet Explorer7 - Phishing Filter Frequently Asked Questions

http://www.microsoft.com/mscorp/safety/tec...ishing/faq.mspx

 

Resources for using Internet Explorer 6

http://support.microsoft.com/?kbid=867470

 

How to Configure Enhanced Security Features for Internet Explorer from Windows XP SP2

http://www.microsoft.com/technet/security/...xp/iesecxp.mspx

 

Safety Home

http://www.microsoft.com/mscorp/safety/default.mspx

 

IEBlog

http://blogs.msdn.com/ie/default.aspx

 

Microsoft Malicious Software Removal Tool

http://www.microsoft.com/security/malwarer...e/families.mspx

 

Keep your Sun Java up to date

 

The most current version of Sun Java is: Java Runtime Environment Version 6.0

http://java.sun.com/javase/downloads/index.jsp

  • Scroll down to where it says "Java Runtime Environment (JRE) 6".
  • Click the "Download" button to the right.
  • Check the box that says: "Accept License Agreement".
  • The page will refresh.
  • Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
  • Close any programs you may have running - especially your web browser.
  • Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
  • Check any item with Java Runtime Environment (JRE or J2SE) in the name.
  • Click the Remove or Change/Remove button.
  • Repeat as many times as necessary to remove each Java versions.
  • Reboot your computer once all Java components are removed.
  • Then from your desktop double-click on jre-6-windows-i586.exe to install the newest version.
And in the future, remember to remove older versions of Java when you update to a newer version to avoid exploitation of older versions left on your system.

 

Check out these topics for more information:

http://spywarewarrior.com/viewtopic.php?t=17910

http://spywarewarrior.com/viewtopic.php?t=17598

 

Free programs that may help you in keeping the PC clean

  • SpywareBlaster

    SpywareBlaster will add a large list of programs and sites into your Internet Explorer settings that will protect you from running and downloading known malicious programs.

    You can download SpywareBlaster here

    A tutorial can be found here

  • SpywareGuard

    It provides a degree of real-time protection solution against spyware that is a great addition to SpywareBlaster's protection method. An anti-virus program scans files before you open them and prevents execution if a virus is detected - SpywareGuard does the same thing, but for spyware. And you can easily have an anti-virus program running alongside SpywareGuard. It also features Download Protection and Browser Hijacking Protection.

    You can download SpywareGuard here

    A tutorial can be found here

  • IE-SPYAD

    IE-SPYAD puts over 5000 sites in your restricted zone, so you'll be protected when you visit innocent-looking sites that aren't actually innocent at all. It basically prevents any downloads, cookies, scripts from the sites listed, although you will still be able to connect to the sites.

    You can download IE-SPYAD here

    A tutorial can be found here

  • Hosts File

    A Hosts file replaces your current HOSTS file with one containing well known ad, spyware sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer.

    A tutorial can be found here

  • MVPS Hosts File

    You can download the MVPS Hosts File here

    Furthermore the website contains useful tips and links to other resources and utilities.

  • Bluetack's Hosts File and Hosts Manager

    Essentially based on the research made by Webhelper, Andrew Clover and Eric L. Howes, it contains most if not all the known spyware sites...sites responsible for hijacks, rogue apllications etc...

    Download Bluetack's Hosts file here

    Download Bluetack's HostsManager here

Free Spyware Detection and Removal Programs
  • Ad-Aware

    It scans for known spyware on your computer. These scans should be run at least once every two weeks.

    You can download Ad-Aware here

    A tutorial can be found here

  • Spybot - Search & Destroy

    It scans for spyware and other malicious programs. Spybot has preventitive tools that stop programs from even installing on your computer.

    You can download Spybot - S&D here

    A tutorial can be found here

Before adding any other Spyware Detection and Removal programs always check the Rogue Anti-Spyware List for programs known to be misleading, mistaken, or just outright "Foistware".

You will find the list here

 

WinPatrol

 

WinPatrol uses a heuristic approach to detecting attacks and violations of your computing environment. Traditional security programs scan your hard drive searching for previously identified threats. WinPatrol takes snapshot of your critical system resources and alerts you to any changes that may occur without your knowledge. You'll be removing dangerous new programs while others download new reference files.

  • Detect & Neutralize Spyware.
  • Detect & Neutralize ADware.
  • Detect & Neutralize Viral infections.
  • Detect & Neutralize Unwanted IE Add-Ons.
  • Detect & Restore File Type Changes.
  • Automatically Filter Unwanted Cookies.
  • Avoid Start Page Hijacking.
  • Detect changes to HOSTS & critical system files.
  • Kill Multiple Tasks that replicate each other, in a single step!
  • Stop programs that repeatedly add themselves to your Startup List!
Starting with WinPatrol 9.5 PLUS users also get the addition of Real-time Infiltration Detection so they'll know immediately when changes are made to critical system areas. WinPatrol Free is not demo or trial software. You're welcome to use it as long as you like.

You can download WinPatrol here

WinPatrol FAQ

 

SiteHound by Firetrust

 

Firetrust introduces the SiteHound Toolbar - the safe way to browse the Internet. With SiteHound, when you browse the Internet, you're shown a warning page every time you go to a site which is a known scam, potentially loads viruses or spyware on to your computer, has questionable content or anything you would not consider reasonable. You are shown a warning page with information about that site. From there you can choose to enter the site or go back. SiteHound is a free add-on to Internet Explorer. (Users of Firefox - a version for you is coming soon.) SiteHound's comprehensive database gathers the knowledge from other users and respected experts from the online security community to tell you which sites are real and which are bogus.

 

SiteHound will alert you when you enter a site which is known to contain:

  • Fraudulent claims or scams
  • Offensive material
  • Security vulnerabilities
  • Spyware or Adware
  • Spam related material
  • or other content deemed to be unsafe
Specifically, SiteHound blocks these categories:

 

o Adult o Spyware o Spam Advertising o Phishing o Possible scam or fraud o Misleading or False Advertising

o Pharming o Rogue or Suspect Product o Adware o Malware or Virus

 

System Requirements:

Internet Explorer 5.5+ and Windows 95/98/NT 4/ME/2000/XP

 

Product Info & Download: SiteHound Toolbar

 

Use an AntiVirus Software

 

It is very important that your computer has an anti-virus software running on your machine. This alone can save you a lot of trouble with malware in the future. See the link below for a listing of some online & their stand-alone antivirus programs.

Computer Safety On line - Anti-Virus

http://forum.malwareremoval.com/viewtopic.php?p=53#53

 

Update your Anti Virus Software

 

It is imperative that you update your Anti virus software at least once a week (Even more if you wish). If you do not update your anti virus software then it will not be able to catch any of the new variants that may come out.

 

Use a Firewall

 

I can not stress enough how important it is that you use a Firewall on your computer. Without a firewall your computer is susceptible to being hacked and taken over. Simply using a Firewall in its default configuration can lower your risk greatly. For an article on Firewalls and a listing of some available ones see the link below.

Computer Safety On line - Software Firewalls

http://forum.malwareremoval.com/viewtopic.php?p=56#56

A tutorial on Understanding and Using Firewalls can be found here

Link to post
Share on other sites

Hiya Trogan,

 

OK, QTime seems to be gone now and the little orphan deleted.

 

Thankyou again and also for the links and advice on different progs and techniques... I'm gonna be a busy boy this weekend going through it all!!

 

 

THANKS!!!

:clap:

 

Phil

Link to post
Share on other sites
×
×
  • Create New...