Possible trojan/keylogger? It hijacked my eBay account!

Discussion in 'Windows - Virus and spyware problems' started by zootie, Sep 25, 2006.

  1. zootie

    zootie Member

    Joined:
    Apr 29, 2006
    Messages:
    16
    Likes Received:
    0
    Trophy Points:
    11
    Hi,

    I think I have a trojan or keylogger on my laptop as my eBay account was hijacked yesterday (all sorted now) and it must have got my personal info from my laptop. AVG, Spybot, Adaware etc have all been run. I have already downloaded hijack and below is the log, I daren't log onto ebay or internet banking on this computer until this is sorted out. Please can someone help!

    Logfile of HijackThis v1.99.1
    Scan saved at 20:37:40, on 25/09/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\PROGRA~1\NCTV\bin\dm.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\WINDOWS\system32\VTtrayp.exe
    C:\WINDOWS\system32\VTTimer.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    C:\Apps\Powercinema\PCMService.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\FinePixViewer\QuickDCF.exe
    C:\Program Files\Logitech\SetPoint\KEM.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\NCTV\bin\dmtray.exe
    C:\Program Files\OpenOffice.org1.1.4\program\soffice.exe
    C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
    C:\Program Files\Linksys\Wireless-G Notebook Adapter\OdHost.exe
    C:\Program Files\Linksys\Wireless-G Notebook Adapter\WPC54Cfg.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Internet Explorer\Iexplore.exe
    C:\WINDOWS\Explorer.EXE
    C:\HJT\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.co.uk
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.virgin.net
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://uk.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://uk.search.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.co.uk
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.virgin.net
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://uk.search.yahoo.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
    O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
    O4 - HKLM\..\Run: [DVD43] C:\PROGRA~1\DVDREG~1\DVDRegionFree.exe /hidden
    O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Virgin Net Broadband\Dragdiag.exe" /icon
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - Startup: E3TV Tray App.lnk = ?
    O4 - Startup: OpenOffice.org 1.1.4.lnk = C:\Program Files\OpenOffice.org1.1.4\program\quickstart.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Exif Launcher.lnk = ?
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
    O4 - Global Startup: Wireless-G Notebook Adapter Utility.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\Startup.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll (file missing)
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll (file missing)
    O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesuk.dll
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesuk.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\uk.htm
    O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
    O16 - DPF: {26CBF141-7D0F-46E1-AA06-718958B6E4D2} - http://download.ebay.com/turbo_lister/UK/install.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{0086105F-D19B-42BE-A0D2-BCBDED4064F5}: NameServer = 192.168.0.2,212.130.104.65
    O17 - HKLM\System\CS1\Services\Tcpip\..\{0086105F-D19B-42BE-A0D2-BCBDED4064F5}: NameServer = 192.168.0.2,212.130.104.65
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: artm_newreg - C:\WINDOWS\
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: Download Manager Lite Service (DownloadManagerLite) - NetCableTV - C:\PROGRA~1\NCTV\bin\dm.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NICSer_WPC54G - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
     
    zootie, Sep 25, 2006
    #1
  2. Niobis

    Niobis Active member

    Joined:
    Jan 30, 2005
    Messages:
    2,326
    Likes Received:
    0
    Trophy Points:
    66
    Yes, you have a Trojan/Backdoor. I'm sorry to inform you this is a big problem. I can try to help you clean it, but even after a clean you still have a risk of getting infected again. The best thing to do is change all your passwords, disconnect the computer from the internet right away and format the harddrive. But, like I said I can try to assist you in ridding it, but I can't promise you will completely safe after the clean.

    It's your choice. If you want me to help, I will. Otherwise, format the drive and start over. Let me know what you choose to do and I will help where I can.
     
    Niobis, Sep 25, 2006
    #2
  3. zootie

    zootie Member

    Joined:
    Apr 29, 2006
    Messages:
    16
    Likes Received:
    0
    Trophy Points:
    11
    Is it really that bad??

    I don't even know where to begin with formatting the hard drive, any help in getting rid of the trojan would be most welcome.

    Why is that? I thought once you got rid of a trojan that was it? How does it become reinfected again?

     
    zootie, Sep 26, 2006
    #3
  4. Niobis

    Niobis Active member

    Joined:
    Jan 30, 2005
    Messages:
    2,326
    Likes Received:
    0
    Trophy Points:
    66
    Luckly after some research I think this one isn't that bad. But there still is the risk of reinfection after killing this thing.

    Even after cleaning some of it's files can hide in the deepest parts of the system and cannot be found to be removed. Once you connect to the internet it contacts home again and get what it needs to give the "writer" access to any part of your computer.

    As requested I will help you. It is hiding right now, so we need it to show itsself.

    Go here to download the trial version of Ewido Anti-spyware.

    Install and update.
    Restart your computer in safe mode(press F8 upon boot, select "Safe Mode" from menu and press Enter).
    Open Ewdio and click "Scanner".
    Click "Complete System Scan".
    When it finishes scanning, set all items to "Quarantine".
    Click "Apply All Actions".
    Click "Save Report".
    Click "Save report as" and save it to the desktop.
    Restart in normal mode.

    Go here and click Kaspersky Online Scanner.
    Accept the terms.
    After downloading, click My Computer.
    After scanning click "Save report as".
    Save as a text file.

    Post back with a new HijackThis log, the Ewdio report and the Kaspersky log.
     
    Last edited: Sep 26, 2006
    Niobis, Sep 26, 2006
    #4
  5. zootie

    zootie Member

    Joined:
    Apr 29, 2006
    Messages:
    16
    Likes Received:
    0
    Trophy Points:
    11
    Logfile of HijackThis v1.99.1
    Scan saved at 22:22:32, on 26/09/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    C:\PROGRA~1\NCTV\bin\dm.exe
    C:\Program Files\ewido anti-spyware 4.0\guard.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\WINDOWS\system32\VTtrayp.exe
    C:\WINDOWS\system32\VTTimer.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    C:\Apps\Powercinema\PCMService.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\ewido anti-spyware 4.0\ewido.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\FinePixViewer\QuickDCF.exe
    C:\Program Files\Logitech\SetPoint\KEM.exe
    C:\Program Files\NCTV\bin\dmtray.exe
    C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
    C:\Program Files\OpenOffice.org1.1.4\program\soffice.exe
    C:\Program Files\Linksys\Wireless-G Notebook Adapter\OdHost.exe
    C:\Program Files\Linksys\Wireless-G Notebook Adapter\WPC54Cfg.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\Explorer.EXE
    C:\HJT\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.co.uk
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.virgin.net
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://uk.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://uk.search.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.co.uk
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.virgin.net
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://uk.search.yahoo.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
    O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
    O4 - HKLM\..\Run: [DVD43] C:\PROGRA~1\DVDREG~1\DVDRegionFree.exe /hidden
    O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Virgin Net Broadband\Dragdiag.exe" /icon
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - Startup: E3TV Tray App.lnk = ?
    O4 - Startup: OpenOffice.org 1.1.4.lnk = C:\Program Files\OpenOffice.org1.1.4\program\quickstart.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Exif Launcher.lnk = ?
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
    O4 - Global Startup: Wireless-G Notebook Adapter Utility.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\Startup.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll (file missing)
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll (file missing)
    O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesuk.dll
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesuk.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\uk.htm
    O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
    O16 - DPF: {26CBF141-7D0F-46E1-AA06-718958B6E4D2} - http://download.ebay.com/turbo_lister/UK/install.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{0086105F-D19B-42BE-A0D2-BCBDED4064F5}: NameServer = 192.168.0.2,212.130.104.65
    O17 - HKLM\System\CS1\Services\Tcpip\..\{0086105F-D19B-42BE-A0D2-BCBDED4064F5}: NameServer = 192.168.0.2,212.130.104.65
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O20 - Winlogon Notify: artm_newreg - C:\WINDOWS\
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
    O23 - Service: Download Manager Lite Service (DownloadManagerLite) - NetCableTV - C:\PROGRA~1\NCTV\bin\dm.exe
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NICSer_WPC54G - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe



    ---------------------------------------------------------
    ewido anti-spyware - Scan Report
    ---------------------------------------------------------

    + Created at: 19:58:33 26/09/2006

    + Scan result:



    C:\WINDOWS\NDNuninstall7_22.exe -> Adware.NewDotNet : Cleaned with backup (quarantined).
    C:\Documents and Settings\SHYRO\Local Settings\Temp\7.dlb -> Downloader.Small.dnk : Cleaned with backup (quarantined).
    C:\Documents and Settings\SHYRO\Local Settings\Temporary Internet Files\Content.IE5\FU4N3LOP\start[1].exe -> Downloader.Small.dul : Cleaned with backup (quarantined).
    C:\Documents and Settings\SHYRO\Local Settings\Temp\6.dlb -> Downloader.Tibs.dr : Cleaned with backup (quarantined).
    C:\Documents and Settings\SHYRO\Local Settings\Temp\2.dlb -> Hijacker.Spywad.o : Cleaned with backup (quarantined).
    C:\Documents and Settings\SHYRO\Cookies\shyro@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined).
    C:\Documents and Settings\SHYRO\Cookies\shyro@www.burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned with backup (quarantined).
    C:\Documents and Settings\SHYRO\Cookies\shyro@e-2dj6wfkismdzmlq.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
    C:\Documents and Settings\SHYRO\Local Settings\Temp\Cookies\shyro@e-2dj6wfk4opczwbp.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
    C:\Documents and Settings\SHYRO\Local Settings\Temp\Cookies\shyro@e-2dj6wfkieidjmkp.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
    C:\Documents and Settings\SHYRO\Local Settings\Temp\Cookies\shyro@e-2dj6wgk4slcjgcp.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
    C:\Documents and Settings\SHYRO\Local Settings\Temp\Cookies\shyro@e-2dj6wjk4smd5sfq.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
    C:\Documents and Settings\SHYRO\Local Settings\Temp\Cookies\shyro@e-2dj6wjl4sgajwbo.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
    C:\Documents and Settings\SHYRO\Local Settings\Temp\Cookies\shyro@e-2dj6wjloopc5acq.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
    C:\Documents and Settings\SHYRO\Local Settings\Temp\Cookies\shyro@e-2dj6wjmygncpgco.stats.esomniture[1].txt -> TrackingCookie.Esomniture : Cleaned with backup (quarantined).
    C:\Documents and Settings\SHYRO\Local Settings\Temp\Cookies\shyro@adopt.euroclick[1].txt -> TrackingCookie.Euroclick : Cleaned with backup (quarantined).
    C:\Documents and Settings\SHYRO\Cookies\shyro@statcounter[2].txt -> TrackingCookie.Statcounter : Cleaned with backup (quarantined).
    C:\Documents and Settings\SHYRO\Cookies\shyro@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup (quarantined).
    C:\Documents and Settings\SHYRO\Cookies\shyro@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned with backup (quarantined).
    C:\Documents and Settings\All Users\Documents\Settings\artm_new.dll -> Trojan.Agent.oh : Cleaned with backup (quarantined).
    C:\Documents and Settings\SHYRO\Local Settings\Temp\artBD25.tmp -> Trojan.Agent.oh : Cleaned with backup (quarantined).
    C:\Documents and Settings\SHYRO\Local Settings\Temp\3fe7.$$$ -> Trojan.Sinowal.az : Cleaned with backup (quarantined).
    C:\Documents and Settings\SHYRO\Local Settings\Temporary Internet Files\Content.IE5\TFN7H54E\vw[1].dat -> Trojan.Sinowal.az : Cleaned with backup (quarantined).
    C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00006.dll -> Trojan.Sinowal.az : Cleaned with backup (quarantined).
    C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00005.dll -> Trojan.Sinowal.k : Cleaned with backup (quarantined).


    ::Report end


    -------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER REPORT
    Tuesday, September 26, 2006 10:16:09 PM
    Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
    Kaspersky Online Scanner version: 5.0.83.0
    Kaspersky Anti-Virus database last update: 26/09/2006
    Kaspersky Anti-Virus database records: 213452
    -------------------------------------------------------------------------------

    Scan Settings:
    Scan using the following antivirus database: standard
    Scan Archives: true
    Scan Mail Bases: true

    Scan Target - My Computer:
    C:\
    D:\

    Scan Statistics:
    Total number of scanned objects: 55816
    Number of viruses found: 12
    Number of infected objects: 16 / 0
    Number of suspicious objects: 1
    Duration of the scan process: 01:08:56

    Infected Object Name / Virus Name / Last Action
    C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
    C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\SHYRO\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\SHYRO\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\SHYRO\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\SHYRO\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\SHYRO\Local Settings\History\History.IE5\MSHist012006092620060927\index.dat Object is locked skipped
    C:\Documents and Settings\SHYRO\Local Settings\Temp\metasploit.exe Infected: Trojan-Downloader.Win32.Tibs.ig skipped
    C:\Documents and Settings\SHYRO\Local Settings\Temporary Internet Files\Content.IE5\49AFOXE7\gc2[1].htm Infected: Exploit.JS.ADODB.Stream.v skipped
    C:\Documents and Settings\SHYRO\Local Settings\Temporary Internet Files\Content.IE5\4X2Z0LYB\sp352452548[1].htm Suspicious: Trojan-Downloader.JS.gen skipped
    C:\Documents and Settings\SHYRO\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\SHYRO\ntuser.dat Object is locked skipped
    C:\Documents and Settings\SHYRO\ntuser.dat.LOG Object is locked skipped
    C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00005.exe Infected: Trojan-PSW.Win32.Sinowal.ay skipped
    C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    C:\System Volume Information\_restore{B1C538C0-CBA3-4434-A006-53A338B37653}\RP315\A0146792.exe Infected: Trojan-Downloader.Win32.Tibs.ig skipped
    C:\System Volume Information\_restore{B1C538C0-CBA3-4434-A006-53A338B37653}\RP315\A0146793.exe Infected: Trojan-Clicker.Win32.Spywad.o skipped
    C:\System Volume Information\_restore{B1C538C0-CBA3-4434-A006-53A338B37653}\RP315\A0146807.exe Object is locked skipped
    C:\System Volume Information\_restore{B1C538C0-CBA3-4434-A006-53A338B37653}\RP315\A0146808.exe Infected: Trojan-Downloader.Win32.Small.dmk skipped
    C:\System Volume Information\_restore{B1C538C0-CBA3-4434-A006-53A338B37653}\RP315\A0146809.exe Infected: Trojan-Downloader.Win32.Small.dkt skipped
    C:\System Volume Information\_restore{B1C538C0-CBA3-4434-A006-53A338B37653}\RP315\A0146810.exe Infected: Trojan-PSW.Win32.Sinowal.ay skipped
    C:\System Volume Information\_restore{B1C538C0-CBA3-4434-A006-53A338B37653}\RP315\A0146812.exe Infected: Trojan-Downloader.Win32.Small.dnk skipped
    C:\System Volume Information\_restore{B1C538C0-CBA3-4434-A006-53A338B37653}\RP315\A0146813.exe Infected: Trojan-Downloader.Win32.Tibs.dr skipped
    C:\System Volume Information\_restore{B1C538C0-CBA3-4434-A006-53A338B37653}\RP315\A0146814.exe Infected: Trojan-Clicker.Win32.Spywad.o skipped
    C:\System Volume Information\_restore{B1C538C0-CBA3-4434-A006-53A338B37653}\RP317\A0146947.dll Infected: Trojan-PSW.Win32.Sinowal.ay skipped
    C:\System Volume Information\_restore{B1C538C0-CBA3-4434-A006-53A338B37653}\RP317\A0146948.dll Infected: Trojan-PSW.Win32.Sinowal.ay skipped
    C:\System Volume Information\_restore{B1C538C0-CBA3-4434-A006-53A338B37653}\RP318\A0150944.exe Infected: Trojan-Downloader.Win32.Small.dul skipped
    C:\System Volume Information\_restore{B1C538C0-CBA3-4434-A006-53A338B37653}\RP319\A0152971.dll Infected: Trojan-PSW.Win32.Sinowal.az skipped
    C:\System Volume Information\_restore{B1C538C0-CBA3-4434-A006-53A338B37653}\RP319\A0152972.dll Infected: Trojan-PSW.Win32.Sinowal.k skipped
    C:\System Volume Information\_restore{B1C538C0-CBA3-4434-A006-53A338B37653}\RP319\change.log Object is locked skipped
    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
    C:\WINDOWS\SchedLgU.Txt Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\EventCache\{CE790400-4E59-4E4B-A8D7-17AEFFCC6BDC}.bin Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
    C:\WINDOWS\Sti_Trace.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
    C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\DEFAULT Object is locked skipped
    C:\WINDOWS\system32\config\default.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SAM Object is locked skipped
    C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SOFTWARE Object is locked skipped
    C:\WINDOWS\system32\config\software.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\SYSTEM Object is locked skipped
    C:\WINDOWS\system32\config\system.LOG Object is locked skipped
    C:\WINDOWS\system32\h323log.txt Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
    C:\WINDOWS\wiadebug.log Object is locked skipped
    C:\WINDOWS\wiaservc.log Object is locked skipped
    C:\WINDOWS\WindowsUpdate.log Object is locked skipped

    Scan process completed.

     
    zootie, Sep 26, 2006
    #5
  6. Niobis

    Niobis Active member

    Joined:
    Jan 30, 2005
    Messages:
    2,326
    Likes Received:
    0
    Trophy Points:
    66
    Ok, good work. What you are going to have to do is change antiviruses temporarily. Deleting all of these would take a very long time.

    Go here and download the 30 day trial of NOD32 Antivirus.

    Uninstall AVG via Add/Remove Programs.
    Restart.
    Install NOD32.(may have to restart again)
    Double click the system tray icon to open NOD32.
    Click NOD32.
    Click In-depth anaylsis.
    After scanning click logs from the menu.
    Click Threat log.
    Copy/paste the log here with a new HijackThis log.
     
    Niobis, Sep 26, 2006
    #6
  7. Niobis

    Niobis Active member

    Joined:
    Jan 30, 2005
    Messages:
    2,326
    Likes Received:
    0
    Trophy Points:
    66
    It wasn't you...it was my directions. Meant to fix them but hadn't got around to it. Scan log is just as good.

    Show hidden files. Control Panel > Folder Options > View tab > check "Show hidden files and folders".

    Delete this folder.

    C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy\[bold]Recovery[/bold].

    Find and delete these files(if there). NOD32 missed one but not certain which.

    C:\WINDOWS\Temp\[bold]sa28.exe[/bold]
    C:\WINDOWS\[bold]artm_new.dll[/bold]
    C:\Documents and Settings\SHYRO\Local Settings\Temp\[bold]metasploit.exe[/bold]

    If you can't find artm_new.dll in the WINDOWS folder look here:
    C:\Documents and Settings\All Users\Documents\Settings\artm_new.dll

    Can't find it there or the others let me know.

    Run a scan only with HijackThis, check to fix this(if there).

    [bold]O20 - Winlogon Notify: artm_newreg - C:\WINDOWS\ [/bold]

    Post new HijackThis log.

    How are things?
     
    Niobis, Sep 28, 2006
    #9
  8. zootie

    zootie Member

    Joined:
    Apr 29, 2006
    Messages:
    16
    Likes Received:
    0
    Trophy Points:
    11
    Hi,

    I deleted the Spybot recovery folder but:

    C:\WINDOWS\Temp\sa28.exe - I found this but as soon as I tried to delete it NOD or whatever it's called quarantined it before I could delete it

    C:\WINDOWS\artm_new.dll
    C:\Documents and Settings\SHYRO\Local Settings\Temp\metasploit.exe

    I couldn't find the above two. Any help? What should I do now?
     
    zootie, Oct 4, 2006
    #10
  9. zootie

    zootie Member

    Joined:
    Apr 29, 2006
    Messages:
    16
    Likes Received:
    0
    Trophy Points:
    11
    O20 - Winlogon Notify: artm_newreg - C:\WINDOWS\

    I managed to fix this in Hijackthis.

    Here is the new log from Hijackthis:

    Logfile of HijackThis v1.99.1
    Scan saved at 20:26:11, on 04/10/2006
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\PROGRA~1\NCTV\bin\dm.exe
    C:\Program Files\ewido anti-spyware 4.0\guard.exe
    C:\Program Files\Eset\nod32krn.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\WINDOWS\system32\VTtrayp.exe
    C:\WINDOWS\system32\VTTimer.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    C:\Apps\Powercinema\PCMService.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Eset\nod32kui.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\Program Files\FinePixViewer\QuickDCF.exe
    C:\Program Files\Logitech\SetPoint\KEM.exe
    C:\Program Files\NCTV\bin\dmtray.exe
    C:\Program Files\Logitech\SetPoint\KHALMNPR.EXE
    C:\Program Files\OpenOffice.org1.1.4\program\soffice.exe
    C:\Program Files\Linksys\Wireless-G Notebook Adapter\OdHost.exe
    C:\Program Files\Linksys\Wireless-G Notebook Adapter\WPC54Cfg.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\HJT\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.co.uk
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.virgin.net
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://uk.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://uk.search.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://www.google.co.uk
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.virgin.net
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://uk.search.yahoo.com
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Packard Bell
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn1\yt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [VTTrayp] VTtrayp.exe
    O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
    O4 - HKLM\..\Run: [PCMService] "c:\Apps\Powercinema\PCMService.exe"
    O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
    O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
    O4 - HKLM\..\Run: [DVD43] C:\PROGRA~1\DVDREG~1\DVDRegionFree.exe /hidden
    O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
    O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Virgin Net Broadband\Dragdiag.exe" /icon
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [nod32kui] "C:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - Startup: E3TV Tray App.lnk = ?
    O4 - Startup: OpenOffice.org 1.1.4.lnk = C:\Program Files\OpenOffice.org1.1.4\program\quickstart.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Exif Launcher.lnk = ?
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\KEM.exe
    O4 - Global Startup: Wireless-G Notebook Adapter Utility.lnk = C:\Program Files\Linksys\Wireless-G Notebook Adapter\Startup.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll (file missing)
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll (file missing)
    O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesuk.dll
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\PROGRA~1\Yahoo!\Common\yhexbmesuk.dll
    O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=file://C:\APPS\IE\offline\uk.htm
    O16 - DPF: {04E214E5-63AF-4236-83C6-A7ADCBF9BD02} (HouseCall Control) - http://housecall60.trendmicro.com/housecall/xscan60.cab
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
    O16 - DPF: {26CBF141-7D0F-46E1-AA06-718958B6E4D2} - http://download.ebay.com/turbo_lister/UK/install.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{0086105F-D19B-42BE-A0D2-BCBDED4064F5}: NameServer = 192.168.0.2,212.130.104.65
    O17 - HKLM\System\CS1\Services\Tcpip\..\{0086105F-D19B-42BE-A0D2-BCBDED4064F5}: NameServer = 192.168.0.2,212.130.104.65
    O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
    O23 - Service: Download Manager Lite Service (DownloadManagerLite) - NetCableTV - C:\PROGRA~1\NCTV\bin\dm.exe
    O23 - Service: ewido anti-spyware 4.0 guard - Anti-Malware Development a.s. - C:\Program Files\ewido anti-spyware 4.0\guard.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: NICSer_WPC54G - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
    O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset - C:\Program Files\Eset\nod32krn.exe

     
    zootie, Oct 4, 2006
    #11
  10. Niobis

    Niobis Active member

    Joined:
    Jan 30, 2005
    Messages:
    2,326
    Likes Received:
    0
    Trophy Points:
    66
    Hello zootie, good to hear from you again. :)

    Your HijackThis log is clean now, but I don't think your machine is fully clean. There was alot of serious infections. I want to be sure...how are things running? Any symptoms or problems?

    Go here and run BitDefender. Post the results if any infections were found.
     
    Niobis, Oct 4, 2006
    #12
  11. zootie

    zootie Member

    Joined:
    Apr 29, 2006
    Messages:
    16
    Likes Received:
    0
    Trophy Points:
    11
    Hi Niobis,

    I just wanted to say thank you so much for all your help, it's very much appreciated :)

    I still haven't used the PC for internet banking (still a bit worried) but have logged on tonight in my eBay account so will check tomorrow when I get to work to see if I can still access it....

    Everything is running fine, I haven't had any problems.

    I will d/l Bitdefender and post back in a bit with my log.
     
    zootie, Oct 4, 2006
    #13
  12. zootie

    zootie Member

    Joined:
    Apr 29, 2006
    Messages:
    16
    Likes Received:
    0
    Trophy Points:
    11
    Hi,

    I hope I did this right! Here is the results from the Bitdefender scan.

    BitDefender Online Scanner



    Scan report generated at: Wed, Oct 04, 2006 - 21:59:56





    Scan path: C:\;D:\;







    Statistics

    Time
    01:10:27

    Files
    302184

    Folders
    6351

    Boot Sectors
    3

    Archives
    7665

    Packed Files
    15804




    Results

    Identified Viruses
    7

    Infected Files
    10

    Suspect Files
    0

    Warnings
    0

    Disinfected
    0

    Deleted Files
    10




    Engines Info

    Virus Definitions
    473941

    Engine build
    AVCORE v1.0 (build 2310) (i386) (Apr 17 2006 16:24:38)

    Scan plugins
    13

    Archive plugins
    38

    Unpack plugins
    6

    E-mail plugins
    6

    System plugins
    1




    Scan Settings

    First Action
    Disinfect

    Second Action
    Delete

    Heuristics
    Yes

    Enable Warnings
    Yes

    Scanned Extensions
    *;

    Exclude Extensions


    Scan Emails
    Yes

    Scan Archives
    Yes

    Scan Packed
    Yes

    Scan Files
    Yes

    Scan Boot
    Yes




    Scanned File
    Status

    C:\$VAULT$.AVG\02160531.FIL
    Infected with: Trojan.Downloader.Tibs.FT

    C:\$VAULT$.AVG\02160531.FIL
    Disinfection failed

    C:\$VAULT$.AVG\02160531.FIL
    Deleted

    C:\$VAULT$.AVG\02222656.FIL
    Infected with: Trojan.Downloader.Agent.AFB

    C:\$VAULT$.AVG\02222656.FIL
    Disinfection failed

    C:\$VAULT$.AVG\02222656.FIL
    Deleted

    C:\$VAULT$.AVG\02263468.FIL
    Infected with: Trojan.Downloader.Agent.AFB

    C:\$VAULT$.AVG\02263468.FIL
    Disinfection failed

    C:\$VAULT$.AVG\02263468.FIL
    Deleted

    C:\$VAULT$.AVG\35026640.FIL
    Infected with: Exploit.Win32.WMF-PFV.G

    C:\$VAULT$.AVG\35026640.FIL
    Disinfection failed

    C:\$VAULT$.AVG\35026640.FIL
    Deleted

    C:\$VAULT$.AVG\58048656.FIL
    Infected with: Exploit.Win32.WMF-PFV.A

    C:\$VAULT$.AVG\58048656.FIL
    Disinfection failed

    C:\$VAULT$.AVG\58048656.FIL
    Deleted

    C:\Documents and Settings\SHYRO\Local Settings\Temporary Internet Files\Content.IE5\4X2Z0LYB\sp352452548[1].htm
    Infected with: Generic.XPL.ADODB.76EAA9C0

    C:\Documents and Settings\SHYRO\Local Settings\Temporary Internet Files\Content.IE5\4X2Z0LYB\sp352452548[1].htm
    Disinfection failed

    C:\Documents and Settings\SHYRO\Local Settings\Temporary Internet Files\Content.IE5\4X2Z0LYB\sp352452548[1].htm
    Deleted

    C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00005.exe
    Infected with: Trojan.PWS.Sinowal.AL

    C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00005.exe
    Disinfection failed

    C:\Program Files\Common Files\Microsoft Shared\Web Folders\ibm00005.exe
    Deleted

    C:\System Volume Information\_restore{B1C538C0-CBA3-4434-A006-53A338B37653}\RP315\A0146810.exe
    Infected with: Trojan.PWS.Sinowal.AL

    C:\System Volume Information\_restore{B1C538C0-CBA3-4434-A006-53A338B37653}\RP315\A0146810.exe
    Disinfection failed

    C:\System Volume Information\_restore{B1C538C0-CBA3-4434-A006-53A338B37653}\RP315\A0146810.exe
    Deleted

    C:\System Volume Information\_restore{B1C538C0-CBA3-4434-A006-53A338B37653}\RP318\A0150944.exe
    Infected with: DeepScan:Generic.Malware.dld!!.70D70FE1

    C:\System Volume Information\_restore{B1C538C0-CBA3-4434-A006-53A338B37653}\RP318\A0150944.exe
    Disinfection failed

    C:\System Volume Information\_restore{B1C538C0-CBA3-4434-A006-53A338B37653}\RP318\A0150944.exe
    Deleted

    C:\System Volume Information\_restore{B1C538C0-CBA3-4434-A006-53A338B37653}\RP324\A0153558.exe
    Infected with: Trojan.PWS.Sinowal.AL

    C:\System Volume Information\_restore{B1C538C0-CBA3-4434-A006-53A338B37653}\RP324\A0153558.exe
    Disinfection failed

    C:\System Volume Information\_restore{B1C538C0-CBA3-4434-A006-53A338B37653}\RP324\A0153558.exe
    Deleted

     
    zootie, Oct 4, 2006
    #14
  13. Niobis

    Niobis Active member

    Joined:
    Jan 30, 2005
    Messages:
    2,326
    Likes Received:
    0
    Trophy Points:
    66
    Great! BitDefender took care of the rest of 'em. :)

    Last two things.

    Go here and download [bold]CCleaner[/bold].

    [bold]Note[/bold]: If you do not want Yahoo! Toolbar uncheck the option when installing.

    Close all windows.
    Open CCleaner.
    Click "Run Cleaner".

    After cleaning, click "Issues".
    Click "Scan for Issues".
    After scannning, click "Fix selectes issues...".
    When prompted to backup registry, click "Yes".

    Java is out of date.
    Go here and download [bold]Java Runtime Environment 5.0 Update 9[/bold].
    Uninstall all previous versions of JRE via Add/Remove Programs.
    Restart and install Update 9.

    Remember, I cannot guarantee complete removal of that backdoor. It's only a low risk backdoor so, I think we got it. Remember to change all your online passwords and accounts.

    How are things? Any problems?
     
    Niobis, Oct 4, 2006
    #15

Share This Page