GAH, i think this had cropped up on here a couple of times, anyhoo, so my friend popped up, said hey look at this, its really funny, then posdted a link, now I know about the whole virus thing going about with these, but the link had "Obama" some where in it, and unfortunately my friend has an odd sense of humor, so i clicked it and it took me to a balnk web page asking me to download a java....muggins here downloaded it didnt he ANYWAY, its screwd up msn, it logs in but i cant talk on it, so i ran AVG, came up with a load of ZEDO.txt type files, but it wont let me move it to the vault, ran Hijack and this is what came up Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 00:51:28, on 06/11/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\System32\WLTRYSVC.EXE C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\Program Files\Kontiki\KService.exe C:\Program Files\Microsoft LifeCam\MSCamS32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\system32\WLTRAY.exe C:\WINDOWS\stsystra.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\WINDOWS\tsnp2std.exe C:\WINDOWS\vsnp2std.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\vVX1000.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\Kontiki\KHost.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\system32\wuauclt.exe C:\Program Files\Windows Live\Messenger\usnsvc.exe C:\WINDOWS\System32\svchost.exe C:\Program Files\iTunes\iTunes.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceHelper.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\distnoted.exe C:\WINDOWS\service.exe C:\Program Files\LimeWire\LimeWire.exe C:\Program Files\Windows Live\Messenger\msnmsgr.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\4.1.805.4472\swg.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: AIM Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS\tsnp2std.exe O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exe O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe" O4 - HKLM\..\Run: [Windows Service] service.exe O4 - HKLM\..\RunOnce: [Windows Service] service.exe O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user') O7 - HKLM\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1 O8 - Extra context menu item: &AIM Search - c:\program files\aol\aim toolbar 5.0\resources\en-us\local\search.html O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_07\bin\ssv.dll O9 - Extra button: AIM Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab3.cab O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: avgrsstx.dll,wbsys.dll O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE -- End of file - 9061 bytes i found a previous thread here with a remedy (http://forums.afterdawn.com/thread_view.cfm/411680) but hijack didnt come up with anything the other person did basically, please help! Thanks
Hi theillusi You have a MSN trojan all right, but not the same one as the other thread. Please download Superantispyware Free and install it. Follow the prompts and reboot if required. Launch Superantispyware Free either by running C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.exe or right-click on the SuperAntispyware icon in your task bar (it looks like a bug) and click on Scan for Spyware, Adware, Malware... Configuring SuperAntispyware • Click on Preferences. • In the tab General and Startup, make sure the box Start SuperAntispyware when Windows starts is unchecked. This will prevent SuperAntispyware from starting everytime, because it may interfere with other fixes that may be run. • Navigate to the tab Scanning Control. • Make sure only these boxes are checked: Code: Close browsers before scanning Scan for tracking cookies Terminate memory threats before quarantining Scan Alternate Data Streams Use Kernel Direct File Access (recommended) Use Kernel Direct Registry Access (recommended) Use Direct Disk Access (recommended) • Click on Close. Updating SuperAntispyware • At the main window, click on Check for Updates.... • Wait for SuperAntispyware to be fully updated. Scanning Time • Boot into safe mode by repeatedly pressing the F8 key after you press the power button. If safe mode does not work, tell me and do the scan in normal mode. • Launch SuperAntispyware. • At the main window, click on Scan your Computer.... • Make sure all drives (excluding CD drives) are checked, select Perform Complete Scan, and then click on Next. • Wait for the scan to complete, and then click on Next>. This will quarantine and remove all detected items. • Reboot your computer. Post A Log • Launch SuperAntispyware • Click on Preferences • Navigate to the tab Statistics/Logs. • Choose the latest scan log, and the click on View Log.... • Copy and paste the contents of the log here in your next post. Best Regards
Thanks, I'm following your instructions as we speak, just a couple more things, if it asks me to reboot is it possible to save pictures and music with out transfering them to an external memory source? and also, out of morbid curiousity, what is the exact nature of my problem? I'd like to know what i'm trying to kill here Thanks loads for your help so far!
right, followed the instructions, as far as i can tell its fixed, i couldnt see an option anywhere to make a log for you though...:S
ok, heres the log SUPERAntiSpyware Scan Log http://www.superantispyware.com Generated 11/06/2008 at 04:03 PM Application Version : 4.21.1004 Core Rules Database Version : 3625 Trace Rules Database Version: 1609 Scan type : Complete Scan Total Scan Time : 05:45:13 Memory items scanned : 171 Memory threats detected : 0 Registry items scanned : 4184 Registry threats detected : 0 File items scanned : 105282 File threats detected : 224 Adware.Tracking Cookie C:\Documents and Settings\Nick\Cookies\nick@edge.ru4[2].txt C:\Documents and Settings\Nick\Cookies\nick@ad1.clickhype[1].txt C:\Documents and Settings\Nick\Cookies\nick@ads.us.e-planning[1].txt C:\Documents and Settings\Nick\Cookies\nick@ad.yieldmanager[2].txt C:\Documents and Settings\Nick\Cookies\nick@fastclick[1].txt C:\Documents and Settings\Nick\Cookies\nick@w00tpublishers.wootmedia[2].txt C:\Documents and Settings\Nick\Cookies\nick@overture[1].txt C:\Documents and Settings\Nick\Cookies\nick@apmebf[1].txt C:\Documents and Settings\Nick\Cookies\nick@sexintheuk[1].txt C:\Documents and Settings\Nick\Cookies\nick@counter6.sextracker[1].txt C:\Documents and Settings\Nick\Cookies\nick@bluestreak[2].txt C:\Documents and Settings\Nick\Cookies\nick@media.adrevolver[3].txt C:\Documents and Settings\Nick\Cookies\nick@adopt.euroclick[2].txt C:\Documents and Settings\Nick\Cookies\nick@www.burstbeacon[2].txt C:\Documents and Settings\Nick\Cookies\nick@ad2.clickhype[1].txt C:\Documents and Settings\Nick\Cookies\nick@msnportal.112.2o7[1].txt C:\Documents and Settings\Nick\Cookies\nick@serving.adsrevenue.clicksor[1].txt C:\Documents and Settings\Nick\Cookies\nick@www.googleadservices[3].txt C:\Documents and Settings\Nick\Cookies\nick@partypoker[2].txt C:\Documents and Settings\Nick\Cookies\nick@data.coremetrics[1].txt C:\Documents and Settings\Nick\Cookies\nick@server.cpmstar[1].txt C:\Documents and Settings\Nick\Cookies\nick@valueclick[1].txt C:\Documents and Settings\Nick\Cookies\nick@barfquestion.newgrounds[1].txt C:\Documents and Settings\Nick\Cookies\nick@versiontracker[1].txt C:\Documents and Settings\Nick\Cookies\nick@adv.xboard[1].txt C:\Documents and Settings\Nick\Cookies\nick@hentaicounter[1].txt C:\Documents and Settings\Nick\Cookies\nick@ehg-idgentertainment.hitbox[2].txt C:\Documents and Settings\Nick\Cookies\nick@www.xxxblackbook[1].txt C:\Documents and Settings\Nick\Cookies\nick@advertising[1].txt C:\Documents and Settings\Nick\Cookies\nick@zedo[2].txt C:\Documents and Settings\Nick\Cookies\nick@collective-media[2].txt C:\Documents and Settings\Nick\Cookies\nick@pornbb[2].txt C:\Documents and Settings\Nick\Cookies\nick@questionmarket[1].txt C:\Documents and Settings\Nick\Cookies\nick@pornotube[1].txt C:\Documents and Settings\Nick\Cookies\nick@indextools[1].txt C:\Documents and Settings\Nick\Cookies\nick@www.etracker[1].txt C:\Documents and Settings\Nick\Cookies\nick@ad2.adecn[2].txt C:\Documents and Settings\Nick\Cookies\nick@e-2dj6wjmichd5cfp.stats.esomniture[1].txt C:\Documents and Settings\Nick\Cookies\nick@atwola[1].txt C:\Documents and Settings\Nick\Cookies\nick@sextracker[2].txt C:\Documents and Settings\Nick\Cookies\nick@stat.onestat[2].txt C:\Documents and Settings\Nick\Cookies\nick@mediaonenetwork[1].txt C:\Documents and Settings\Nick\Cookies\nick@rotator.adjuggler[3].txt C:\Documents and Settings\Nick\Cookies\nick@kontera[2].txt C:\Documents and Settings\Nick\Cookies\nick@free.wegcash[2].txt C:\Documents and Settings\Nick\Cookies\nick@paypal.112.2o7[1].txt C:\Documents and Settings\Nick\Cookies\nick@statcounter[2].txt C:\Documents and Settings\Nick\Cookies\nick@tracking.summitmedia.co[1].txt C:\Documents and Settings\Nick\Cookies\nick@ad2.doublepimp[1].txt C:\Documents and Settings\Nick\Cookies\nick@12.go.globaladsales[1].txt C:\Documents and Settings\Nick\Cookies\nick@allporntube[1].txt C:\Documents and Settings\Nick\Cookies\nick@clickthrough.wegcash[2].txt C:\Documents and Settings\Nick\Cookies\nick@tribalfusion[2].txt C:\Documents and Settings\Nick\Cookies\nick@www.pornbb[2].txt C:\Documents and Settings\Nick\Cookies\nick@at.atwola[1].txt C:\Documents and Settings\Nick\Cookies\nick@casalemedia[1].txt C:\Documents and Settings\Nick\Cookies\nick@msnaccountservices.112.2o7[2].txt C:\Documents and Settings\Nick\Cookies\nick@serving-sys[2].txt C:\Documents and Settings\Nick\Cookies\nick@e-2dj6wjmygkdzkco.stats.esomniture[2].txt C:\Documents and Settings\Nick\Cookies\nick@adecn[1].txt C:\Documents and Settings\Nick\Cookies\nick@tradedoubler[1].txt C:\Documents and Settings\Nick\Cookies\nick@tripod[1].txt C:\Documents and Settings\Nick\Cookies\nick@counter2.sextracker[2].txt C:\Documents and Settings\Nick\Cookies\nick@videoegg.adbureau[1].txt C:\Documents and Settings\Nick\Cookies\nick@e-2dj6wfkowldpwhq.stats.esomniture[2].txt C:\Documents and Settings\Nick\Cookies\nick@reduxads.valuead[2].txt C:\Documents and Settings\Nick\Cookies\nick@publishers.clickbooth[1].txt C:\Documents and Settings\Nick\Cookies\nick@e-2dj6wfkiejdjggp.stats.esomniture[1].txt C:\Documents and Settings\Nick\Cookies\nick@bs.serving-sys[1].txt C:\Documents and Settings\Nick\Cookies\nick@247realmedia[1].txt C:\Documents and Settings\Nick\Cookies\nick@clickbank[1].txt C:\Documents and Settings\Nick\Cookies\nick@adultfriendfinder.cams[2].txt C:\Documents and Settings\Nick\Cookies\nick@doubleclick[1].txt C:\Documents and Settings\Nick\Cookies\nick@ads.anm.co[1].txt C:\Documents and Settings\Nick\Cookies\nick@ad.uk.tangozebra[1].txt C:\Documents and Settings\Nick\Cookies\nick@insightexpressai[2].txt C:\Documents and Settings\Nick\Cookies\nick@porntube[2].txt C:\Documents and Settings\Nick\Cookies\nick@pro-market[2].txt C:\Documents and Settings\Nick\Cookies\nick@ehg-autotrader.hitbox[1].txt C:\Documents and Settings\Nick\Cookies\nick@media6degrees[1].txt C:\Documents and Settings\Nick\Cookies\nick@adtech[1].txt C:\Documents and Settings\Nick\Cookies\nick@track.adform[1].txt C:\Documents and Settings\Nick\Cookies\nick@mediaplex[2].txt C:\Documents and Settings\Nick\Cookies\nick@clicktorrent[2].txt C:\Documents and Settings\Nick\Cookies\nick@adrevolver[1].txt C:\Documents and Settings\Nick\Cookies\nick@www.burstnet[1].txt C:\Documents and Settings\Nick\Cookies\nick@xiti[2].txt C:\Documents and Settings\Nick\Cookies\nick@e-2dj6wjl4ejd5slp.stats.esomniture[2].txt C:\Documents and Settings\Nick\Cookies\nick@revsci[1].txt C:\Documents and Settings\Nick\Cookies\nick@realmedia[2].txt C:\Documents and Settings\Nick\Cookies\nick@media.mtvnservices[2].txt C:\Documents and Settings\Nick\Cookies\nick@serif.112.2o7[1].txt C:\Documents and Settings\Nick\Cookies\nick@ad1.emediate[2].txt C:\Documents and Settings\Nick\Cookies\nick@adultadworld[1].txt C:\Documents and Settings\Nick\Cookies\nick@servedby.onlinemediadiva[2].txt C:\Documents and Settings\Nick\Cookies\nick@account.live[2].txt C:\Documents and Settings\Nick\Cookies\nick@ads.pointroll[1].txt C:\Documents and Settings\Nick\Cookies\nick@atdmt[1].txt C:\Documents and Settings\Nick\Cookies\nick@rotator.adjuggler[1].txt C:\Documents and Settings\Nick\Cookies\nick@adbrite[2].txt C:\Documents and Settings\Nick\Cookies\nick@media.adrevolver[1].txt C:\Documents and Settings\Nick\Cookies\nick@xxxblackbook[2].txt C:\Documents and Settings\Nick\Cookies\nick@trvlnet.adbureau[2].txt C:\Documents and Settings\Nick\Cookies\nick@interclick[2].txt C:\Documents and Settings\Nick\Cookies\nick@dynamic.media.adrevolver[1].txt C:\Documents and Settings\Nick\Cookies\nick@americanexpress.122.2o7[1].txt C:\Documents and Settings\Nick\Cookies\nick@adserver.adreactor[1].txt C:\Documents and Settings\Nick\Cookies\nick@adlegend[1].txt C:\Documents and Settings\Nick\Cookies\nick@trafficmp[1].txt C:\Documents and Settings\Nick\Cookies\nick@burstnet[2].txt C:\Documents and Settings\Nick\Cookies\nick@stat.dealtime[2].txt C:\Documents and Settings\Nick\Cookies\nick@blykservices.112.2o7[1].txt C:\Documents and Settings\Nick\Cookies\nick@www.pregnantxxxmovies[2].txt C:\Documents and Settings\Nick\Cookies\nick@yadro[2].txt C:\Documents and Settings\Nick\Cookies\nick@pacificpoker[1].txt C:\Documents and Settings\Nick\Cookies\nick@socialmedia[1].txt C:\Documents and Settings\Nick\Cookies\nick@2o7[2].txt C:\Documents and Settings\Nick\Cookies\nick@specificclick[2].txt C:\Documents and Settings\Nick\Cookies\nick@rktrack[1].txt C:\Documents and Settings\Nick\Cookies\nick@a.websponsors[2].txt C:\Documents and Settings\Nick\Cookies\nick@adviva[1].txt C:\Documents and Settings\Nick\Cookies\nick@highbeam.122.2o7[1].txt C:\Documents and Settings\Nick\Cookies\nick@e-2dj6wdk4wjcjshq.stats.esomniture[1].txt C:\Documents and Settings\Nick\Cookies\nick@adserve.rupizads[1].txt C:\Documents and Settings\Nick\Cookies\nick@ads.rlcomics[1].txt C:\Documents and Settings\Nick\Cookies\nick@trinitymirror.112.2o7[1].txt C:\Documents and Settings\Nick\Cookies\nick@adcentriconline[1].txt C:\Documents and Settings\Nick\Cookies\nick@eas.apm.emediate[2].txt C:\Documents and Settings\Nick\Cookies\nick@e-2dj6wfl4uodjsap.stats.esomniture[2].txt C:\Documents and Settings\Nick\Cookies\nick@cms.trafficmp[2].txt C:\Documents and Settings\Nick\Cookies\nick@ice.112.2o7[1].txt C:\Documents and Settings\Nick\Cookies\nick@ssa.adxdnet[2].txt C:\Documents and Settings\Nick\Cookies\nick@www.3pintracking[1].txt C:\Documents and Settings\Nick\Cookies\nick@sixapart.adbureau[2].txt C:\Documents and Settings\Nick\Cookies\nick@vip.clickzs[2].txt C:\Documents and Settings\Nick\Cookies\nick@ads.clicksor[1].txt C:\Documents and Settings\Nick\Cookies\nick@counter3.sextracker[1].txt C:\Documents and Settings\Nick\Cookies\nick@serv.clicksor[2].txt C:\Documents and Settings\Nick\Cookies\nick@crucial.adbureau[2].txt C:\Documents and Settings\Nick\Cookies\nick@myroitracking[2].txt C:\Documents and Settings\Nick\Cookies\nick@e-2dj6wjk4kjc5obo.stats.esomniture[2].txt C:\Documents and Settings\Nick\Cookies\nick@cdn.at.atwola[1].txt C:\Documents and Settings\Nick\Cookies\nick@int.sitestat[1].txt C:\Documents and Settings\Nick\Cookies\nick@statse.webtrendslive[1].txt C:\Documents and Settings\Nick\Cookies\nick@atoc.112.2o7[2].txt C:\Documents and Settings\Nick\Cookies\nick@hitbox[1].txt C:\Documents and Settings\Nick\Cookies\nick@cadburyschweppesplc.112.2o7[1].txt C:\Documents and Settings\Nick\Cookies\nick@chitika[1].txt C:\Documents and Settings\Nick\Cookies\nick@counter8.sextracker[1].txt C:\Documents and Settings\Nick\Cookies\nick@server.iad.liveperson[3].txt C:\Documents and Settings\Nick\Cookies\nick@e-2dj6wjmyglazsbq.stats.esomniture[2].txt C:\Documents and Settings\Nick\Cookies\nick@ads.movieweb[2].txt C:\Documents and Settings\Nick\Cookies\nick@pregnanteen[2].txt C:\Documents and Settings\Nick\Cookies\nick@adultfriendfinder[2].txt C:\Documents and Settings\Nick\Cookies\nick@carphonewarehouse.112.2o7[1].txt C:\Documents and Settings\Nick\Cookies\nick@media303[2].txt C:\Documents and Settings\Nick\Cookies\nick@sixapart.112.2o7[1].txt C:\Documents and Settings\Nick\Cookies\nick@www.teentube4free[1].txt C:\Documents and Settings\Nick\Cookies\nick@int.sitestat[3].txt C:\Documents and Settings\Nick\Cookies\nick@www.gamestracker[2].txt C:\Documents and Settings\Nick\Cookies\nick@sales.liveperson[3].txt C:\Documents and Settings\Nick\Cookies\nick@sexuality.about[1].txt C:\Documents and Settings\Nick\Cookies\nick@ad.mmoabc[1].txt C:\Documents and Settings\Nick\Cookies\nick@precisionclick[2].txt C:\Documents and Settings\Nick\Cookies\nick@adfarm1.adition[1].txt C:\Documents and Settings\Nick\Cookies\nick@iacas.adbureau[2].txt C:\Documents and Settings\Nick\Cookies\nick@ar.atwola[1].txt C:\Documents and Settings\Nick\Cookies\nick@imrworldwide[1].txt C:\Documents and Settings\Nick\Cookies\nick@ylovesporn[2].txt C:\Documents and Settings\Nick\Cookies\nick@dmtracker[1].txt C:\Documents and Settings\Nick\Cookies\nick@porn.naughtyfiles[2].txt C:\Documents and Settings\Nick\Cookies\nick@devart.adbureau[1].txt C:\Documents and Settings\Nick\Cookies\nick@ehg-rodale.hitbox[1].txt C:\Documents and Settings\Nick\Cookies\nick@uk.sitestat[1].txt C:\Documents and Settings\Nick\Cookies\nick@rambler[1].txt C:\Documents and Settings\Nick\Cookies\nick@clickcash[1].txt C:\Documents and Settings\Nick\Cookies\nick@www.versiontracker[1].txt C:\Documents and Settings\Nick\Cookies\nick@ehg-mgnlimited.hitbox[1].txt C:\Documents and Settings\Nick\Cookies\nick@int.sitestat[2].txt C:\Documents and Settings\Nick\Cookies\nick@e-2dj6wfkygoajglp.stats.esomniture[2].txt C:\Documents and Settings\Nick\Cookies\nick@www.usenext[2].txt C:\Documents and Settings\Nick\Cookies\nick@tacoda[1].txt C:\Documents and Settings\Nick\Cookies\nick@test.coremetrics[1].txt C:\Documents and Settings\Nick\Cookies\nick@indexstats[2].txt C:\Documents and Settings\Nick\Cookies\nick@stats.adbrite[2].txt C:\Documents and Settings\Nick\Cookies\nick@ads.addynamix[1].txt C:\Documents and Settings\Nick\Cookies\nick@ads.aol.co[1].txt C:\Documents and Settings\Nick\Cookies\nick@affiliates.hottopicmedia[1].txt C:\Documents and Settings\Nick\Cookies\nick@beyondsexxy[1].txt C:\Documents and Settings\Nick\Cookies\nick@e-2dj6wjmialajgep.stats.esomniture[2].txt C:\Documents and Settings\Nick\Cookies\nick@adopt.specificclick[2].txt C:\Documents and Settings\Nick\Cookies\nick@friendfinder[2].txt C:\Documents and Settings\Nick\Cookies\nick@ads.newgrounds[1].txt C:\Documents and Settings\Nick\Cookies\nick@ads.techguy[1].txt C:\Documents and Settings\Nick\Cookies\nick@adserver.adtechus[1].txt C:\Documents and Settings\Nick\Cookies\nick@www.zanox-affiliate[2].txt C:\Documents and Settings\Nick\Cookies\nick@cgm.adbureau[1].txt C:\Documents and Settings\Nick\Cookies\nick@sales.liveperson[1].txt C:\Documents and Settings\Nick\Cookies\nick@azjmp[1].txt C:\Documents and Settings\Nick\Cookies\nick@viacom.adbureau[1].txt C:\Documents and Settings\Nick\Cookies\nick@ar.atwola[2].txt C:\Documents and Settings\Nick\Cookies\nick@www.googleadservices[6].txt C:\Documents and Settings\Nick\Cookies\nick@www.googleadservices[2].txt C:\Documents and Settings\Nick\Cookies\nick@www.weloveteengirls[1].txt C:\Documents and Settings\Nick\Cookies\nick@e-2dj6wfkisjc5kep.stats.esomniture[2].txt C:\Documents and Settings\Nick\Cookies\nick@optimize.indieclick[2].txt C:\Documents and Settings\Nick\Cookies\nick@royalmail.112.2o7[1].txt C:\Documents and Settings\Nick\Cookies\nick@ehg-logantod.hitbox[2].txt C:\Documents and Settings\Nick\Cookies\nick@counter10.sextracker[1].txt C:\Documents and Settings\Nick\Cookies\nick@ads.tbnhost.co[2].txt C:\Documents and Settings\Nick\Cookies\nick@counter12.sextracker[1].txt C:\Documents and Settings\Nick\Cookies\nick@gettyimages.122.2o7[1].txt C:\Documents and Settings\Nick\Cookies\nick@stats.manticoretechnology[1].txt C:\Documents and Settings\Nick\Cookies\nick@www.googleadservices[1].txt C:\Documents and Settings\Nick\Cookies\nick@network.realmedia[1].txt C:\Documents and Settings\Nick\Cookies\nick@ads.ak.facebook[1].txt C:\Documents and Settings\Nick\Cookies\nick@media.medhelp[2].txt C:\Documents and Settings\Nick\Cookies\nick@weloveteengirls[2].txt C:\Documents and Settings\Nick\Cookies\nick@adserver1.w00tmedia[1].txt C:\Documents and Settings\Nick\Cookies\nick@112.2o7[1].txt C:\Documents and Settings\Nick\Cookies\nick@medhelpinternational.112.2o7[1].txt C:\Documents and Settings\Nick\Cookies\nick@googleadservices[1].txt C:\Documents and Settings\Nick\Cookies\nick@ads.widgetbucks[1].txt C:\Documents and Settings\Nick\Cookies\nick@server.iad.liveperson[1].txt cheers
Hey theillusi Thanks for following my instructions. Sorry I didn't get to answer your questions. I'll answer them now. 1. Why wouldn't it be? As in save pictures to another hard drive? Or save pictures onto the infected computer? Both are possible. 2. From your HijackThis log, I can identify a MSN trojan which is causing your problem. However, Superantispyware did not fix it, so you problem should still be there.... Now, please download ComboFix. With ComboFix, at the download window, please rename it to Combo-Fix(.exe) before downloading it. Please disable all security programs, such as antiviruses, antispywares, and firewalls. Also disable your internet connection. • Run Combo-Fix.exe and follow the prompts. **Understand that things like your system clock changing and your desktop disappearing might happen. Do not worry, because all will be restored later. • Wait for the scan to be completed. • If it requires a reboot, please do it. • After the scan has completed entirely, please post the log here. The log will be located at C:\ComboFix(.txt) Do not click on the ComoboFix window, as it may cause it to stall. After that, post a new HijackThis log. Best Regards
Combofix log ComboFix 08-11-09.04 - Nick 2008-11-10 21:13:46.1 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.296 [GMT 0:00] Running from: c:\documents and settings\Nick\My Documents\Downloads\Combo-Fix.exe * Created a new restore point . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\admintxt.txt c:\windows\service.exe c:\windows\system32\bdbsbkuw.ini c:\windows\system32\dpclwqtu.dll c:\windows\system32\gjTAdMoq.ini c:\windows\system32\gjTAdMoq.ini2 c:\windows\system32\igfpogpw.dll c:\windows\system32\jkkJAqRK.dll c:\windows\system32\KRqAJkkj.ini c:\windows\system32\KRqAJkkj.ini2 c:\windows\system32\rqeidann.dll c:\windows\system32\svtptf.dll c:\windows\system32\utqwlcpd.ini c:\windows\system32\wukbsbdb.dll . ((((((((((((((((((((((((( Files Created from 2008-10-10 to 2008-11-10 ))))))))))))))))))))))))))))))) . 2008-11-10 19:35 . 2008-11-10 19:35 35,328 --a------ c:\windows\system32\khfdCtuT.dll 2008-11-10 19:35 . 2008-11-10 19:35 35,328 --a------ c:\windows\system32\awtttQHx.dll 2008-11-10 19:08 . 2008-11-10 19:08 35,328 --a------ c:\windows\system32\wvUnKAqn.dll 2008-11-10 19:08 . 2008-11-10 19:08 35,328 --a------ c:\windows\system32\tuvuTNee.dll 2008-11-10 18:58 . 2008-11-10 18:58 85,504 --a------ c:\windows\system32\dxjaisaa.dll 2008-11-10 18:52 . 2008-11-10 18:52 35,328 --a------ c:\windows\system32\opnomjgH.dll 2008-11-10 18:52 . 2008-11-10 18:52 35,328 --a------ c:\windows\system32\iifdayWp.dll 2008-11-09 22:42 . 2008-11-09 22:42 <DIR> d-------- c:\program files\Windows Live Favorites 2008-11-09 22:38 . 2008-11-09 22:42 <DIR> d-------- c:\program files\Windows Live 2008-11-06 10:15 . 2008-11-06 10:15 <DIR> d-------- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com 2008-11-06 10:15 . 2008-11-06 10:15 <DIR> d-------- c:\documents and settings\Administrator 2008-11-06 10:05 . 2008-11-06 10:05 <DIR> d-------- c:\program files\SUPERAntiSpyware 2008-11-06 10:05 . 2008-11-06 10:05 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard 2008-11-06 10:05 . 2008-11-06 10:05 <DIR> d-------- c:\documents and settings\Nick\Application Data\SUPERAntiSpyware.com 2008-11-06 10:05 . 2008-11-06 10:05 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2008-11-06 00:41 . 2008-11-06 00:41 <DIR> d-------- c:\program files\Trend Micro 2008-11-05 21:35 . 2008-11-05 21:35 49,676 --a------ c:\documents and settings\Nick\javaplugin.exe 2008-10-29 09:33 . 2008-10-29 09:41 <DIR> d-------- c:\program files\PogoSticker 2008-10-27 19:25 . 2008-10-27 19:25 <DIR> d-------- c:\documents and settings\Nick\Application Data\Acoustica 2008-10-27 19:25 . 2007-08-07 11:32 57,344 --a------ c:\windows\system32\Wnaspint.dll 2008-10-27 19:05 . 2008-10-27 19:25 <DIR> d-------- c:\program files\Acoustica Mixcraft 4 2008-10-27 19:05 . 2008-10-27 19:05 <DIR> d-------- c:\documents and settings\All Users\Application Data\Acoustica 2008-10-27 19:03 . 2008-10-27 19:25 <DIR> d-------- c:\program files\Acoustica Shared Effects 2008-10-27 19:02 . 2008-10-27 19:03 <DIR> d-------- c:\program files\Acoustica Mixcraft . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-10 21:25 --------- d-----w c:\documents and settings\All Users\Application Data\Kontiki 2008-11-09 22:44 --------- d-----w c:\program files\Windows Live Toolbar 2008-11-09 22:38 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller 2008-11-09 17:35 --------- d-----w c:\documents and settings\Nick\Application Data\LimeWire 2008-11-08 23:19 --------- d-----w c:\documents and settings\Nick\Application Data\uTorrent 2008-11-08 20:20 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater 2008-10-30 09:16 --------- d-----w c:\documents and settings\Nick\Application Data\OpenOffice.org2 2008-10-22 12:33 --------- d-----w c:\program files\Microsoft Silverlight 2008-10-08 20:42 --------- d-----w c:\program files\Kontiki 2008-09-26 08:56 --------- d-----w c:\program files\Microsoft LifeCam 2008-09-17 10:11 --------- d-----w c:\program files\AlienGUIse 2008-09-17 02:52 --------- d-----w c:\program files\Common Files\Stardock 2008-09-15 11:57 1,846,016 ----a-w c:\windows\system32\win32k.sys 2008-09-14 13:54 --------- d-----w c:\program files\InterActual 2008-09-11 11:34 --------- d-----w c:\documents and settings\Mum\Application Data\Apple Computer 2008-09-11 11:32 --------- d-----w c:\documents and settings\Mum\Application Data\ATI 2008-08-26 07:24 826,368 ----a-w c:\windows\system32\wininet.dll 2008-08-14 09:57 2,185,984 ----a-w c:\windows\system32\ntoskrnl.exe 2008-08-14 09:18 2,062,976 ----a-w c:\windows\system32\ntkrnlpa.exe . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{24990BFC-C554-403B-A22D-40A8ED1828F8}] 2008-11-10 21:26 246272 --a------ c:\windows\system32\geBuVPhF.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3CCDF8CE-C339-4DD6-AD4F-CA7230C7E2F2}] 2008-11-10 18:52 35328 --a------ c:\windows\system32\opnomjgH.dll [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4CAB59B4-55A3-4737-9FD5-B93C6430BF76}] 2008-11-10 18:58 85504 --a------ c:\windows\system32\dxjaisaa.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-08 39408] "kdx"="c:\program files\Kontiki\KHost.exe" [2008-02-27 1032376] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-12-19 1347584] "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 90112] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-09-29 1234712] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "tsnp2std"="c:\windows\tsnp2std.exe" [2007-01-05 258048] "snp2std"="c:\windows\vsnp2std.exe" [2006-09-15 675840] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-22 116040] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-05-27 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-07-30 289064] "VX1000"="c:\windows\vVX1000.exe" [2007-04-10 709992] "LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2007-05-17 279912] "SigmatelSysTrayApp"="stsystra.exe" [2006-07-27 c:\windows\stsystra.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-04-17 9117696] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] "{3CCDF8CE-C339-4DD6-AD4F-CA7230C7E2F2}"= "c:\windows\system32\opnomjgH.dll" [2008-11-10 35328] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2008-07-23 16:28 352256 c:\program files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB] 2001-12-20 22:34 24576 c:\program files\AlienGUIse\fastload.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\opnomjgH] 2008-11-10 18:52 35328 c:\windows\system32\opnomjgH.dll [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa] Authentication Packages REG_MULTI_SZ msv1_0 c:\windows\system32\geBuVPhF [HKLM\~\startupfolder\C:^Documents and Settings^Nick^Start Menu^Programs^Startup^LimeWire On Startup.lnk] path=c:\documents and settings\Nick\Start Menu\Programs\Startup\LimeWire On Startup.lnk backup=c:\windows\pss\LimeWire On Startup.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^Nick^Start Menu^Programs^Startup^OpenOffice.org 2.4.lnk] path=c:\documents and settings\Nick\Start Menu\Programs\Startup\OpenOffice.org 2.4.lnk backup=c:\windows\pss\OpenOffice.org 2.4.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6] --a------ 2008-03-25 20:21 50528 c:\program files\AIM6\aim6.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMC] --a------ 2008-01-14 11:14 4053102 c:\program files\FriendFinder\FriendFinder Messenger 4\imc.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM] --a------ 2008-04-17 23:27 9117696 c:\program files\MySpace\IM\MySpaceIM.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "c:\\Program Files\\AVG\\AVG8\\avgemc.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "c:\\Program Files\\AIM6\\aim6.exe"= "c:\\Program Files\\LimeWire\\LimeWire.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"= "c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"= "c:\\Program Files\\Kontiki\\KService.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"= R0 atiide;atiide;c:\windows\system32\DRIVERS\atiide.sys [2006-09-13 3456] R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-08-29 97928] R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-08-29 875288] R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-08-29 231704] R2 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-07-04 76040] R2 MSCamSvc;MSCamSvc;c:\program files\Microsoft LifeCam\MSCamS32.exe [2007-05-17 271720] R2 ousbehci;OrangeWare USB Enhanced Host Controller Service;c:\windows\system32\Drivers\ousbehci.sys [2007-03-26 46336] R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652] S3 SNP2STD;USB2.0 PC Camera (SNP2STD);c:\windows\system32\DRIVERS\snp2sxp.sys [2007-01-26 12028032] S3 VX1000;VX-1000;c:\windows\system32\DRIVERS\VX1000.sys [2007-04-10 1966312] . Contents of the 'Scheduled Tasks' folder 2008-09-06 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2008-11-10 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job - c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20] 2008-09-26 c:\windows\Tasks\Microsoft_Hardware_Launch_setup_exe.job - D:\setup.exe [] 2008-11-10 c:\windows\Tasks\RegCure Program Check.job - c:\program files\RegCure\RegCure.exe [2008-04-21 21:21] 2008-05-30 c:\windows\Tasks\RegCure.job - c:\program files\RegCure\RegCure.exe [2008-04-21 21:21] . - - - - ORPHANS REMOVED - - - - BHO-{7815e68c-fd92-4671-b192-398b5e4ce4f7} - c:\windows\system32\svtptf.dll BHO-{94F82254-ABD1-4448-A5C4-B634D24972E6} - c:\windows\system32\jkkJAqRK.dll BHO-{DCEDD09A-E6BA-4375-A650-2C08F7FD5CFC} - c:\windows\system32\qoMdATjg.dll HKLM-Run-b8dcc183 - c:\windows\system32\wukbsbdb.dll . ------- Supplementary Scan ------- . FireFox -: Profile - c:\documents and settings\Nick\Application Data\Mozilla\Firefox\Profiles\yl7j4ywh.default\ . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-10 21:21:45 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . --------------------- DLLs Loaded Under Running Processes --------------------- PROCESS: c:\windows\system32\winlogon.exe -> c:\windows\system32\opnomjgH.dll PROCESS: c:\windows\explorer.exe -> c:\windows\system32\xhegypyu.dll -> c:\windows\system32\geBuVPhF.dll . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\ati2evxx.exe c:\windows\system32\ati2evxx.exe c:\windows\system32\WLTRYSVC.EXE c:\windows\system32\BCMWLTRY.EXE c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe c:\program files\Kontiki\KService.exe c:\program files\AVG\AVG8\avgrsx.exe c:\program files\ATI Technologies\ATI.ACE\CLI.exe c:\program files\iPod\bin\iPodService.exe c:\program files\ATI Technologies\ATI.ACE\CLI.exe c:\windows\system32\rundll32.exe c:\windows\system32\rundll32.exe c:\windows\system32\imapi.exe . ************************************************************************** . Completion time: 2008-11-10 21:30:39 - machine was rebooted ComboFix-quarantined-files.txt 2008-11-10 21:30:25 Pre-Run: 4,389,306,368 bytes free Post-Run: 6,036,250,624 bytes free WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe [boot loader] timeout=2 default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS [operating systems] c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect 224 --- E O F --- 2008-11-10 08:56:02 and hijack log Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 21:35:11, on 10/11/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v7.00 (7.00.6000.16735) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\System32\WLTRYSVC.EXE C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\system32\spoolsv.exe C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe C:\Program Files\Bonjour\mDNSResponder.exe C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe C:\Program Files\Kontiki\KService.exe C:\Program Files\Microsoft LifeCam\MSCamS32.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\PROGRA~1\AVG\AVG8\avgrsx.exe C:\PROGRA~1\AVG\AVG8\avgemc.exe C:\WINDOWS\system32\WLTRAY.exe C:\WINDOWS\stsystra.exe C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE C:\PROGRA~1\AVG\AVG8\avgtray.exe C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe C:\WINDOWS\tsnp2std.exe C:\WINDOWS\vsnp2std.exe C:\Program Files\iTunes\iTunesHelper.exe C:\WINDOWS\vVX1000.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\ATI Technologies\ATI.ACE\cli.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\system32\rundll32.exe C:\WINDOWS\explorer.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe C:\Program Files\Trend Micro\HijackThis\HijackThis.exe R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896 R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157 R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local O3 - Toolbar: AIM Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_07\bin\jusched.exe" O4 - HKLM\..\Run: [tsnp2std] C:\WINDOWS\tsnp2std.exe O4 - HKLM\..\Run: [snp2std] C:\WINDOWS\vsnp2std.exe O4 - HKLM\..\Run: [AppleSyncNotifier] C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKLM\..\Run: [VX1000] C:\WINDOWS\vVX1000.exe O4 - HKLM\..\Run: [LifeCam] "C:\Program Files\Microsoft LifeCam\LifeExp.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [kdx] C:\Program Files\Kontiki\KHost.exe -all O4 - HKUS\S-1-5-18\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [MySpaceIM] C:\Program Files\MySpace\IM\MySpaceIM.exe (User 'Default user') O8 - Extra context menu item: &AIM Search - c:\program files\aol\aim toolbar 5.0\resources\en-us\local\search.html O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx O9 - Extra button: AIM Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AIM Toolbar 5.0\aoltb.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {0CCA191D-13A6-4E29-B746-314DEE697D83} (Facebook Photo Uploader 5) - http://upload.facebook.com/controls/FacebookPhotoUploader5.cab O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.srtest.com/srl_bin/sysreqlab3.cab O16 - DPF: {48DD0448-9209-4F81-9F6D-D83562940134} (MySpace Uploader Control) - http://lads.myspace.com/upload/MySpaceUploader1006.cab O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w3/pr01/resources/MSNPUpld.cab O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll O20 - AppInit_DLLs: qjtdar.dll O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: KService - Kontiki Inc. - C:\Program Files\Kontiki\KService.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE -- End of file - 6914 bytes Cheers for all your help so far, there's n way i could have worked this all out myself ive done everything you said so far, since the virus i've been having pop-ups like crazy on IE 7, and still am up to thise point
Hey theillusi I'm kinda shocked here, that ComboFix managed to delete so many trojans that full-fledged antimalware like AVG and Superantispyware did not even detect... You are still infected though; let's complete it! 1. Please disable all security programs, such as antiviruses, antispywares, and firewalls. Also disable your internet connection. Open Notepad and copy/paste the text in the code box below into it: Code: File:: C:\windows\system32\geBuVPhF.dll C:\windows\system32\opnomjgH.dll C:\windows\system32\dxjaisaa.dll c:\windows\system32\khfdCtuT.dll C:\windows\system32\awtttQHx.dll C:\windows\system32\wvUnKAqn.dll C:\windows\system32\tuvuTNee.dll C:\windows\system32\dxjaisaa.dll C:\windows\system32\opnomjgH.dll C:\windows\system32\iifdayWp.dll Registry:: [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{3CCDF8CE-C339-4DD6-AD4F-CA7230C7E2F2}"=- [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\opnomjgH] • Save this as CFScript.txt in the same folder as ComboFix. • Then drag the CFScript.txt into Combo-Fix.exe. • This will start ComboFix again. After reboot, (in case it asks to reboot), post the ComboFix log here. The log will be located at C:\ComboFix(.txt). Do not click on the ComoboFix window, as it may cause it to stall. 2. Please run HijackThis. • Click on the button which says Main Menu, then Do a system scan only. • Please wait for the scan to be completed. • After the scan has completed, check the following entries. Code: O20 - AppInit_DLLs: qjtdar.dll Click on the button Fix checked NOTE:: Close all browsers before fixing anything. After that, reboot. Tell me how your computer fares. Also zip this folder C:\Qoobox into a zip file and upload it to http://www.uploadmalware.com/ Best Regards
ComboFix 08-11-09.04 - Nick 2008-11-11 10:24:59.2 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.474 [GMT 0:00] Running from: c:\documents and settings\Nick\My Documents\Downloads\Combo-Fix.exe Command switches used :: c:\documents and settings\Nick\My Documents\Downloads\CFScript.txt * Created a new restore point FILE :: c:\windows\system32\awtttQHx.dll c:\windows\system32\dxjaisaa.dll c:\windows\system32\geBuVPhF.dll c:\windows\system32\iifdayWp.dll c:\windows\system32\khfdCtuT.dll c:\windows\system32\opnomjgH.dll c:\windows\system32\tuvuTNee.dll c:\windows\system32\wvUnKAqn.dll . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\awtttQHx.dll c:\windows\system32\dxjaisaa.dll c:\windows\system32\FhPVuBeg.ini c:\windows\system32\FhPVuBeg.ini2 c:\windows\system32\geBuVPhF.dll c:\windows\system32\iifdayWp.dll c:\windows\system32\iyotjvhh.dll c:\windows\system32\khfdCtuT.dll c:\windows\system32\mcrh.tmp c:\windows\system32\opnomjgH.dll c:\windows\system32\qjtdar.dll c:\windows\system32\tuvuTNee.dll c:\windows\system32\uypygehx.ini c:\windows\system32\wvUnKAqn.dll c:\windows\system32\xhegypyu.dll . ((((((((((((((((((((((((( Files Created from 2008-10-11 to 2008-11-11 ))))))))))))))))))))))))))))))) . 2008-11-10 21:28 . 2008-11-10 21:28 85,504 --a------ c:\windows\system32\eoevpmjx.dll 2008-11-09 22:42 . 2008-11-09 22:42 <DIR> d-------- c:\program files\Windows Live Favorites 2008-11-09 22:38 . 2008-11-09 22:42 <DIR> d-------- c:\program files\Windows Live 2008-11-06 10:15 . 2008-11-06 10:15 <DIR> d-------- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com 2008-11-06 10:15 . 2008-11-06 10:15 <DIR> d-------- c:\documents and settings\Administrator 2008-11-06 10:05 . 2008-11-06 10:05 <DIR> d-------- c:\program files\SUPERAntiSpyware 2008-11-06 10:05 . 2008-11-06 10:05 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard 2008-11-06 10:05 . 2008-11-06 10:05 <DIR> d-------- c:\documents and settings\Nick\Application Data\SUPERAntiSpyware.com 2008-11-06 10:05 . 2008-11-06 10:05 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2008-11-06 00:41 . 2008-11-06 00:41 <DIR> d-------- c:\program files\Trend Micro 2008-11-05 21:35 . 2008-11-05 21:35 49,676 --a------ c:\documents and settings\Nick\javaplugin.exe 2008-10-29 09:33 . 2008-10-29 09:41 <DIR> d-------- c:\program files\PogoSticker 2008-10-27 19:25 . 2008-10-27 19:25 <DIR> d-------- c:\documents and settings\Nick\Application Data\Acoustica 2008-10-27 19:25 . 2007-08-07 11:32 57,344 --a------ c:\windows\system32\Wnaspint.dll 2008-10-27 19:05 . 2008-10-27 19:25 <DIR> d-------- c:\program files\Acoustica Mixcraft 4 2008-10-27 19:05 . 2008-10-27 19:05 <DIR> d-------- c:\documents and settings\All Users\Application Data\Acoustica 2008-10-27 19:03 . 2008-10-27 19:25 <DIR> d-------- c:\program files\Acoustica Shared Effects 2008-10-27 19:02 . 2008-10-27 19:03 <DIR> d-------- c:\program files\Acoustica Mixcraft . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-11 10:39 --------- d-----w c:\documents and settings\All Users\Application Data\Kontiki 2008-11-10 22:20 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater 2008-11-09 22:44 --------- d-----w c:\program files\Windows Live Toolbar 2008-11-09 22:38 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller 2008-11-09 17:35 --------- d-----w c:\documents and settings\Nick\Application Data\LimeWire 2008-11-08 23:19 --------- d-----w c:\documents and settings\Nick\Application Data\uTorrent 2008-10-30 09:16 --------- d-----w c:\documents and settings\Nick\Application Data\OpenOffice.org2 2008-10-22 12:33 --------- d-----w c:\program files\Microsoft Silverlight 2008-10-08 20:42 --------- d-----w c:\program files\Kontiki 2008-09-26 08:56 --------- d-----w c:\program files\Microsoft LifeCam 2008-09-17 10:11 --------- d-----w c:\program files\AlienGUIse 2008-09-17 02:52 --------- d-----w c:\program files\Common Files\Stardock 2008-09-14 13:54 --------- d-----w c:\program files\InterActual 2008-09-11 11:34 --------- d-----w c:\documents and settings\Mum\Application Data\Apple Computer 2008-09-11 11:32 --------- d-----w c:\documents and settings\Mum\Application Data\ATI . ((((((((((((((((((((((((((((( snapshot@2008-11-10_21.28.55.23 ))))))))))))))))))))))))))))))))))))))))) . - 2008-11-10 21:20:20 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_760.dat + 2008-11-11 10:37:11 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_760.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4CAB59B4-55A3-4737-9FD5-B93C6430BF76}] 2008-11-10 21:28 85504 --a------ c:\windows\system32\eoevpmjx.dll [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-08 39408] "kdx"="c:\program files\Kontiki\KHost.exe" [2008-02-27 1032376] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-12-19 1347584] "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 90112] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-09-29 1234712] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "tsnp2std"="c:\windows\tsnp2std.exe" [2007-01-05 258048] "snp2std"="c:\windows\vsnp2std.exe" [2006-09-15 675840] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-22 116040] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-05-27 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-07-30 289064] "VX1000"="c:\windows\vVX1000.exe" [2007-04-10 709992] "LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2007-05-17 279912] "b8dcc183"="c:\windows\system32\xhegypyu.dll" [BU] "SigmatelSysTrayApp"="stsystra.exe" [2006-07-27 c:\windows\stsystra.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-04-17 9117696] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2008-07-23 16:28 352256 c:\program files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB] 2001-12-20 22:34 24576 c:\program files\AlienGUIse\fastload.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=qjtdar.dll [HKLM\~\startupfolder\C:^Documents and Settings^Nick^Start Menu^Programs^Startup^LimeWire On Startup.lnk] path=c:\documents and settings\Nick\Start Menu\Programs\Startup\LimeWire On Startup.lnk backup=c:\windows\pss\LimeWire On Startup.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^Nick^Start Menu^Programs^Startup^OpenOffice.org 2.4.lnk] path=c:\documents and settings\Nick\Start Menu\Programs\Startup\OpenOffice.org 2.4.lnk backup=c:\windows\pss\OpenOffice.org 2.4.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6] --a------ 2008-03-25 20:21 50528 c:\program files\AIM6\aim6.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMC] --a------ 2008-01-14 11:14 4053102 c:\program files\FriendFinder\FriendFinder Messenger 4\imc.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM] --a------ 2008-04-17 23:27 9117696 c:\program files\MySpace\IM\MySpaceIM.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "c:\\Program Files\\AVG\\AVG8\\avgemc.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "c:\\Program Files\\AIM6\\aim6.exe"= "c:\\Program Files\\LimeWire\\LimeWire.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"= "c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"= "c:\\Program Files\\Kontiki\\KService.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"= R0 atiide;atiide;c:\windows\system32\DRIVERS\atiide.sys [2006-09-13 3456] R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-08-29 97928] R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-08-29 875288] R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-08-29 231704] R2 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-07-04 76040] R2 MSCamSvc;MSCamSvc;c:\program files\Microsoft LifeCam\MSCamS32.exe [2007-05-17 271720] R2 ousbehci;OrangeWare USB Enhanced Host Controller Service;c:\windows\system32\Drivers\ousbehci.sys [2007-03-26 46336] R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652] S3 SNP2STD;USB2.0 PC Camera (SNP2STD);c:\windows\system32\DRIVERS\snp2sxp.sys [2007-01-26 12028032] S3 VX1000;VX-1000;c:\windows\system32\DRIVERS\VX1000.sys [2007-04-10 1966312] . Contents of the 'Scheduled Tasks' folder 2008-09-06 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2008-11-11 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job - c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20] 2008-09-26 c:\windows\Tasks\Microsoft_Hardware_Launch_setup_exe.job - D:\setup.exe [] 2008-11-11 c:\windows\Tasks\RegCure Program Check.job - c:\program files\RegCure\RegCure.exe [2008-04-21 21:21] 2008-05-30 c:\windows\Tasks\RegCure.job - c:\program files\RegCure\RegCure.exe [2008-04-21 21:21] . - - - - ORPHANS REMOVED - - - - BHO-{3c978489-839e-4e9b-8d12-de0cd3383801} - c:\windows\system32\qjtdar.dll BHO-{3CCDF8CE-C339-4DD6-AD4F-CA7230C7E2F2} - c:\windows\system32\opnomjgH.dll BHO-{CDD5B88A-A304-4332-B9C3-84EBFADDAB4B} - c:\windows\system32\geBuVPhF.dll ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-11 10:37:56 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... scan completed successfully hidden files: 0 ************************************************************************** . ------------------------ Other Running Processes ------------------------ . c:\windows\system32\ati2evxx.exe c:\windows\system32\ati2evxx.exe c:\windows\system32\WLTRYSVC.EXE c:\windows\system32\BCMWLTRY.EXE c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe c:\program files\Bonjour\mDNSResponder.exe c:\program files\Google\Common\Google Updater\GoogleUpdaterService.exe c:\program files\Kontiki\KService.exe c:\program files\AVG\AVG8\avgrsx.exe c:\program files\ATI Technologies\ATI.ACE\CLI.exe c:\program files\iPod\bin\iPodService.exe c:\program files\ATI Technologies\ATI.ACE\CLI.exe . ************************************************************************** . Completion time: 2008-11-11 10:44:54 - machine was rebooted ComboFix-quarantined-files.txt 2008-11-11 10:44:49 ComboFix2.txt 2008-11-10 21:30:41 Pre-Run: 5,976,870,912 bytes free Post-Run: 5,989,605,376 bytes free 202 --- E O F --- 2008-11-10 08:56:02 that the combo fix latest log, now doing the hijack step
OK, done everything you said, what do I do with the orginal Qoobox folder? it looks like some kind of quarrantine folder or something, i dare not touch it
Now this malware is just getting on my nerves... It's not gone yet. I'll need you to do something with Combofix, then one more scan. 1. Please disable all security programs, such as antiviruses, antispywares, and firewalls. Also disable your internet connection. Open Notepad and copy/paste the text in the code box below into it: Code: File:: c:\windows\system32\qjtdar.dll c:\windows\system32\eoevpmjx.dll c:\windows\system32\xhegypyu.dll Registry:: [-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4CAB59B4-55A3-4737-9FD5-B93C6430BF76}] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "b8dcc183"=- [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows] "appinit_dlls"=- • Save this as CFScript.txt in the same folder as ComboFix. • Then drag the CFScript.txt into Combo-Fix.exe. • This will start ComboFix again. After reboot, (in case it asks to reboot), post the ComboFix log here. The log will be located at C:\ComboFix(.txt). Do not click on the ComoboFix window, as it may cause it to stall. 2. Please download Malwarebytes Anti-Malware and install it. Follow the prompts and reboot if required. Launch Malwarebytes either by running C:\Program Files\Malwarebytes' Anti-Malware\mbam.exe or double-click the Malwarebytes' Anti-Malware shortcut on your Desktop. Configuring Malwarebytes • Click on the tab Settings. • Make sure only these boxes are checked: Code: Terminate Internet Explorer Automatically save and display logfile after removal Always scan memory objects Always scan registry objects Always scan filesystem Always scan extra and heuristics objects Updating Malwarebytes • Click on the tab Update. • Press the button Check for Updates • Wait for Malwarebytes to be fully updated. Scanning Time • Click on the tab Scanner. • Check Perform full scan and click on Scan • Wait for the scan to complete, and then click on Show Results. • Make sure all items are checked, then click on Remove Selected. **If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If you are asked to restart the computer, please do so immediately. Post A Log • A text box will pop up after the removal process is over. Post the contents of the text here. • If no text box pops up, launch Malwarebytes, and click on the tab Logs. • The logs will appear as mbam-log-*date-*time.txt. Select the latest one, and then click on Open. • Post the log here. Best Regards
ComboFix 08-11-10.01 - Nick 2008-11-11 21:14:05.3 - NTFSx86 Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.500 [GMT 0:00] Running from: c:\documents and settings\Nick\My Documents\Downloads\Combo-Fix.exe Command switches used :: c:\documents and settings\Nick\My Documents\Downloads\CFScript.txt * Created a new restore point FILE :: c:\windows\system32\eoevpmjx.dll c:\windows\system32\qjtdar.dll c:\windows\system32\xhegypyu.dll . ((((((((((((((((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))))))))))))))))))))))))))) . c:\windows\system32\eoevpmjx.dll . ((((((((((((((((((((((((( Files Created from 2008-10-11 to 2008-11-11 ))))))))))))))))))))))))))))))) . 2008-11-11 10:51 . 2008-11-11 10:51 3,368,675 --a------ C:\Qoobox.zip 2008-11-09 22:42 . 2008-11-09 22:42 <DIR> d-------- c:\program files\Windows Live Favorites 2008-11-09 22:38 . 2008-11-09 22:42 <DIR> d-------- c:\program files\Windows Live 2008-11-06 10:15 . 2008-11-06 10:15 <DIR> d-------- c:\documents and settings\Administrator\Application Data\SUPERAntiSpyware.com 2008-11-06 10:15 . 2008-11-06 10:15 <DIR> d-------- c:\documents and settings\Administrator 2008-11-06 10:05 . 2008-11-06 10:05 <DIR> d-------- c:\program files\SUPERAntiSpyware 2008-11-06 10:05 . 2008-11-06 10:05 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard 2008-11-06 10:05 . 2008-11-06 10:05 <DIR> d-------- c:\documents and settings\Nick\Application Data\SUPERAntiSpyware.com 2008-11-06 10:05 . 2008-11-06 10:05 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com 2008-11-06 00:41 . 2008-11-06 00:41 <DIR> d-------- c:\program files\Trend Micro 2008-11-05 21:35 . 2008-11-05 21:35 49,676 --a------ c:\documents and settings\Nick\javaplugin.exe 2008-10-29 09:33 . 2008-10-29 09:41 <DIR> d-------- c:\program files\PogoSticker 2008-10-27 19:25 . 2008-10-27 19:25 <DIR> d-------- c:\documents and settings\Nick\Application Data\Acoustica 2008-10-27 19:25 . 2007-08-07 11:32 57,344 --a------ c:\windows\system32\Wnaspint.dll 2008-10-27 19:05 . 2008-10-27 19:25 <DIR> d-------- c:\program files\Acoustica Mixcraft 4 2008-10-27 19:05 . 2008-10-27 19:05 <DIR> d-------- c:\documents and settings\All Users\Application Data\Acoustica 2008-10-27 19:03 . 2008-10-27 19:25 <DIR> d-------- c:\program files\Acoustica Shared Effects 2008-10-27 19:02 . 2008-10-27 19:03 <DIR> d-------- c:\program files\Acoustica Mixcraft . (((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))) . 2008-11-11 21:16 --------- d-----w c:\documents and settings\All Users\Application Data\Kontiki 2008-11-10 22:20 --------- d-----w c:\documents and settings\All Users\Application Data\Google Updater 2008-11-09 22:44 --------- d-----w c:\program files\Windows Live Toolbar 2008-11-09 22:38 --------- d-----w c:\documents and settings\All Users\Application Data\WLInstaller 2008-11-09 17:35 --------- d-----w c:\documents and settings\Nick\Application Data\LimeWire 2008-11-08 23:19 --------- d-----w c:\documents and settings\Nick\Application Data\uTorrent 2008-10-30 09:16 --------- d-----w c:\documents and settings\Nick\Application Data\OpenOffice.org2 2008-10-22 12:33 --------- d-----w c:\program files\Microsoft Silverlight 2008-10-08 20:42 --------- d-----w c:\program files\Kontiki 2008-09-26 08:56 --------- d-----w c:\program files\Microsoft LifeCam 2008-09-17 10:11 --------- d-----w c:\program files\AlienGUIse 2008-09-17 02:52 --------- d-----w c:\program files\Common Files\Stardock 2008-09-15 11:57 1,846,016 ----a-w c:\windows\system32\win32k.sys 2008-09-14 13:54 --------- d-----w c:\program files\InterActual 2008-09-11 11:34 --------- d-----w c:\documents and settings\Mum\Application Data\Apple Computer 2008-09-11 11:32 --------- d-----w c:\documents and settings\Mum\Application Data\ATI 2008-08-26 07:24 826,368 ----a-w c:\windows\system32\wininet.dll 2008-08-14 09:57 2,185,984 ----a-w c:\windows\system32\ntoskrnl.exe 2008-08-14 09:18 2,062,976 ----a-w c:\windows\system32\ntkrnlpa.exe . ((((((((((((((((((((((((((((( snapshot@2008-11-10_21.28.55.23 ))))))))))))))))))))))))))))))))))))))))) . - 2008-11-10 21:20:20 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_760.dat + 2008-11-11 10:37:11 16,384 ----atw c:\windows\Temp\Perflib_Perfdata_760.dat . ((((((((((((((((((((((((((((((((((((( Reg Loading Points )))))))))))))))))))))))))))))))))))))))))))))))))) . . *Note* empty entries & legit default entries are not shown REGEDIT4 [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360] "msnmsgr"="c:\program files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 5724184] "swg"="c:\program files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2008-09-08 39408] "kdx"="c:\program files\Kontiki\KHost.exe" [2008-02-27 1032376] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Broadcom Wireless Manager UI"="c:\windows\system32\WLTRAY.exe" [2005-12-19 1347584] "ATICCC"="c:\program files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 90112] "AVG8_TRAY"="c:\progra~1\AVG\AVG8\avgtray.exe" [2008-09-29 1234712] "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 39792] "SunJavaUpdateSched"="c:\program files\Java\jre1.6.0_07\bin\jusched.exe" [2008-06-10 144784] "tsnp2std"="c:\windows\tsnp2std.exe" [2007-01-05 258048] "snp2std"="c:\windows\vsnp2std.exe" [2006-09-15 675840] "AppleSyncNotifier"="c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe" [2008-07-22 116040] "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2008-05-27 413696] "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2008-07-30 289064] "VX1000"="c:\windows\vVX1000.exe" [2007-04-10 709992] "LifeCam"="c:\program files\Microsoft LifeCam\LifeExp.exe" [2007-05-17 279912] "SigmatelSysTrayApp"="stsystra.exe" [2006-07-27 c:\windows\stsystra.exe] [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run] "MySpaceIM"="c:\program files\MySpace\IM\MySpaceIM.exe" [2008-04-17 9117696] [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks] "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824] [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon] 2008-07-23 16:28 352256 c:\program files\SUPERAntiSpyware\SASWINLO.dll [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB] 2001-12-20 22:34 24576 c:\program files\AlienGUIse\fastload.dll [HKLM\~\startupfolder\C:^Documents and Settings^Nick^Start Menu^Programs^Startup^LimeWire On Startup.lnk] path=c:\documents and settings\Nick\Start Menu\Programs\Startup\LimeWire On Startup.lnk backup=c:\windows\pss\LimeWire On Startup.lnkStartup [HKLM\~\startupfolder\C:^Documents and Settings^Nick^Start Menu^Programs^Startup^OpenOffice.org 2.4.lnk] path=c:\documents and settings\Nick\Start Menu\Programs\Startup\OpenOffice.org 2.4.lnk backup=c:\windows\pss\OpenOffice.org 2.4.lnkStartup [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6] --a------ 2008-03-25 20:21 50528 c:\program files\AIM6\aim6.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMC] --a------ 2008-01-14 11:14 4053102 c:\program files\FriendFinder\FriendFinder Messenger 4\imc.exe [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MySpaceIM] --a------ 2008-04-17 23:27 9117696 c:\program files\MySpace\IM\MySpaceIM.exe [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List] "%windir%\\system32\\sessmgr.exe"= "c:\\Program Files\\AVG\\AVG8\\avgupd.exe"= "c:\\Program Files\\AVG\\AVG8\\avgemc.exe"= "c:\\Program Files\\Bonjour\\mDNSResponder.exe"= "c:\\Program Files\\uTorrent\\uTorrent.exe"= "c:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"= "c:\\Program Files\\AIM6\\aim6.exe"= "c:\\Program Files\\LimeWire\\LimeWire.exe"= "c:\\Program Files\\iTunes\\iTunes.exe"= "c:\\Program Files\\Microsoft LifeCam\\LifeCam.exe"= "c:\\Program Files\\Microsoft LifeCam\\LifeExp.exe"= "c:\\Program Files\\Kontiki\\KService.exe"= "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"= "c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"= "c:\\Program Files\\MySpace\\IM\\MySpaceIM.exe"= R0 atiide;atiide;c:\windows\system32\DRIVERS\atiide.sys [2006-09-13 3456] R1 AvgLdx86;AVG AVI Loader Driver x86;c:\windows\system32\Drivers\avgldx86.sys [2008-08-29 97928] R2 avg8emc;AVG8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-08-29 875288] R2 avg8wd;AVG8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-08-29 231704] R2 AvgTdiX;AVG8 Network Redirector;c:\windows\system32\Drivers\avgtdix.sys [2008-07-04 76040] R2 MSCamSvc;MSCamSvc;c:\program files\Microsoft LifeCam\MSCamS32.exe [2007-05-17 271720] R2 ousbehci;OrangeWare USB Enhanced Host Controller Service;c:\windows\system32\Drivers\ousbehci.sys [2007-03-26 46336] R2 Viewpoint Manager Service;Viewpoint Manager Service;c:\program files\Viewpoint\Common\ViewpointService.exe [2007-01-04 24652] S3 SNP2STD;USB2.0 PC Camera (SNP2STD);c:\windows\system32\DRIVERS\snp2sxp.sys [2007-01-26 12028032] S3 VX1000;VX-1000;c:\windows\system32\DRIVERS\VX1000.sys [2007-04-10 1966312] . Contents of the 'Scheduled Tasks' folder 2008-09-06 c:\windows\Tasks\AppleSoftwareUpdate.job - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 11:34] 2008-11-11 c:\windows\Tasks\Check Updates for Windows Live Toolbar.job - c:\program files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 11:20] 2008-09-26 c:\windows\Tasks\Microsoft_Hardware_Launch_setup_exe.job - D:\setup.exe [] 2008-11-11 c:\windows\Tasks\RegCure Program Check.job - c:\program files\RegCure\RegCure.exe [2008-04-21 21:21] 2008-05-30 c:\windows\Tasks\RegCure.job - c:\program files\RegCure\RegCure.exe [2008-04-21 21:21] . ************************************************************************** catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net Rootkit scan 2008-11-11 21:16:58 Windows 5.1.2600 Service Pack 2 NTFS scanning hidden processes ... scanning hidden autostart entries ... scanning hidden files ... ************************************************************************** . Completion time: 2008-11-11 21:19:22 ComboFix-quarantined-files.txt 2008-11-11 21:18:18 ComboFix2.txt 2008-11-11 10:44:55 ComboFix3.txt 2008-11-10 21:30:41 Pre-Run: 5,970,681,856 bytes free Post-Run: 5,966,245,888 bytes free 160 --- E O F --- 2008-11-10 08:56:02 theres the log, doing the malwarebyte thing now
Malwarebytes' Anti-Malware 1.30 Database version: 1383 Windows 5.1.2600 Service Pack 2 11/11/2008 22:19:25 mbam-log-2008-11-11 (22-19-25).txt Scan type: Full Scan (C:\|) Objects scanned: 107349 Time elapsed: 49 minute(s), 36 second(s) Memory Processes Infected: 0 Memory Modules Infected: 0 Registry Keys Infected: 0 Registry Values Infected: 0 Registry Data Items Infected: 0 Folders Infected: 0 Files Infected: 20 Memory Processes Infected: (No malicious items detected) Memory Modules Infected: (No malicious items detected) Registry Keys Infected: (No malicious items detected) Registry Values Infected: (No malicious items detected) Registry Data Items Infected: (No malicious items detected) Folders Infected: (No malicious items detected) Files Infected: C:\Qoobox\Quarantine\C\WINDOWS\system32\dpclwqtu.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Qoobox\Quarantine\C\WINDOWS\system32\geBuVPhF.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Qoobox\Quarantine\C\WINDOWS\system32\igfpogpw.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Qoobox\Quarantine\C\WINDOWS\system32\iyotjvhh.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Qoobox\Quarantine\C\WINDOWS\system32\jkkJAqRK.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Qoobox\Quarantine\C\WINDOWS\system32\qjtdar.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Qoobox\Quarantine\C\WINDOWS\system32\rqeidann.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Qoobox\Quarantine\C\WINDOWS\system32\svtptf.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Qoobox\Quarantine\C\WINDOWS\system32\wukbsbdb.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully. C:\Qoobox\Quarantine\C\WINDOWS\system32\xhegypyu.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{BEB5091D-D6F0-4A20-B2BE-6F16D17F0AD8}\RP184\A0570586.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{BEB5091D-D6F0-4A20-B2BE-6F16D17F0AD8}\RP184\A0570588.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{BEB5091D-D6F0-4A20-B2BE-6F16D17F0AD8}\RP184\A0570589.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{BEB5091D-D6F0-4A20-B2BE-6F16D17F0AD8}\RP184\A0570590.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{BEB5091D-D6F0-4A20-B2BE-6F16D17F0AD8}\RP184\A0570591.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{BEB5091D-D6F0-4A20-B2BE-6F16D17F0AD8}\RP184\A0570593.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{BEB5091D-D6F0-4A20-B2BE-6F16D17F0AD8}\RP188\A0572615.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{BEB5091D-D6F0-4A20-B2BE-6F16D17F0AD8}\RP188\A0572623.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{BEB5091D-D6F0-4A20-B2BE-6F16D17F0AD8}\RP188\A0572624.dll (Trojan.Vundo) -> Quarantined and deleted successfully. C:\System Volume Information\_restore{BEB5091D-D6F0-4A20-B2BE-6F16D17F0AD8}\RP188\A0572626.dll (Trojan.Vundo) -> Quarantined and deleted successfully. and there the malwarebytes log Anything else? lol it must be gone by now Thanks so much for your help
Hey theillusi Yes, you're all clean now. You can delete HijackThis and Combofix (this is recommended), and also uninstall the programs we used if you wish. Enjoy! Best Regards
