Skip to main content
Start a Conversation

Unsolved

This post is more than 5 years old

shorty3913

9 Posts

1262

May 3rd, 2007 18:00

Hijack this log. please help me!

Let me tell you what my computer is doing..
There are 2 other people that use the computer besides me and one of them likes to download music. I ran a virus check and counterspy and they found a couple of things,so I cleaned them. However, my computer still seems to be messed up. If you do a search in google and type in something like "pizza" all the search results will come back with stuff like "freesingles.net,canadianmeds.com" and other junk like that. How do I make this go away? Also,it only seems to do this from google and yahoo. I was searching for something from aol.com and it gave me normal results..Please help me!
 
 
 
Logfile of HijackThis v1.99.1
Scan saved at 3:13:52 PM, on 5/3/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\eHome\ehRecvr.exe
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe
C:\Program Files\Napster\napster.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\ehome\RMSysTry.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\ehome\RMSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Sunbelt Software\CounterSpy\CounterSpy.exe
C:\Program Files\Sunbelt Software\CounterSpy\SBCSSvc.exe
C:\Program Files\Sunbelt Software\CounterSpy\SBCSTray.exe
C:\Program Files\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=1061230
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sunsentinel.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=1061230
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
R3 - URLSearchHook: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll (file missing)
R3 - URLSearchHook: (no name) - {D73F49B6-B51B-4d32-A3B7-BD04B8342F53} - C:\Program Files\MorpheusBar\SrchAstt\4.bin\MBSRCAS.DLL (file missing)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: MorpheusToolbar BHO - {3F3714A1-89A4-46be-8AF3-D0C9D1FB03F9} - C:\Program Files\MorpheusBar\bar\4.bin\MORPHBAR.DLL (file missing)
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O2 - BHO: (no name) - {D73F49B1-B51B-4d32-A3B7-BD04B8342F53} - C:\Program Files\MorpheusBar\SrchAstt\4.bin\MBSRCAS.DLL (file missing)
O2 - BHO: XBTP02634 Class - {F97DA966-F09D-4cab-BF29-75A0026986EA} - C:\PROGRA~1\BEARSH~1\BEARSH~2\MediaBar.dll (file missing)
O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll (file missing)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O3 - Toolbar: Morpheus Toolbar - {3F3714A9-89A4-46be-8AF3-D0C9D1FB03F9} - C:\Program Files\MorpheusBar\bar\4.bin\MORPHBAR.DLL (file missing)
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [DMXLauncher] "C:\Program Files\Dell\Media Experience\DMXLauncher.exe"
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Corel Photo Downloader] "C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe"
O4 - HKLM\..\Run: [NapsterShell] "C:\Program Files\Napster\napster.exe" /systray
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SBCSTray] C:\Program Files\Sunbelt Software\CounterSpy\SBCSTray.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Extender Resource Monitor.lnk = C:\WINDOWS\ehome\RMSysTry.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {1B9B97D0-C0F4-4045-9B42-50A4535C9041} (WCLoaderCtl Class) - http://download.paltalk.com/wcloader_prod/wcloader.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqna/downloads/sysinfo.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5022/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{EF087A60-1F19-4270-B34B-612E9ACED9CF}: NameServer = 194.54.90.226
O20 - AppInit_DLLs: C:\WINDOWS\system32\perfc000.dat
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: AOL Instant Messenger - {55F5986E-2D4A-7058-C335-9102B1289CE9} - c:\program files\aim\winwrvph6.dll
O21 - SSODL: 12133444-BF36-4d4e-B7FB-A3424C645DE4 - {8B99E401-03BF-BC94-F6CA-E7D83FF55910} - c:\program files\gemmaster\winqhdycs8.dll
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sunbelt CounterSpy Antispyware (SBCSSvc) - Sunbelt Software - C:\Program Files\Sunbelt Software\CounterSpy\SBCSSvc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
 

bamajim

10.4K Posts

May 4th, 2007 12:00

shorty3913

1. To enable the viewing of Hidden and System files follow these steps:
  • Right click on Start and select Explore.
    Select the Tools menu and click Folder Options.
    After the new window appears select the View tab.
    Put a checkmark in the checkbox labeled Display the contents of system folders.
    Under the Hidden files and folders section select the radio button labeled Show hidden files and folders. Remove the checkmark from the checkbox labeled Hide file extensions for known file types.
    Remove the checkmark from the checkbox labeled Hide protected operating system files.
    Click Yes To confirm
    Press the Apply button and then the OK button.
2. I need you to help us out with some research

Please go HERE

Put Your Name, and Dell HJT forum

and In the file to submit box, click Browse.Using Windows Explorer
  • (Right click on "Start," select "Explore," and you will see the "tree' of file folders in the left side of the window. Click on the "+" next to any folder name to expand its contents)
Locate the file
  • C:\WINDOWS\system32\perfc000.dat
In the comments tell them that I asked you to upload the file
Then Select Send File.

3. Please download the Killbox.
  • 1)Save it to the desktop
    2) Rt Click->>Extract all->.Extract it to your Desktop
    3) Double Click Killbox.exe to run it
    4)Select " Delete on Reboot", and then select "All files".
    5) Copy the file names below to the clipboard by highlighting them and pressing Control-C:

    • C:\WINDOWS\system32\perfc000.dat

    6) Return to Killbox, go to the File menu, and choose " Paste from Clipboard".
    7) Click the red-and-white " Delete File" button.  Click " Yes" at the Delete on Reboot prompt.  Click " No" at the Pending Operations prompt.

4. Rerun Hijackthis (scan only) and place checks beside the following entries
  • R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = \blank.htm
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
    R3 - URLSearchHook: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll (file missing)
    R3 - URLSearchHook: (no name) - {D73F49B6-B51B-4d32-A3B7-BD04B8342F53} - C:\Program Files\MorpheusBar\SrchAstt\4.bin\MBSRCAS.DLL (file missing)
    O2 - BHO: MorpheusToolbar BHO - {3F3714A1-89A4-46be-8AF3-D0C9D1FB03F9} - C:\Program Files\MorpheusBar\bar\4.bin\MORPHBAR.DLL (file missing)
    O2 - BHO: (no name) - {D73F49B1-B51B-4d32-A3B7-BD04B8342F53} - C:\Program Files\MorpheusBar\SrchAstt\4.bin\MBSRCAS.DLL (file missing)
    O2 - BHO: XBTP02634 Class - {F97DA966-F09D-4cab-BF29-75A0026986EA} - C:\PROGRA~1\BEARSH~1\BEARSH~2\MediaBar.dll (file missing)
    O3 - Toolbar: BearShare MediaBar - {D3DEE18F-DB64-4BEB-9FF1-E1F0A5033E4A} - C:\Program Files\BearShare applications\BearShare MediaBar\MediaBar.dll (file missing)
    O3 - Toolbar: Morpheus Toolbar - {3F3714A9-89A4-46be-8AF3-D0C9D1FB03F9} - C:\Program Files\MorpheusBar\bar\4.bin\MORPHBAR.DLL (file missing)
    O20 - AppInit_DLLs: C:\WINDOWS\system32\perfc000.dat
Close all other open windows except Hijackthis and Select " Fix checked"

You may receive an error message during the Hijackthis fix, just ignore it.

5. Reboot your PC->>Rerun Hijackthis and post a fresh Hijackthis log
 
bamajim   Graduate of MRU
CastleCops  Instructor





shorty3913

9 Posts

May 4th, 2007 13:00

I sent that file like you asked me to do and then did the other stuff. This is the new log..
 
Logfile of HijackThis v1.99.1
Scan saved at 10:29:29 AM, on 5/4/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16414)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\HPZipm12.exe
C:\WINDOWS\ehome\RMSvc.exe
C:\Program Files\Sunbelt Software\CounterSpy\SBCSSvc.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\ehome\ehtray.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\stsystra.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe
C:\Program Files\Dell\Media Experience\DMXLauncher.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe
C:\Program Files\Napster\napster.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Sunbelt Software\CounterSpy\SBCSTray.exe
C:\Program Files\Dell Support\DSAgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\Program Files\Digital Line Detect\DLG.exe
C:\WINDOWS\ehome\RMSysTry.exe
C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
C:\Program Files\HP\Digital Imaging\bin\hpqSTE08.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\eHome\ehmsas.exe
C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Program Files\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=1061230
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,SearchAssistant = http://search.bearshare.com/sidebar.html?src=ssb
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://search.bearshare.com/sidebar.html?src=ssb
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.sunsentinel.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Search,Default_Page_URL = www.google.com/ig/dell?hl=en&client=dell-usuk-rel&channel=us&ibd=1061230
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\System32\DLA\DLASHX_W.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - C:\Program Files\BAE\BAE.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [IAAnotif] "C:\Program Files\Intel\Intel Matrix Storage Manager\Iaanotif.exe"
O4 - HKLM\..\Run: [DMXLauncher] "C:\Program Files\Dell\Media Experience\DMXLauncher.exe"
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [NapsterShell] "C:\Program Files\Napster\napster.exe" /systray
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_11\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SBCSTray] C:\Program Files\Sunbelt Software\CounterSpy\SBCSTray.exe
O4 - HKLM\..\Run: [Corel Photo Downloader] C:\Program Files\Corel\Corel Snapfire Plus\Corel Photo Downloader.exe
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Digital Line Detect.lnk = ?
O4 - Global Startup: Extender Resource Monitor.lnk = C:\WINDOWS\ehome\RMSysTry.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O8 - Extra context menu item: &Yahoo! Search - file:///C:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MI1933~1\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Yahoo! &Dictionary - file:///C:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///C:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///C:\Program Files\Yahoo!\Common/ycsms.htm
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {1B9B97D0-C0F4-4045-9B42-50A4535C9041} (WCLoaderCtl Class) - http://download.paltalk.com/wcloader_prod/wcloader.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {49232000-16E4-426C-A231-62846947304B} (SysData Class) - http://ipgweb.cce.hp.com/rdqna/downloads/sysinfo.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/mcfscan/2,2,0,5022/mcfscan.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{EF087A60-1F19-4270-B34B-612E9ACED9CF}: NameServer = 194.54.90.226
O20 - AppInit_DLLs: C:\WINDOWS\system32\perfc000.dat
O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll
O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O21 - SSODL: AOL Instant Messenger - {55F5986E-2D4A-7058-C335-9102B1289CE9} - c:\program files\aim\winwrvph6.dll
O21 - SSODL: 12133444-BF36-4d4e-B7FB-A3424C645DE4 - {8B99E401-03BF-BC94-F6CA-E7D83FF55910} - c:\program files\gemmaster\winqhdycs8.dll
O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMON) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\Iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Unknown owner - C:\Program Files\iPod\bin\iPodService.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Sunbelt CounterSpy Antispyware (SBCSSvc) - Sunbelt Software - C:\Program Files\Sunbelt Software\CounterSpy\SBCSSvc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
 

bamajim

10.4K Posts

May 4th, 2007 15:00

shorty3913

Thanks. I got the file and am currently looking at it.

I am going to need some more information please to resolve this infection

1. Download this file - combofix.exe
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your next reply

Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall

2. Go HERE and Download RegSearch by Bobbi Flekman
  • Save it to your Desktop
    Rt Click->> Extract All->>Extract it to your desktop
    Open the Regsearch folder
    Double Click RegSearch and Run
    Copy and paste the following into the top box

    • perfc000.dat

    Then O.K. Let the program run. When it is finished the results
    will open in notepad
    Copy and paste the results as a reply to this thread

Please post the contents of both logs in your reply. You may have to post the results in more than one reply
 
bamajim   Graduate of MRU
CastleCops Instructor







shorty3913

9 Posts

May 4th, 2007 16:00

Windows Registry Editor Version 5.00
; Registry Search 2.0 by Bobbi Flekman © 2005
; Version: 2.0.4.2
; Results at 5/4/2007 1:04:16 PM for strings:
;  'perfc000.dat'
; Strings excluded from search:
;  (None)
; Search in:
; Registry Keys  Registry Values  Registry Data 
; HKEY_LOCAL_MACHINE  HKEY_USERS 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="C:\\WINDOWS\\system32\\perfc000.dat"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\*]
"b"="C:\\windows\\system32\\perfc000.dat"
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\ComDlg32\OpenSaveMRU\dat]
"a"="C:\\windows\\system32\\perfc000.dat"
; End Of The Log..

shorty3913

9 Posts

May 4th, 2007 16:00

"amy" - 07-05-04 12:56:53    Service Pack 2 
ComboFix 07-04-25.4V - Running from: "C:\Documents and Settings\amy\Desktop\"

((((((((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))

C:\install.log

(((((((((((((((((((((((((((((((   Files Created from 2007-04-04 to 2007-05-04  ))))))))))))))))))))))))))))))))))

2007-05-04 10:26   d-------- C:\DOCUME~1\Kenny\APPLIC~1\HP
2007-05-04 10:25 786,432 --ah----- C:\DOCUME~1\Kenny\NTUSER.DAT
2007-05-04 10:25   d--h----- C:\DOCUME~1\Kenny\APPLIC~1\Gtek
2007-05-04 10:25   d-------- C:\DOCUME~1\Kenny\APPLIC~1\InstallShield
2007-05-04 10:05   d-------- C:\!KillBox
2007-05-03 14:52 0 --a------ C:\WINDOWS\system32\SBRC.dat
2007-05-03 14:52 0 --a------ C:\WINDOWS\system32\SBFC.dat
2007-05-03 14:47 15,544 --a------ C:\WINDOWS\system32\drivers\sbhr.sys
2007-05-03 14:46   d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sunbelt Software
2007-05-03 08:29   d-------- C:\WINDOWS\system32\vmm32
2007-05-02 23:20 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2007-05-02 23:09   d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee
2007-05-02 22:49   d-------- C:\WINDOWS\McAfee.com
2007-05-02 20:46   d-------- C:\DOCUME~1\amy\APPLIC~1\Uniblue
2007-05-02 17:17   d-------- C:\Program Files\Lavasoft
2007-05-01 23:46   d-------- C:\Program Files\a-squared HiJackFree
2007-05-01 23:31   d-------- C:\Program Files\InterMute
2007-05-01 22:58   d-------- C:\VundoFix Backups
2007-05-01 22:53 512,688 --a------ C:\WINDOWS\system32\XceedCry.dll
2007-05-01 22:53 423,784 --a------ C:\WINDOWS\system32\XceedBkp.dll
2007-05-01 22:48   d-------- C:\Program Files\Spynoose
2007-05-01 21:57   d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\ParetoLogic Anti-Spyware
2007-05-01 21:36   d-------- C:\Program Files\NoAdware5.0
2007-04-27 17:48 8,413 --a------ C:\WINDOWS\system32\drivers\mcstrm.sys
2007-04-27 17:47   d-------- C:\Program Files\Best Buy Rhapsody
2007-04-27 17:47   d-------- C:\DOCUME~1\amy\APPLIC~1\Real
2007-04-12 21:28   d-------- C:\Program Files\thriXXX
2007-04-08 19:38   d-------- C:\Program Files\QuickTime

((((((((((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-05-04 03:14 -------- d-------- C:\Program Files\napster
2007-05-04 03:14 -------- d-------- C:\Program Files\myspace
2007-05-03 10:43 88 -r-hs---- C:\WINDOWS\system32\bcbfe65b20.sys
2007-05-03 10:43 3140 --ahs---- C:\WINDOWS\system32\kgygaavl.sys
2007-05-03 09:46 -------- d-------- C:\DOCUME~1\amy\APPLIC~1\pc tools
2007-05-03 08:29 -------- d-------- C:\Program Files\dell
2007-05-03 08:17 -------- d--h----- C:\Program Files\installshield installation information
2007-05-03 08:17 -------- d-------- C:\Program Files\Common Files\panda software
2007-05-02 22:55 -------- d-------- C:\Program Files\comcast web controls
2007-05-02 20:50 -------- d-------- C:\Program Files\Common Files\wise installation wizard
2007-05-02 17:17 -------- d-------- C:\DOCUME~1\amy\APPLIC~1\lavasoft
2007-05-01 21:52 -------- d-------- C:\Program Files\microsoft works
2007-05-01 21:40 -------- d-------- C:\Program Files\google
2007-05-01 21:39 -------- d-------- C:\Program Files\digital line detect
2007-05-01 21:39 -------- d-------- C:\Program Files\dell support
2007-05-01 21:38 -------- d-------- C:\Program Files\Common Files\lightscribe
2007-05-01 21:37 -------- d-------- C:\Program Files\bonjour
2007-05-01 21:37 -------- d-------- C:\Program Files\bae
2007-05-01 07:19 -------- d-------- C:\Program Files\gemmaster
2007-04-25 17:06 466 --a------ C:\DOCUME~1\amy\APPLIC~1\wklnhst.dat
2007-04-08 19:36 -------- d-------- C:\Program Files\apple software update
2007-03-17 18:20 -------- d-------- C:\DOCUME~1\amy\APPLIC~1\image zone express
2007-03-17 18:20 -------- d-------- C:\DOCUME~1\amy\APPLIC~1\hp
2007-03-17 09:43 292864 --a------ C:\WINDOWS\system32\winsrv.dll
2007-03-15 23:23 -------- d-------- C:\Program Files\microsoft activesync
2007-03-15 23:21 -------- d-------- C:\Program Files\microsoft.net
2007-03-15 14:55 -------- d-------- C:\Program Files\maxis
2007-03-15 00:06 -------- d-------- C:\Program Files\egames
2007-03-15 00:01 -------- d-------- C:\Program Files\pc tools antivirus
2007-03-14 23:57 -------- d-------- C:\Program Files\panda software
2007-03-14 22:03 -------- d-------- C:\Program Files\Common Files\pc tools
2007-03-14 21:53 -------- d-------- C:\Program Files\kodak
2007-03-09 09:57 27376 --a------ C:\WINDOWS\system32\sbbd.exe
2007-03-08 20:34 -------- d-------- C:\DOCUME~1\amy\APPLIC~1\roxio
2007-03-08 11:36 577536 --a------ C:\WINDOWS\system32\user32.dll
2007-03-08 11:36 40960 --a------ C:\WINDOWS\system32\mf3216.dll
2007-03-08 11:36 281600 --a------ C:\WINDOWS\system32\gdi32.dll
2007-03-08 09:47 1843584 --a------ C:\WINDOWS\system32\win32k.sys
2007-03-08 08:46 -------- d-------- C:\DOCUME~1\amy\APPLIC~1\paltalk
2007-03-06 21:41 -------- d-------- C:\DOCUME~1\amy\APPLIC~1\help
2007-02-22 20:11 0 --a------ C:\WINDOWS\system32\cmmgr32.exe
2007-02-18 22:07 4096 --a------ C:\DOCUME~1\amy\APPLIC~1\dvd.bmk
2007-02-15 16:11 1021504 --a------ C:\WINDOWS\system32\vete.dll
2007-02-15 15:24 4212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2007-02-11 15:21 641021 --a------ C:\WINDOWS\unins000.exe
2007-02-11 15:21 1665 --a------ C:\WINDOWS\unins000.dat
2007-02-08 20:53 124022 --a------ C:\WINDOWS\hphins12.dat
2007-02-05 16:17 185344 --a------ C:\WINDOWS\system32\upnphost.dll

((((((((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))
 
 
*Note* empty entries & legit default entries are not shown
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} C:\Program Files\Yahoo!\Common\yiesrvc.dll
{5CA3D70E-1895-11CF-8E15-001234567890} C:\WINDOWS\System32\DLA\DLASHX_W.DLL
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
{AA58ED58-01DD-4d91-8333-CF10577473F7} c:\program files\google\googletoolbar2.dll
{CA6319C0-31B7-401E-A518-A07C3DB8F777} C:\Program Files\BAE\BAE.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"ehTray"="C:\\WINDOWS\\ehome\\ehtray.exe"
"IgfxTray"="C:\\WINDOWS\\system32\\igfxtray.exe"
"HotKeysCmds"="C:\\WINDOWS\\system32\\hkcmd.exe"
"Persistence"="C:\\WINDOWS\\system32\\igfxpers.exe"
"SigmatelSysTrayApp"="stsystra.exe"
"IAAnotif"="\"C:\\Program Files\\Intel\\Intel Matrix Storage Manager\\Iaanotif.exe\""
"DMXLauncher"="\"C:\\Program Files\\Dell\\Media Experience\\DMXLauncher.exe\""
"DLA"="C:\\WINDOWS\\System32\\DLA\\DLACTRLW.EXE"
"ISUSPM Startup"="\"C:\\PROGRA~1\\COMMON~1\\INSTAL~1\\UPDATE~1\\ISUSPM.exe\" -startup"
"ISUSScheduler"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\issch.exe\" -start"
"NapsterShell"="\"C:\\Program Files\\Napster\\napster.exe\" /systray"
"HP Software Update"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe"
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_11\\bin\\jusched.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
@=""
"SBCSTray"="C:\\Program Files\\Sunbelt Software\\CounterSpy\\SBCSTray.exe"
"Corel Photo Downloader"="C:\\Program Files\\Corel\\Corel Snapfire Plus\\Corel Photo Downloader.exe"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"DellSupport"="\"C:\\Program Files\\Dell Support\\DSAgnt.exe\" /startup"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.1128.5462\\GoogleToolbarNotifier.exe"
"WMPNSCFG"="C:\\Program Files\\Windows Media Player\\WMPNSCFG.exe"

bamajim

10.4K Posts

May 4th, 2007 22:00

shorty3913
 
The bottom portion on the Combofix log got cut off. Could you rerun Combofix and repost the log please.
 
bamajim   Graduate of MRU
CastleCops  Instructor

shorty3913

9 Posts

May 4th, 2007 22:00

Sorry about that...
 
 
 
"amy" - 07-05-04 19:08:43    Service Pack 2 
ComboFix 07-04-25.4V - Running from: "C:\Documents and Settings\amy\Desktop\"

(((((((((((((((((((((((((((((((   Files Created from 2007-04-04 to 2007-05-04  ))))))))))))))))))))))))))))))))))

2007-05-04 13:00 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-05-04 10:26   d-------- C:\DOCUME~1\Kenny\APPLIC~1\HP
2007-05-04 10:25 786,432 --ah----- C:\DOCUME~1\Kenny\NTUSER.DAT
2007-05-04 10:25   d--h----- C:\DOCUME~1\Kenny\APPLIC~1\Gtek
2007-05-04 10:25   d-------- C:\DOCUME~1\Kenny\APPLIC~1\InstallShield
2007-05-04 10:05   d-------- C:\!KillBox
2007-05-03 14:52 0 --a------ C:\WINDOWS\system32\SBRC.dat
2007-05-03 14:52 0 --a------ C:\WINDOWS\system32\SBFC.dat
2007-05-03 14:47 15,544 --a------ C:\WINDOWS\system32\drivers\sbhr.sys
2007-05-03 14:46   d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\Sunbelt Software
2007-05-03 08:29   d-------- C:\WINDOWS\system32\vmm32
2007-05-02 23:20 626,688 --a------ C:\WINDOWS\system32\msvcr80.dll
2007-05-02 23:09   d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\McAfee
2007-05-02 22:49   d-------- C:\WINDOWS\McAfee.com
2007-05-02 20:46   d-------- C:\DOCUME~1\amy\APPLIC~1\Uniblue
2007-05-02 17:17   d-------- C:\Program Files\Lavasoft
2007-05-01 23:46   d-------- C:\Program Files\a-squared HiJackFree
2007-05-01 23:31   d-------- C:\Program Files\InterMute
2007-05-01 22:58   d-------- C:\VundoFix Backups
2007-05-01 22:53 512,688 --a------ C:\WINDOWS\system32\XceedCry.dll
2007-05-01 22:53 423,784 --a------ C:\WINDOWS\system32\XceedBkp.dll
2007-05-01 22:48   d-------- C:\Program Files\Spynoose
2007-05-01 21:57   d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\ParetoLogic Anti-Spyware
2007-05-01 21:36   d-------- C:\Program Files\NoAdware5.0
2007-04-27 17:48 8,413 --a------ C:\WINDOWS\system32\drivers\mcstrm.sys
2007-04-27 17:47   d-------- C:\Program Files\Best Buy Rhapsody
2007-04-27 17:47   d-------- C:\DOCUME~1\amy\APPLIC~1\Real
2007-04-12 21:28   d-------- C:\Program Files\thriXXX
2007-04-08 19:38   d-------- C:\Program Files\QuickTime

((((((((((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-05-04 03:14 -------- d-------- C:\Program Files\napster
2007-05-04 03:14 -------- d-------- C:\Program Files\myspace
2007-05-03 10:43 88 -r-hs---- C:\WINDOWS\system32\bcbfe65b20.sys
2007-05-03 10:43 3140 --ahs---- C:\WINDOWS\system32\kgygaavl.sys
2007-05-03 09:46 -------- d-------- C:\DOCUME~1\amy\APPLIC~1\pc tools
2007-05-03 08:29 -------- d-------- C:\Program Files\dell
2007-05-03 08:17 -------- d--h----- C:\Program Files\installshield installation information
2007-05-03 08:17 -------- d-------- C:\Program Files\Common Files\panda software
2007-05-02 22:55 -------- d-------- C:\Program Files\comcast web controls
2007-05-02 20:50 -------- d-------- C:\Program Files\Common Files\wise installation wizard
2007-05-02 17:17 -------- d-------- C:\DOCUME~1\amy\APPLIC~1\lavasoft
2007-05-01 21:52 -------- d-------- C:\Program Files\microsoft works
2007-05-01 21:40 -------- d-------- C:\Program Files\google
2007-05-01 21:39 -------- d-------- C:\Program Files\digital line detect
2007-05-01 21:39 -------- d-------- C:\Program Files\dell support
2007-05-01 21:38 -------- d-------- C:\Program Files\Common Files\lightscribe
2007-05-01 21:37 -------- d-------- C:\Program Files\bonjour
2007-05-01 21:37 -------- d-------- C:\Program Files\bae
2007-05-01 07:19 -------- d-------- C:\Program Files\gemmaster
2007-04-25 17:06 466 --a------ C:\DOCUME~1\amy\APPLIC~1\wklnhst.dat
2007-04-08 19:36 -------- d-------- C:\Program Files\apple software update
2007-03-17 18:20 -------- d-------- C:\DOCUME~1\amy\APPLIC~1\image zone express
2007-03-17 18:20 -------- d-------- C:\DOCUME~1\amy\APPLIC~1\hp
2007-03-17 09:43 292864 --a------ C:\WINDOWS\system32\winsrv.dll
2007-03-15 23:23 -------- d-------- C:\Program Files\microsoft activesync
2007-03-15 23:21 -------- d-------- C:\Program Files\microsoft.net
2007-03-15 14:55 -------- d-------- C:\Program Files\maxis
2007-03-15 00:06 -------- d-------- C:\Program Files\egames
2007-03-15 00:01 -------- d-------- C:\Program Files\pc tools antivirus
2007-03-14 23:57 -------- d-------- C:\Program Files\panda software
2007-03-14 22:03 -------- d-------- C:\Program Files\Common Files\pc tools
2007-03-14 21:53 -------- d-------- C:\Program Files\kodak
2007-03-09 09:57 27376 --a------ C:\WINDOWS\system32\sbbd.exe
2007-03-08 20:34 -------- d-------- C:\DOCUME~1\amy\APPLIC~1\roxio
2007-03-08 11:36 577536 --a------ C:\WINDOWS\system32\user32.dll
2007-03-08 11:36 40960 --a------ C:\WINDOWS\system32\mf3216.dll
2007-03-08 11:36 281600 --a------ C:\WINDOWS\system32\gdi32.dll
2007-03-08 09:47 1843584 --a------ C:\WINDOWS\system32\win32k.sys
2007-03-08 08:46 -------- d-------- C:\DOCUME~1\amy\APPLIC~1\paltalk
2007-03-06 21:41 -------- d-------- C:\DOCUME~1\amy\APPLIC~1\help
2007-02-22 20:11 0 --a------ C:\WINDOWS\system32\cmmgr32.exe
2007-02-18 22:07 4096 --a------ C:\DOCUME~1\amy\APPLIC~1\dvd.bmk
2007-02-15 16:11 1021504 --a------ C:\WINDOWS\system32\vete.dll
2007-02-15 15:24 4212 ---h----- C:\WINDOWS\system32\zllictbl.dat
2007-02-11 15:21 641021 --a------ C:\WINDOWS\unins000.exe
2007-02-11 15:21 1665 --a------ C:\WINDOWS\unins000.dat
2007-02-08 20:53 124022 --a------ C:\WINDOWS\hphins12.dat
2007-02-05 16:17 185344 --a------ C:\WINDOWS\system32\upnphost.dll

((((((((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))
 
 
*Note* empty entries & legit default entries are not shown
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} C:\Program Files\Yahoo!\Common\yiesrvc.dll
{5CA3D70E-1895-11CF-8E15-001234567890} C:\WINDOWS\System32\DLA\DLASHX_W.DLL
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} C:\Program Files\Java\jre1.5.0_11\bin\ssv.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
{AA58ED58-01DD-4d91-8333-CF10577473F7} c:\program files\google\googletoolbar2.dll
{CA6319C0-31B7-401E-A518-A07C3DB8F777} C:\Program Files\BAE\BAE.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"ehTray"="C:\\WINDOWS\\ehome\\ehtray.exe"
"IgfxTray"="C:\\WINDOWS\\system32\\igfxtray.exe"
"HotKeysCmds"="C:\\WINDOWS\\system32\\hkcmd.exe"
"Persistence"="C:\\WINDOWS\\system32\\igfxpers.exe"
"SigmatelSysTrayApp"="stsystra.exe"
"IAAnotif"="\"C:\\Program Files\\Intel\\Intel Matrix Storage Manager\\Iaanotif.exe\""
"DMXLauncher"="\"C:\\Program Files\\Dell\\Media Experience\\DMXLauncher.exe\""
"DLA"="C:\\WINDOWS\\System32\\DLA\\DLACTRLW.EXE"
"ISUSPM Startup"="\"C:\\PROGRA~1\\COMMON~1\\INSTAL~1\\UPDATE~1\\ISUSPM.exe\" -startup"
"ISUSScheduler"="\"C:\\Program Files\\Common Files\\InstallShield\\UpdateService\\issch.exe\" -start"
"NapsterShell"="\"C:\\Program Files\\Napster\\napster.exe\" /systray"
"HP Software Update"="C:\\Program Files\\HP\\HP Software Update\\HPWuSchd2.exe"
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_11\\bin\\jusched.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
@=""
"SBCSTray"="C:\\Program Files\\Sunbelt Software\\CounterSpy\\SBCSTray.exe"
"Corel Photo Downloader"="C:\\Program Files\\Corel\\Corel Snapfire Plus\\Corel Photo Downloader.exe"
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"DellSupport"="\"C:\\Program Files\\Dell Support\\DSAgnt.exe\" /startup"
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"swg"="C:\\Program Files\\Google\\GoogleToolbarNotifier\\1.2.1128.5462\\GoogleToolbarNotifier.exe"
"WMPNSCFG"="C:\\Program Files\\Windows Media Player\\WMPNSCFG.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,\
  63,65,73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,5c,52,6f,79,61,6c,65,2e,\
  6d,73,73,74,79,6c,65,73,00
"InstallTheme"=hex(2):43,3a,5c,57,49,4e,44,4f,57,53,5c,52,65,73,6f,75,72,63,65,\
  73,5c,54,68,65,6d,65,73,5c,52,6f,79,61,6c,65,2e,74,68,65,6d,65,00
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoCDBurning"=dword:00000000
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"AOL Instant Messenger"="{55F5986E-2D4A-7058-C335-9102B1289CE9}"
"12133444-BF36-4d4e-B7FB-A3424C645DE4"="{8B99E401-03BF-BC94-F6CA-E7D83FF55910}"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"appinit_dlls"="C:\WINDOWS\system32\perfc000.dat"
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa
   Authentication Packages REG_MULTI_SZ    msv1_0\0\0
   Security Packages REG_MULTI_SZ    kerberos\0msv1_0\0schannel\0wdigest\0\0
   Notification Packages REG_MULTI_SZ    scecli\0\0
HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\SBCSSvc
 
[HKEY_LOCAL_MACHINE\software\Microsoft\Windows NT\CurrentVersion\Svchost]
HTTPFilter REG_MULTI_SZ    HTTPFilter\0\0
LocalService REG_MULTI_SZ    Alerter\0WebClient\0LmHosts\0RemoteRegistry\0upnphost\0SSDPSRV\0\0
NetworkService REG_MULTI_SZ    DnsCache\0\0
DcomLaunch REG_MULTI_SZ    DcomLaunch\0TermService\0\0
rpcss REG_MULTI_SZ    RpcSs\0\0
imgsvc REG_MULTI_SZ    StiSvc\0\0
termsvcs REG_MULTI_SZ    TermService\0\0
QWAVE REG_MULTI_SZ    QWAVE\0\0
WudfServiceGroup REG_MULTI_SZ    WUDFSvc\0\0

[HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{361ac05d-0e0d-11da-9aa9-806d6172696f}]
Shell\AutoRun\command E:\setup.exe

Contents of the 'Scheduled Tasks' folder
C:\WINDOWS\tasks\AppleSoftwareUpdate.job
C:\WINDOWS\tasks\Pareto UNS.job
********************************************************************
catchme 0.3.660 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-05-04 19:10:42
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden services ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden processes: 0
hidden services: 0
hidden files: 0

********************************************************************
Completion time: 07-05-04 19:10:48
C:\ComboFix-quarantined-files.txt ... 07-05-04 19:10
C:\ComboFix2.txt ... 07-05-04 13:00

bamajim

10.4K Posts

May 5th, 2007 00:00


shorty3913

1. Please download The Avenger by Swandog46 to your Desktop.
  • Click on Avenger.zip to open the file
  • Extract avenger.exe to your desktop


2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing ( Ctrl+C) including the File to delete:

File to delete:
C:\windows\system32\perfc000.dat

Note: the above code was created specifically for this user.  If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Now, start The Avenger program by clicking on its icon on your desktop.
  • Under "Script file to execute" choose "Input Script Manually".
  • Now click on the Magnifying Glass icon which will open a new window titled "View/edit script"
  • Paste the text copied to clipboard into this window by pressing (Ctrl+V).
  • Click Done
  • Now click on the Green Light to begin execution of the script
  • Answer "Yes" twice when prompted.

4. The Avenger will automatically do the following:
  • It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
  • On reboot, it will briefly open a black command window on your desktop, this is normal.
  • After the restart, it creates a log file that should open with the results of Avenger’s actions.  This log file will be located at  C:\avenger.txt
  • The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
5. Please copy/paste the content of c:\avenger.txt into your reply along with a fresh HJT log   by using Add/Reply
 
bamajim   Graduate of MRU
CastleCops  Instructor


shorty3913

9 Posts

May 5th, 2007 19:00

I get to the "confirm execution" and press yes..it says the selected file does not appear to be a valid script,press ok to to log error and continue or cancel to abort, error code:0

bamajim

10.4K Posts

May 6th, 2007 23:00


shorty3913

It could be because the input string is missing a "S"

Please copy and paste the string below and rerun it per previuos instructions

Files to delete:
C:\windows\system32\perfc000.dat

Then reply with the results

bamajim   Graduate of MRU
CastleCops  Instructor

bamajim

10.4K Posts

May 7th, 2007 00:00

Let me check something and I will get back to you :smileyhappy:
 
bamajim   Graduate of MRU
CastleCops Instructor

shorty3913

9 Posts

May 7th, 2007 00:00

Eh..I got the same thing as before.

bamajim

10.4K Posts

May 7th, 2007 19:00

shorty3913

Odd. Let's try a little trick here.

1. Rt Click a blank space on your Desktop->>Select New->>Folder

Name the folder Junk

2. Then using wondows explorer
Locate the file
  • C:\windows\system32\perfc000.dat

When you open the System32 folder to find the file, reduce the window size, or move it over to where you can still see the Junk folder you created on your Desktop.
Left click and hold the C:\windows\system32\perfc000.dat file and drag it to the Junk folder and drop it (let go of the mouse button).

Then reply with the results, whether you were able to move it.
 
bamajim   Graduate of MRU
CastleCops  Instructor

shorty3913

9 Posts

May 8th, 2007 01:00

I actually ended up having to just clear everything and start over. It got worse today and I couldn't connect to the internet at all. Thanks for all your help though!

Was this post helpful?

View All

0 events found

No Events found!

Top