Trojan-spy.wm32@mx

Question

Dear sir,

Recently I started getting pop-ups like System Alert and believe that a backdoor Trojan virus has entered my PC,P-3 having Windows-XP.At some other forum I am a member and so I had posted the problem form where I got a link of your forum where I have become member .As per the link and other msgs I downloaded the AVG Anti-Spy Ware Prog as well as HijackThis.exe Prog.I have run both of them scanned ,got the Log and saved in my PC.As per earlier msg I also could not find the

Smitfraudfix folder to proceed further.The log is as under.Please advise for the next steps.

Thanks.

Jitu Shah

Logfile of HijackThis v1.99.1
Scan saved at 2:59:18 PM, on 4/20/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Microsoft Office\Office10\EXCEL.EXE
C:\Program Files\Hijackthis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: (no name) - {A6ACAE64-F798-4930-AD86-BD3FB32038DB} - C:\Program Files\Video ActiveX Object\isadd.dll (file missing)
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Protection Bar - {84938242-5C5B-4A55-B6B9-A1507543B418} - C:\Program Files\Video ActiveX Object\iesplugin.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{3E79EBA0-F600-40CB-9F96-AFC4F297DF18}: NameServer = 61.1.96.69,61.1.96.71
O17 - HKLM\System\CS1\Services\Tcpip\..\{3E79EBA0-F600-40CB-9F96-AFC4F297DF18}: NameServer = 61.1.96.69,61.1.96.71
O17 - HKLM\System\CS2\Services\Tcpip\..\{3E79EBA0-F600-40CB-9F96-AFC4F297DF18}: NameServer = 61.1.96.69,61.1.96.71
O17 - HKLM\System\CS3\Services\Tcpip\..\{3E79EBA0-F600-40CB-9F96-AFC4F297DF18}: NameServer = 61.1.96.69,61.1.96.71
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

zbestwun2001 · Answer

Please download SmitfraudFix (by S!Ri) to your Desktop. Double-click smitfraudfix.exe Select option #1 - Search by typing 1 and press ' Enter'; a text file will appear, which lists infected files (if present). Please copy/paste the content of that report into your next reply. IMPORTANT: Do NOT run any other options until you are asked to do so! Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a 'RiskTool'; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between 'good' and 'malicious' use of such programs, therefore they may alert the user. http://www.beyondlogic.org/consulting/proc...processutil.htm ******************************************* zb1 Message Edited by zbestwun2001 on 04-20-2007 07:17 PM

Jitu Shah · Answer

Dear Sir,

Thanks for the response and the Tool.Please find here with the report as under.

SmitFraudFix v2.171

Scan done at 16:35:30.82, Sat 04/21/2007
Run from C:\Documents and Settings\Admin\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is FAT32
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

C:\WINDOWS\system32\ygjun.dll FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Admin

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Admin\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

C:\DOCUME~1\ALLUSE~1\STARTM~1\Online Security Guide.url FOUND !
C:\DOCUME~1\ALLUSE~1\STARTM~1\Security Troubleshooting.url FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\ADMIN\FAVORI~1

»»»»»»»»»»»»»»»»»»»»»»»» Desktop

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

C:\Program Files\Video ActiveX Object\ FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{abef791f-947e-4cdf-83c3-e72a240afb67}"="frisbee"

[HKEY_CLASSES_ROOT\CLSID\{abef791f-947e-4cdf-83c3-e72a240afb67}\InProcServer32]
@="C:\WINDOWS\system32\ygjun.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{abef791f-947e-4cdf-83c3-e72a240afb67}\InProcServer32]
@="C:\WINDOWS\system32\ygjun.dll"

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=""

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» pe386-msguard-lzx32-huy32

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: D-Link DFE-538TX 10/100 Adapter - Packet Scheduler Miniport
DNS Server Search Order: 61.1.96.69
DNS Server Search Order: 61.1.96.71

HKLM\SYSTEM\CCS\Services\Tcpip\..\{3E79EBA0-F600-40CB-9F96-AFC4F297DF18}: NameServer=61.1.96.69,61.1.96.71
HKLM\SYSTEM\CS1\Services\Tcpip\..\{3E79EBA0-F600-40CB-9F96-AFC4F297DF18}: NameServer=61.1.96.69,61.1.96.71
HKLM\SYSTEM\CS2\Services\Tcpip\..\{3E79EBA0-F600-40CB-9F96-AFC4F297DF18}: NameServer=61.1.96.69,61.1.96.71
HKLM\SYSTEM\CS3\Services\Tcpip\..\{3E79EBA0-F600-40CB-9F96-AFC4F297DF18}: NameServer=61.1.96.69,61.1.96.71

»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection

»»»»»»»»»»»»»»»»»»»»»»»» End

Thanks again.

Jitu Shah

zbestwun2001 · Answer

Please print out these instructions, or copy them to a Notepad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.

Please reboot your computer in Safe Mode by doing the following :

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.

Once in Safe Mode, double-click on SmitfraudFix.exe again.
Select option #2 - Clean by typing 2 and press " Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".

The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart anyway into normal Windows.
A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report along with all others into your next reply along with a new HijackThis log.
The report can also be found at the root of the system drive, usually at C:\rapport.txt

Warning : Running option #2 on a non-infected computer will remove your Desktop background.

____________________________________________________________

Clean out your Temporary Internet files. Proceed like this:

Quit Internet Explorer and quit any instances of Windows Explorer.
Click Start, click Control Panel, and then double-click Internet Options.
On the General tab, click Delete Files under Temporary Internet Files.
In the Delete Files dialog box, tick the Delete all offline content check box , and then click OK.
On the General tab, click Delete Cookies under Temporary Internet Files, and then click OK.
Click on the Programs tab then click the Reset Web Settings button. Click Apply then OK.
Click OK.

Next Click Start, click Control Panel and then double-click Display.
Click on the Desktop tab, then click the Customize Desktop button. Click on the Web tab. Under Web Pages you should see a checked entry called Security info or something similar. If it is there, select that entry and click the Delete button. Click Ok then Apply and Ok.
Empty the Recycle Bin by right-clicking the Recycle Bin icon on your Desktop, and then clicking Empty Recycle Bin
______________________________

Close ALL open Windows / Programs / Folders.

While in Safe Mode, launch AVG Anti-Spyware by double-clicking the icon on your desktop.
Select the "Scanner" icon at the top and then the "Scan" tab then click on "Complete System Scan".
AVG AS will now begin the scanning process, be patient this may take a little time.
Once the scan is complete do the following:
If you have any infections you will prompted, then select "Apply all actions"
Next select the "Reports" icon at the top.
Select the "Save report as" button in the lower left hand of the screen and save it to a text file on your system (make sure to remember where you saved that file, this is important).
Close AVG AS and reboot your system back into Normal Mode.

In your next reply please include:

1. The report from SmitfraudFix found here: C:\rapport.txt
2. The report from AVG AS
3. A fresh HijackThis log

You may need several replies to post the requested logs; otherwise they might get cut off.

Jitu Shah · Answer

Dear Sir, Thanks for the further instructions.I could reboot the PC in Safe Mode and got the Desktop Icons but there is no control of the Mouse and so cant proceed further-I tried for 2-3 times but in vain.I tried even the key board keys tp select but may be dont know much about it.Probably the infection or the over=riding ageny does not allow to work further.Please advise . Thank you. Jitu Shah

zbestwun2001 · Answer

Let's just check to make sure the mouse is plug in securely. zb1

Jitu Shah · Answer

yes sir,very much plugged in and works well otherwise. Thanks. Jitu Shah

zbestwun2001 · Answer

If the mouse is not working in Safe Mode but will work in Normal mode try the fix in normal mode. Let me know if this works? zb1

Jitu Shah · Answer

Dear ZB1,

Thank you very much for all the trouble taken by you and guiding me to remove the back door Trojan-as I run the SmitfraudFix in Normal mode and finally the required job was done.Please find herewith the last Rapport as under.

Thanks again.

Jitu Shah

SmitFraudFix v2.171

Scan done at 22:44:35.97, Tue 04/24/2007
Run from C:\Documents and Settings\Admin\Desktop\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is FAT32
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{abef791f-947e-4cdf-83c3-e72a240afb67}"="frisbee"

[HKEY_CLASSES_ROOT\CLSID\{abef791f-947e-4cdf-83c3-e72a240afb67}\InProcServer32]
@="C:\WINDOWS\system32\ygjun.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{abef791f-947e-4cdf-83c3-e72a240afb67}\InProcServer32]
@="C:\WINDOWS\system32\ygjun.dll"

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

C:\WINDOWS\system32\ygjun.dll -> Hoax.Win32.Renos.gen.l
C:\WINDOWS\system32\ygjun.dll -> Deleted

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\DOCUME~1\ALLUSE~1\STARTM~1\Online Security Guide.url Deleted
C:\DOCUME~1\ALLUSE~1\STARTM~1\Security Troubleshooting.url Deleted
C:\Program Files\Video ActiveX Object\ Deleted

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: D-Link DFE-538TX 10/100 Adapter - Packet Scheduler Miniport
DNS Server Search Order: 61.1.96.69
DNS Server Search Order: 61.1.96.71

HKLM\SYSTEM\CCS\Services\Tcpip\..\{3E79EBA0-F600-40CB-9F96-AFC4F297DF18}: NameServer=61.1.96.69,61.1.96.71
HKLM\SYSTEM\CS1\Services\Tcpip\..\{3E79EBA0-F600-40CB-9F96-AFC4F297DF18}: NameServer=61.1.96.69,61.1.96.71
HKLM\SYSTEM\CS2\Services\Tcpip\..\{3E79EBA0-F600-40CB-9F96-AFC4F297DF18}: NameServer=61.1.96.69,61.1.96.71
HKLM\SYSTEM\CS3\Services\Tcpip\..\{3E79EBA0-F600-40CB-9F96-AFC4F297DF18}: NameServer=61.1.96.69,61.1.96.71

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» End

zbestwun2001 · Answer

Please post your AVG log and a new HJT log. zb1

zbestwun2001 · Answer

You got it right, now the HJT log. zb1

Jitu Shah · Answer

Dear zb1, Please inform whether AVG report means AVG anti virus or AVG Anti Spy Ware report?The AVG Anti Spy Ware report is as under.   AVG Anti-Spyware - Scan Report ---------------------------------------------------------  + Created at: 9:09:38 PM 4/25/2007  + Scan result:    C:\System Volume Information\_restore{5607BF44-EE8E-44A8-8E7B-BE7F9030FDB0}\RP94\A0051488.exe -> Adware.Agent : Cleaned with backup (quarantined). C:\System Volume Information\_restore{5607BF44-EE8E-44A8-8E7B-BE7F9030FDB0}\RP94\A0051489.dll -> Adware.Agent : Cleaned with backup (quarantined). F:\old-I\Hub_motor\Wheelchairs and Wheelchair Accessories_files\mm.js -> Adware.Chitika : Cleaned with backup (quarantined). F:\old-I\data\RA+\Rheumatoid_files\mm.js -> Adware.Chitika : Cleaned with backup (quarantined). F:\old-G\StoikVideoConverter20.zip -> Adware.NavExcel : Cleaned with backup (quarantined). C:\WINDOWS\mirar_distro_876260.exe -> Adware.SaveNow : Cleaned with backup (quarantined). C:\System Volume Information\_restore{5607BF44-EE8E-44A8-8E7B-BE7F9030FDB0}\RP91\A0050200.exe -> Adware.Systemdoctor : Cleaned with backup (quarantined). C:\System Volume Information\_restore{5607BF44-EE8E-44A8-8E7B-BE7F9030FDB0}\RP91\A0050202.exe -> Adware.Systemdoctor : Cleaned with backup (quarantined). C:\System Volume Information\_restore{5607BF44-EE8E-44A8-8E7B-BE7F9030FDB0}\RP91\A0050203.dll -> Adware.Systemdoctor : Cleaned with backup (quarantined). C:\System Volume Information\_restore{5607BF44-EE8E-44A8-8E7B-BE7F9030FDB0}\RP91\A0050204.exe -> Adware.Systemdoctor : Cleaned with backup (quarantined). C:\System Volume Information\_restore{5607BF44-EE8E-44A8-8E7B-BE7F9030FDB0}\RP91\A0050205.exe -> Adware.Systemdoctor : Cleaned with backup (quarantined). C:\System Volume Information\_restore{5607BF44-EE8E-44A8-8E7B-BE7F9030FDB0}\RP91\A0050207.exe -> Adware.SystemDoctor : Cleaned with backup (quarantined). C:\System Volume Information\_restore{5607BF44-EE8E-44A8-8E7B-BE7F9030FDB0}\RP92\A0050228.exe -> Adware.Systemdoctor : Cleaned with backup (quarantined). C:\System Volume Information\_restore{5607BF44-EE8E-44A8-8E7B-BE7F9030FDB0}\RP92\A0050230.exe -> Adware.Systemdoctor : Cleaned with backup (quarantined). C:\System Volume Information\_restore{5607BF44-EE8E-44A8-8E7B-BE7F9030FDB0}\RP92\A0050231.dll -> Adware.Systemdoctor : Cleaned with backup (quarantined). C:\System Volume Information\_restore{5607BF44-EE8E-44A8-8E7B-BE7F9030FDB0}\RP92\A0050232.exe -> Adware.Systemdoctor : Cleaned with backup (quarantined). C:\System Volume Information\_restore{5607BF44-EE8E-44A8-8E7B-BE7F9030FDB0}\RP92\A0050233.exe -> Adware.Systemdoctor : Cleaned with backup (quarantined). C:\System Volume Information\_restore{5607BF44-EE8E-44A8-8E7B-BE7F9030FDB0}\RP92\A0050235.exe -> Adware.SystemDoctor : Cleaned with backup (quarantined). C:\System Volume Information\_restore{5607BF44-EE8E-44A8-8E7B-BE7F9030FDB0}\RP93\A0050256.exe -> Adware.Systemdoctor : Cleaned with backup (quarantined). C:\System Volume Information\_restore{5607BF44-EE8E-44A8-8E7B-BE7F9030FDB0}\RP93\A0050258.exe -> Adware.Systemdoctor : Cleaned with backup (quarantined). C:\System Volume Information\_restore{5607BF44-EE8E-44A8-8E7B-BE7F9030FDB0}\RP93\A0050259.dll -> Adware.Systemdoctor : Cleaned with backup (quarantined). C:\System Volume Information\_restore{5607BF44-EE8E-44A8-8E7B-BE7F9030FDB0}\RP93\A0050260.exe -> Adware.Systemdoctor : Cleaned with backup (quarantined). C:\System Volume Information\_restore{5607BF44-EE8E-44A8-8E7B-BE7F9030FDB0}\RP93\A0050261.exe -> Adware.Systemdoctor : Cleaned with backup (quarantined). C:\System Volume Information\_restore{5607BF44-EE8E-44A8-8E7B-BE7F9030FDB0}\RP93\A0050263.exe -> Adware.SystemDoctor : Cleaned with backup (quarantined). C:\System Volume Information\_restore{5607BF44-EE8E-44A8-8E7B-BE7F9030FDB0}\RP93\A0050277.exe -> Adware.Systemdoctor : Cleaned with backup (quarantined). C:\System Volume Information\_restore{5607BF44-EE8E-44A8-8E7B-BE7F9030FDB0}\RP93\A0050278.dll -> Adware.Systemdoctor : Cleaned with backup (quarantined). C:\System Volume Information\_restore{5607BF44-EE8E-44A8-8E7B-BE7F9030FDB0}\RP93\A0050279.exe -> Adware.Systemdoctor : Cleaned with backup (quarantined). C:\System Volume Information\_restore{5607BF44-EE8E-44A8-8E7B-BE7F9030FDB0}\RP93\A0050280.exe -> Adware.Systemdoctor : Cleaned with backup (quarantined). C:\System Volume Information\_restore{5607BF44-EE8E-44A8-8E7B-BE7F9030FDB0}\RP93\A0050288.EXE -> Adware.Systemdoctor : Cleaned with backup (quarantined). C:\System Volume Information\_restore{5607BF44-EE8E-44A8-8E7B-BE7F9030FDB0}\RP93\A0050289.exe -> Adware.SystemDoctor : Cleaned with backup (quarantined). F:\old-I\Drivers&SetUps\WinDVDCreator2-dm.exe -> Adware.Trymedia : Cleaned with backup (quarantined). C:\System Volume Information\_restore{5607BF44-EE8E-44A8-8E7B-BE7F9030FDB0}\RP91\A0050201.exe -> Adware.WinFixer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{5607BF44-EE8E-44A8-8E7B-BE7F9030FDB0}\RP92\A0050229.exe -> Adware.WinFixer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{5607BF44-EE8E-44A8-8E7B-BE7F9030FDB0}\RP93\A0050257.exe -> Adware.WinFixer : Cleaned with backup (quarantined). C:\System Volume Information\_restore{5607BF44-EE8E-44A8-8E7B-BE7F9030FDB0}\RP93\A0050287.exe -> Adware.WinFixer : Cleaned with backup (quarantined). C:\WINDOWS\system32
wprzvau.dll -> Backdoor.AFCore.f : Cleaned with backup (quarantined). C:\flashupd.ocx -> Backdoor.AFCore.f : Cleaned with backup (quarantined). C:\shockwave11.ocx -> Backdoor.AFCore.f : Cleaned with backup (quarantined). F:\old-G\My Documents\Dictionary of Automotive Terms Abbreviations.htm -> Backdoor.Sitex : Cleaned with backup (quarantined). C:\System Volume Information\_restore{5607BF44-EE8E-44A8-8E7B-BE7F9030FDB0}\RP100\A0055857.exe -> Downloader.Zlob.auz : Cleaned with backup (quarantined). C:\System Volume Information\_restore{5607BF44-EE8E-44A8-8E7B-BE7F9030FDB0}\RP100\A0055858.exe -> Downloader.Zlob.auz : Cleaned with backup (quarantined). C:\System Volume Information\_restore{5607BF44-EE8E-44A8-8E7B-BE7F9030FDB0}\RP100\A0055860.exe -> Downloader.Zlob.auz : Cleaned with backup (quarantined). C:\System Volume Information\_restore{5607BF44-EE8E-44A8-8E7B-BE7F9030FDB0}\RP100\A0055859.dll -> Downloader.Zlob.ava : Cleaned with backup (quarantined). C:\Documents and Settings\Admin\Local Settings\Temp\$7F7B73C3.t$m -> Dropper.Delf.xo : Cleaned with backup (quarantined). F:\LimeWire\Oxygen.Phone.Manager.II.for.Nokia.And.Vertu.Phones.v2.12.1.5.WinAll.Regged.READ.NFO-ViH.zip/Oxygen.Phone.Manager.II.for.Nokia.And.Vertu.Phones.v2.12.1.5.WinAll.Regged.READ.NFO-ViH/opm2reg2121.exe -> Dropper.Delf.xo : Cleaned with backup (quarantined). C:\Recycled\Dc2.exe -> Not-A-Virus.Downloader.Win32.WinFixer.q : Cleaned with backup (quarantined). C:\Documents and Settings\Admin\Cookies\admin@247realmedia[1].txt -> TrackingCookie.247realmedia : Cleaned. :mozilla.21:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.22:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.28:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.2o7 : Cleaned. :mozilla.29:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@gfi.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@highbeam.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@msnportal.112.2o7[1].txt -> TrackingCookie.2o7 : Cleaned. :mozilla.136:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.Adbrite : Cleaned. :mozilla.137:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.Adbrite : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@adbrite[1].txt -> TrackingCookie.Adbrite : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@ad.adocean[1].txt -> TrackingCookie.Adocean : Cleaned. :mozilla.31:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.32:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.Advertising : Cleaned. :mozilla.33:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.Advertising : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@advertising[1].txt -> TrackingCookie.Advertising : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@adviva[1].txt -> TrackingCookie.Adviva : Cleaned. :mozilla.30:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.Atdmt : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@atdmt[1].txt -> TrackingCookie.Atdmt : Cleaned. :mozilla.125:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.Bfast : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@www.burstnet[2].txt -> TrackingCookie.Burstnet : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@casalemedia[2].txt -> TrackingCookie.Casalemedia : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@clickbank[1].txt -> TrackingCookie.Clickbank : Cleaned. :mozilla.24:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.Cnn : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@com[1].txt -> TrackingCookie.Com : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned. :mozilla.26:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.Doubleclick : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@e-2dj6wjl4wid5skp.stats.esomniture[2].txt -> TrackingCookie.Esomniture : Cleaned. :mozilla.97:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.Fastclick : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@media.fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@hit.gemius[2].txt -> TrackingCookie.Gemius : Cleaned. :mozilla.36:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.Goclick : Cleaned. :mozilla.37:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.Goclick : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@goclick[2].txt -> TrackingCookie.Goclick : Cleaned. :mozilla.107:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.108:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.76:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.77:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.Hitbox : Cleaned. :mozilla.78:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.Hitbox : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@ehg-aarp.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@ehg-aha.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@ehg-discoverynetwork.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@ehg-tigerdirect2.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@ehg-tsvgroup.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@ehg-watlow.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@ehg-zoomerang.hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@ehg.hitbox[1].txt -> TrackingCookie.Hitbox : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@hitbox[2].txt -> TrackingCookie.Hitbox : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@counter.hitslink[1].txt -> TrackingCookie.Hitslink : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@hotlog[1].txt -> TrackingCookie.Hotlog : Cleaned. :mozilla.23:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned. :mozilla.25:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.Imrworldwide : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@searchportal.information[2].txt -> TrackingCookie.Information : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@server.iad.liveperson[2].txt -> TrackingCookie.Liveperson : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@ie.search.msn[1].txt -> TrackingCookie.Msn : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@search.msn[1].txt -> TrackingCookie.Msn : Cleaned. :mozilla.98:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.Navrcholu : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@overture[1].txt -> TrackingCookie.Overture : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@perf.overture[1].txt -> TrackingCookie.Overture : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@ads.pointroll[2].txt -> TrackingCookie.Pointroll : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@real[2].txt -> TrackingCookie.Real : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@stats1.reliablestats[1].txt -> TrackingCookie.Reliablestats : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@revenue[2].txt -> TrackingCookie.Revenue : Cleaned. :mozilla.115:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.Revsci : Cleaned. :mozilla.116:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.Revsci : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@revsci[2].txt -> TrackingCookie.Revsci : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@edge.ru4[1].txt -> TrackingCookie.Ru4 : Cleaned. :mozilla.80:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.81:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.82:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.83:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.84:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. :mozilla.85:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.Serving-sys : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@specificclick[2].txt -> TrackingCookie.Specificclick : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@spylog[1].txt -> TrackingCookie.Spylog : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@statcounter[2].txt -> TrackingCookie.Statcounter : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@anad.tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned. :mozilla.99:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.Toplist : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@trafic[1].txt -> TrackingCookie.Trafic : Cleaned. :mozilla.70:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.Tribalfusion : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned. :mozilla.88:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.Webtrendslive : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@statse.webtrendslive[2].txt -> TrackingCookie.Webtrendslive : Cleaned. :mozilla.102:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.Yadro : Cleaned. :mozilla.103:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.Yadro : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@yadro[2].txt -> TrackingCookie.Yadro : Cleaned. :mozilla.96:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.Yieldmanager : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@ad.yieldmanager[1].txt -> TrackingCookie.Yieldmanager : Cleaned. :mozilla.71:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.Zedo : Cleaned. :mozilla.72:F:\old-G\Mozilla\Firefox\Profiles\default.zxe\cookies.txt -> TrackingCookie.Zedo : Cleaned. C:\Documents and Settings\Admin\Cookies\admin@zedo[2].txt -> TrackingCookie.Zedo : Cleaned. C:\System Volume Information\_restore{5607BF44-EE8E-44A8-8E7B-BE7F9030FDB0}\RP100\A0055855.dll -> Trojan.Renos.nav : Cleaned with backup (quarantined). F:\LimeWire\01 Track 1.wma -> Trojan.Wimad.a : Cleaned with backup (quarantined). F:\LimeWire\Steven Spielberg gets a hilarious prank phone call.wma -> Trojan.Wimad.a : Cleaned with backup (quarantined). ::Report end I shall HJT report later. Thanks. Jitu Shah

zbestwun2001 · Answer

Update Java Canned: Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system. It is possible that you may be running Java code in your applications that absolutely require a specific version of the JRE to run. Please follow these steps to remove older version Java components and update. Updating Java: Download the latest version of Java Runtime Environment (JRE) 6u1. Scroll down to where it says 'Java Runtime Environment (JRE) 6u1 allows end-users to run Java applications'. Click the 'Download' button to the right. Check the box that says: 'Accept License Agreement'. The page will refresh. Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop. Close any programs you may have running - especially your web browser. Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java. Check any item with Java Runtime Environment (JRE or J2SE) in the name. Click the Remove or Change/Remove button. Repeat as many times as necessary to remove each Java versions. Reboot your computer once all Java components are removed. Then from your desktop double-click on jre-6u1-windows-i586-p.exe to install the newest version. Official JAVA Installation Instructions if needed. Post a new HJT log now... zb1 Message Edited by zbestwun2001 on 04-25-2007 10:28 AM

Jitu Shah · Answer

Dear sir,

Please find the HJT lod as under.Pl.informhow to select/check and fix the scanned report.I might re-run the same,check a sper your advice and fix.

Thanks for all the help.

Jitu Shah

Logfile of HijackThis v1.99.1
Scan saved at 10:23:18 PM, on 4/25/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\Program Files\Microsoft Office\Office10\EXCEL.EXE
C:\Program Files\Hijackthis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_10\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{3E79EBA0-F600-40CB-9F96-AFC4F297DF18}: NameServer = 61.1.96.69,61.1.96.71
O17 - HKLM\System\CS1\Services\Tcpip\..\{3E79EBA0-F600-40CB-9F96-AFC4F297DF18}: NameServer = 61.1.96.69,61.1.96.71
O17 - HKLM\System\CS2\Services\Tcpip\..\{3E79EBA0-F600-40CB-9F96-AFC4F297DF18}: NameServer = 61.1.96.69,61.1.96.71
O17 - HKLM\System\CS3\Services\Tcpip\..\{3E79EBA0-F600-40CB-9F96-AFC4F297DF18}: NameServer = 61.1.96.69,61.1.96.71
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

Jitu Shah · Answer

Dear zb1,

Thank you for the reply.The HJT log is as under.Please advise accordingly.

Thanks.

Jitu Shah

Logfile of HijackThis v1.99.1
Scan saved at 11:51:59 AM, on 4/26/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\VS7Debug\mdm.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Hijackthis\HijackThis.exe

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{3E79EBA0-F600-40CB-9F96-AFC4F297DF18}: NameServer = 61.1.96.69,61.1.96.71
O17 - HKLM\System\CS1\Services\Tcpip\..\{3E79EBA0-F600-40CB-9F96-AFC4F297DF18}: NameServer = 61.1.96.69,61.1.96.71
O17 - HKLM\System\CS2\Services\Tcpip\..\{3E79EBA0-F600-40CB-9F96-AFC4F297DF18}: NameServer = 61.1.96.69,61.1.96.71
O17 - HKLM\System\CS3\Services\Tcpip\..\{3E79EBA0-F600-40CB-9F96-AFC4F297DF18}: NameServer = 61.1.96.69,61.1.96.71
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe

zbestwun2001 · Answer

After something like this it is a good idea to purge the Restore Points and start fresh.
If everything is running well....
To flush the XP System Restore Points:
(Using XP, you must be logged in as Administrator to do this.)
Go to Start>Run and type msconfig Press enter.
When msconfig opens, click the Launch System Restore Button.
On the next page, click the System Restore Settings Link on the left.
Check the box labeled Turn Off System Restore.

Reboot. Go back in and turn System Restore ON. A new Restore Point will be created.

Here is my standard list of simple steps that you can take to reduce the chance of infection in the future.

You may have already taken some of these steps:
1. Visit Windows Update:
Make sure that you have all the Critical Updates recommended for your operating system and IE. The first defense against infection is a properly patched OS.
Windows Update: http://v4.windowsupdate.microsoft.com/en/default.asp

2. Adjust your security settings for ActiveX:
Go to Internet Options/Security/Internet, press 'default level', then OK.
Now press "Custom Level."
In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to 'prompt', and 'Initialize and Script ActiveX controls not marked as safe" to 'disable'.

3. Download and install the following free programs:
a. SpywareBlaster:
http://www.javacoolsoftware.com/spywareblaster.html
Tutorial here: http://www.bleepingcomputer.com/forums/tutorial49.html
b. SpywareGuard:
http://www.javacoolsoftware.com/spywareguard.html
Tutorial here: http://www.bleepingcomputer.com/tutorials/tutorial50.html
Periodically check for updates in both programs.

4. Please use a firewall and realtime anti-virus. Keep the anti-virus software and firewall software up to date.
Note: Zone Alarm Firewall (Zone Labs) http://www.zonelabs.com/store/content/company/products/trial_zaFamily/trial_zaFamily.jsp?lid=home_freedownloads
Sunbelt Kerio has a free version: http://www.kerio.com/kpf_download.html

5. You might consider installing Mozilla / Firefox.
http://www.mozilla.org/

6. Install spyware detection and removal programs:
You may also want to consider installing either or both of AdAware (free version) and Spybot S&D (freeware). Use these programs to regularly scan your system for and remove many forms of spyware/malware.

a. Ad-aware: http://www.lavasoft.de/software/adaware/

b. SpyBot S&D: http://safer-networking.org/en/news/2005-05-31.html

I would check for updates in SpyBot once a week or so.
Check for updates in Ad-aware frequently.

If you have recently installed AVG Anti-Spyware, it is a free trial product for 30 days. After that you can purchase it for full features OR you can also keep the free version to use as an on-demand scanner (recommended).
You will still be able to manually update it using the *update* button

7. Before using or purchasing any Spyware/Malware protection/removal program, always check the Rogue/Suspect Spyware List.
Here is the link:
http://www.spywarewarrior.com/rogue_anti-spyware.htm

8. If you have not already done so, you might want to install CCleaner and run it in each user's profile: http://www.ccleaner.com/
** UNcheck the option to install the Yahoo toolbar that is checked by default for the Standard version, or download the toolbar-free versions (Slim or Basic) when given the option for those.

9. If you use Adobe Reader it may need to be updated to be sure that you have a more secure version. If you are using a version prior to v. 6.05, you should update to 6.05, preferably version 8. It would be best to remove prior versions before updating to a new version.
Info here: http://www.adobe.com/support/security/bulletins/apsb06-20.html
If you need additional assistance, the Adobe forums are here: http://www.adobe.com/support/forums/main.html

10. Make sure you are using the most updated version of Java.
The current version is Java Runtime Environment (JRE) 6u1
You can go here to download the latest version of Java Runtime Environment (JRE) 6.
Scroll down to where it says " Java Runtime Environment (JRE) 6u1 allows end-users to run Java applications".

Click the link to download the Windows (Offline Installation) package: Save it, do not run it. When the download is complete, close the browser.

Remove all prior versions using Add/Remove Programs, and delete the Java folder in Program Files.
Reboot your computer once all Java components are removed.
Then from your desktop double-click on jre-6u1-windows-i586-p.exe to install the newest version.
Official JAVA Installation Instructions if needed.
Reboot.

11. Practice Safe Surfing with with SiteAdvisor by McAfee. SiteAdvisor is a browser plugin that assigns a safety rating to domains listed in your search engine.
The following color codes are used by SiteAdvisor to indicate the safety of each site.

Red for Warning
Yellow for Use Caution
Green for Safe
Grey for Unknown

12. Here are some helpful articles:
"So how did I get infected in the first place?"
by TonyKlein
http://computercops.biz/postlite7736-.html

"I'm not pulling your leg, honest"
by Sandi Hardmeier
http://www.microsoft.com/windows/IE/community/columns/pulling.mspx

13. This is an excellent resource for users of all levels. General computer maintenance as well as internet security is covered.
Rootkits for Dummies
(Paperback)
by Larry Stevenson (Author), Nancy Altholz (Author)
Let us know if we have not resolved your problem. Otherwise, you are good to go.
Happy and Safe Surfing!

zb1

Virus & Spyware

Trojan-spy.wm32@mx

Was this post helpful?