UNSOLVED
Amaena causing problems - please help
There are popups coming in asking me to install anti virus software. On the top I saw Amaena and looked for it on the net. FOund a ton of similar complaints and understood that you guys can help me. Need some help PLEASE, thanks.
here is my HJT file
Logfile of HijackThis v1.99.1
Scan saved at 12:36:55 PM, on 8/10/2007
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)
Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\basfipm.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\Program Files\TightVNC\WinVNC.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\Explorer.EXE
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Microsoft Office97\Office\FINDFAST.EXE
C:\Program Files\Microsoft Office97\Office\OSA.EXE
C:\Program Files\WinZip\WZQKPICK.EXE
\Feb-5fwds61\c$\PROGRA~1\Palm\HOTSYNC.EXE
C:\Program Files\SAP\FrontEnd\SAPgui\saplogon.exe
C:\Program Files\INTERN~1\iexplore.exe
C:\Program Files\Microsoft Office\Office\WINWORD.EXE
C:\Program Files\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearch.myway.com/jsp/dellsidebar.jsp?p=DE
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
O1 - Hosts: 160.3.15.84 MAILNS01
O1 - Hosts: 160.3.15.84 MAILNS01.UGC
O1 - Hosts: 160.3.15.84 MAILNS01.NET.UGC
O1 - Hosts: 160.3.15.84 MAILNS01.HOME.NET.UGC
O1 - Hosts: 160.3.15.85 MAILNS02
O1 - Hosts: 160.3.15.85 MAILNS02.UGC
O1 - Hosts: 160.3.15.85 MAILNS02.NET.UGC
O1 - Hosts: 160.3.15.85 MAILNS02.HOME.NET.UGC
O1 - Hosts: 160.3.15.77 APPNS01
O1 - Hosts: 160.3.15.77 APPNS01.UGC
O1 - Hosts: 160.3.15.77 APPNS01.NET.UGC
O1 - Hosts: 160.3.15.77 APPNS01.HOME.NET.UGC
O1 - Hosts: 160.3.15.78 APPNS02
O1 - Hosts: 160.3.15.78 APPNS02.UGC
O1 - Hosts: 160.3.15.78 APPNS02.NET.UGC
O1 - Hosts: 160.3.15.78 APPNS02.HOME.NET.UGC
O1 - Hosts: 130.10.5.113 ULSDBCI1
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINNT\system32\dla\tfswshx.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O2 - BHO: (no name) - {bb9bfd03-3999-4cef-bf84-c49e059552c4} - C:\WINNT\system32\C_2SSO.dll
O2 - BHO: (no name) - {f2b6b1ad-967f-4fee-957b-3f31e89b9003} - C:\WINNT\system32\C_2SSO.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\system32\hkcmd.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINNT\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\TightVNC\WinVNC.exe" -servicehelper
O4 - HKLM\..\Run: [SDR6_Check] "C:\Program Files\Common Files\DriveCleaner Free\udcsdr.exe"
O4 - HKLM\..\Run: [PAS_Check] "C:\Program Files\Common Files\DriveCleaner Free\udcpas.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: HotSync Manager.lnk = Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office97\Office\FINDFAST.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office97\Office\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://www.drivecleaner.com/.freeware/installdrivecleanerstart.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1186165816592
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = feblo.hlgllc.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = feblo.hlgllc.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = feblo.hlgllc.com
O20 - AppInit_DLLs: c:\winnt\system32\awvtsst.dll
O20 - Winlogon Notify: C_2SSO - C:\WINNT\SYSTEM32\C_2SSO.dll
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINNT\system32\NavLogon.dll
O23 - Service: Broadcom ASF IP monitoring service v6.0.4 (BAsfIpM) - Broadcom Corp. - C:\WINNT\system32\basfipm.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: OracleOraHome81ClientCache - Unknown owner - C:\oracle\ora81\BIN\ONRSD.EXE
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Program Files\TightVNC\WinVNC.exe" -service (file missing)
407
0
Posted August 13th, 2007 14:00
Thank you so much bamajim. Here is my combofix file.ComboFix 07-08-13.3 - "solai" 2007-08-13 11:40:08.2 - NTFSx86
Microsoft Windows 2000 Professional 5.0.2195.4.1252.1.1033.18.263 [GMT -4:00]
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\DOCUME~1\SOLAI~1.FEB\APPLIC~1\tmp11.tmp.exe
C:\DOCUME~1\SOLAI~1.FEB\APPLIC~1\tmp127A.tmp.exe
C:\DOCUME~1\SOLAI~1.FEB\APPLIC~1\tmp127C.tmp.exe
C:\DOCUME~1\SOLAI~1.FEB\APPLIC~1\tmp13.tmp.exe
C:\WINNT\system32\dnac2bf4d4.dat
((((((((((((((((((((((((( Files Created from 2007-07-13 to 2007-08-13 )))))))))))))))))))))))))))))))
2007-08-13 11:40 16,384 --a----t- C:\WINNT\SYSTEM32\Perflib_Perfdata_37c.dat
2007-08-13 11:37 16,384 --a----t- C:\WINNT\SYSTEM32\Perflib_Perfdata_5c0.dat
2007-08-13 11:37 16,384 --a----t- C:\WINNT\SYSTEM32\Perflib_Perfdata_5b8.dat
2007-08-13 11:37 16,384 --a----t- C:\WINNT\SYSTEM32\Perflib_Perfdata_53c.dat
2007-08-13 10:51 51,200 --a------ C:\WINNT\nircmd.exe
2007-08-07 02:08d-------- C:\WINNT\SYSTEM32\Windows Media
2007-08-07 02:07d--h-c--- C:\WINNT\$NtUpdateRollupPackUninstall$
2007-08-07 02:07d-------- C:\WINNT\msiinst.tmp
2007-08-07 02:05d--h-c--- C:\WINNT\$SQLUninstallMDAC28-KB927779-x86-ENU$
2007-08-07 02:02d-------- C:\Program Files\MSXML 4.0
2007-08-06 08:13 44,032 --------- C:\WINNT\SYSTEM32\DLLCACHE\msxml3r.dll
2007-08-06 08:09 86,288 --------- C:\WINNT\SYSTEM32\DLLCACHE\srvsvc.dll
2007-08-06 08:05 2,174,976 --------- C:\WINNT\SYSTEM32\DLLCACHE\wmvcore.dll
2007-08-06 08:03 840,976 --------- C:\WINNT\SYSTEM32\DLLCACHE\mmcndmgr.dll
2007-08-03 15:10d-------- C:\WINNT\SYSTEM32\BITS
2007-08-03 14:30 549,720 --a------ C:\WINNT\SYSTEM32\wuapi.dll
2007-08-03 14:30 43,352 --a------ C:\WINNT\SYSTEM32\wups2.dll
2007-08-03 14:30 33,624 --a------ C:\WINNT\SYSTEM32\wups.dll
2007-08-03 14:30 325,976 --a------ C:\WINNT\SYSTEM32\wucltui.dll
2007-08-03 14:30d-------- C:\WINNT\SoftwareDistribution
2007-08-03 09:38 2,379,776 --ah----- C:\DOCUME~1\SOLAI~1.FEB\NTUSER.DAT
2007-08-03 09:38d-a------ C:\DOCUME~1\SOLAI~1.FEB\SapWorkDir
2007-08-03 09:38d-a------ C:\DOCUME~1\SOLAI~1.FEB\pnlinks
2007-08-03 09:38d-a------ C:\DOCUME~1\SOLAI~1.FEB\APPLIC~1\Sonic
2007-08-03 09:38d-a------ C:\DOCUME~1\SOLAI~1.FEB\APPLIC~1\Real
2007-08-03 09:38d-a------ C:\DOCUME~1\SOLAI~1.FEB\APPLIC~1\Murasu
2007-08-03 09:38d-a------ C:\DOCUME~1\SOLAI~1.FEB\APPLIC~1\Microsoft Web Folders
2007-08-03 09:38d-a------ C:\DOCUME~1\SOLAI~1.FEB\APPLIC~1\Leadertech
2007-08-03 09:38d-a------ C:\DOCUME~1\SOLAI~1.FEB\APPLIC~1\Lavasoft
2007-08-03 09:38d-a------ C:\DOCUME~1\SOLAI~1.FEB\APPLIC~1\ICAClient
2007-08-03 09:38d-a------ C:\DOCUME~1\SOLAI~1.FEB\APPLIC~1\Help
2007-08-03 09:38d-a------ C:\DOCUME~1\SOLAI~1.FEB\APPLIC~1\Google
2007-08-03 09:38d-a------ C:\DOCUME~1\SOLAI~1.FEB\APPLIC~1\Arcsoft
2007-08-03 09:38d-a------ C:\DOCUME~1\SOLAI~1.FEB\APPLIC~1\AdobeUM
2007-08-03 09:38d---s---- C:\DOCUME~1\SOLAI~1.FEB\UserData
2007-08-03 09:38d-------- C:\DOCUME~1\SOLAI~1.FEB\APPLIC~1\AdwareAlert
2007-08-02 12:26d-------- C:\DOCUME~1\solai\APPLIC~1\AdwareAlert
2007-08-02 12:07 58,798 --a------ C:\DOCUME~1\solai\APPLIC~1\tmp7B.tmp.exe
2007-08-01 11:46 58,798 --a------ C:\DOCUME~1\solai\APPLIC~1\tmp26.tmp.exe
2007-07-31 11:46 58,798 --a------ C:\DOCUME~1\solai\APPLIC~1\tmp19.tmp.exe
2007-07-31 10:27 499,712 --a------ C:\WINNT\SYSTEM32\msvcp71.dll
2007-07-31 10:27 1,060,864 --a------ C:\WINNT\SYSTEM32\mfc71.dll
2007-07-30 10:55 78,623 --a------ C:\DOCUME~1\solai\APPLIC~1\tmp13.tmp.exe
2007-07-30 10:55 58,798 --a------ C:\DOCUME~1\solai\APPLIC~1\tmp10.tmp.exe
2007-07-30 10:55 125,141 --a------ C:\DOCUME~1\solai\APPLIC~1\tmp11.tmp.exe
2007-07-28 10:58 93,814 --a------ C:\WINNT\SYSTEM32\C_2SSO.dll
2007-07-28 10:58 17,120 --a------ C:\WINNT\SYSTEM32\awvtsst.dll
2007-07-23 15:05d-------- C:\WINNT\Cache
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))07-08-13 11:37 --------- d-------- C:\Program Files\Symantec AntiVirus
07-06-25 16:55 22592 --a------ C:\WINNT\system32\JHfEDA6I.exe
03-07-10 15:54 271 --ah----- C:\Program Files\DESKTOP.INI
03-07-10 15:54 21952 --ah----- C:\Program Files\FOLDER.HTT
03-06-20 09:00 32528 --a------ C:\WINNT\inf\WBFIRDMA.SYS
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bb9bfd03-3999-4cef-bf84-c49e059552c4}]
07-07-28 10:58 93814 --a------ C:\WINNT\system32\C_2SSO.dll[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{f2b6b1ad-967f-4fee-957b-3f31e89b9003}]
07-07-28 10:58 93814 --a------ C:\WINNT\system32\C_2SSO.dll[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe" [03-06-20 09:00 C:\WINNT\SYSTEM32\MOBSYNC.EXE]
"IgfxTray"="C:\WINNT\system32\igfxtray.exe" [04-08-20 17:55 ]
"HotKeysCmds"="C:\WINNT\system32\hkcmd.exe" [04-08-20 17:51 ]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [04-04-26 10:04 ]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [04-01-07 03:01 ]
"dla"="C:\WINNT\system32\dla\tfswctrl.exe" [04-08-13 03:05 ]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [04-02-29 17:44 ]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [04-03-12 16:18 ]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [04-02-12 14:38 ]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [04-05-12 16:18 ]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [05-05-05 12:44 ]
"WinVNC"="C:\Program Files\TightVNC\WinVNC.exe" [03-08-01 19:28 ][HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [04-05-12 01:03 ]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [][HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"internat.exe"=internat.exeC:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Find Fast.lnk - C:\Program Files\Microsoft Office97\Office\FINDFAST.EXE [1997-07-11 01:00:00]
Office Startup.lnk - C:\Program Files\Microsoft Office97\Office\OSA.EXE [1997-07-11 01:00:00]
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2005-02-16 09:46:18][HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"DisablePersonalDirChange"=1 (0x1)[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"= shdocvw.dll [ ][HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\C_2SSO]
C_2SSO.dll 07-07-28 10:58 93814 C:\WINNT\SYSTEM32\C_2SSO.dll[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=c:\winnt\system32\awvtsst.dll[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]
@="Driver"[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]
@="Driver"R0 fasttrak;fasttrak;C:\WINNT\system32\DRIVERS\fasttrak.sys
R0 Fd16_700;Fd16_700;C:\WINNT\system32\DRIVERS\fd16_700.sys
R0 mraid2k;mraid2k;C:\WINNT\system32\DRIVERS\mraid2k.sys
R2 BASFND;BASFND;\??\C:\WINNT\system32\Drivers\BASFND.sys
R3 usbhub20;USB 2.0 Root Hub Support;C:\WINNT\system32\DRIVERS\usbhub20.sys
S3 EL90BC;3Com EtherLink XL B/C Adapter Driver;C:\WINNT\system32\DRIVERS\el90xbc5.sys
S3 OracleOraHome81ClientCache;OracleOraHome81ClientCache;C:\oracle\ora81\BIN\ONRSD.EXE*Newly Created Service* - IPNAT
*Newly Created Service* - RASAUTO
*Newly Created Service* - SHAREDACCESSContents of the 'Scheduled Tasks' folder
2007-08-02 16:26:44 C:\WINNT\Tasks\AdwareAlert Scheduled Scan.job - C:\Program Files\AdwareAlert\AdwareAlert.exe
2007-08-07 06:11:29 C:\WINNT\Tasks\At1.job - C:\WINNT\system32\JHfEDA6I.exe
2007-08-13 13:00:30 C:\WINNT\Tasks\At10.job - C:\WINNT\system32\JHfEDA6I.exe
2007-08-13 14:00:30 C:\WINNT\Tasks\At11.job
2007-08-10 15:00:30 C:\WINNT\Tasks\At12.job
2007-08-10 16:00:30 C:\WINNT\Tasks\At13.job
2007-08-10 17:00:30 C:\WINNT\Tasks\At14.job
2007-08-10 18:00:30 C:\WINNT\Tasks\At15.job
2007-08-10 19:00:30 C:\WINNT\Tasks\At16.job
2007-08-10 20:00:30 C:\WINNT\Tasks\At17.job
2007-08-09 21:00:30 C:\WINNT\Tasks\At18.job
2007-08-07 22:01:08 C:\WINNT\Tasks\At19.job - C:\WINNT\system32\JHfEDA6I.exe
2007-08-07 06:11:29 C:\WINNT\Tasks\At2.job - C:\WINNT\system32\JHfEDA6I.exe
2007-08-07 06:11:29 C:\WINNT\Tasks\At20.job
2007-08-07 06:11:29 C:\WINNT\Tasks\At21.job - C:\WINNT\system32\JHfEDA6I.exe
2007-08-07 06:11:29 C:\WINNT\Tasks\At22.job - C:\WINNT\system32\JHfEDA6I.exe
2007-08-07 06:11:29 C:\WINNT\Tasks\At23.job - C:\WINNT\system32\JHfEDA6I.exe
2007-08-07 06:11:29 C:\WINNT\Tasks\At24.job - C:\WINNT\system32\JHfEDA6I.exe
2007-08-07 06:11:29 C:\WINNT\Tasks\At3.job - C:\WINNT\system32\JHfEDA6I.exe
2007-08-07 06:11:29 C:\WINNT\Tasks\At4.job - C:\WINNT\system32\JHfEDA6I.exe
2007-08-07 06:11:29 C:\WINNT\Tasks\At5.job
2007-08-07 06:11:29 C:\WINNT\Tasks\At6.job - C:\WINNT\system32\JHfEDA6I.exe
2007-08-07 06:11:29 C:\WINNT\Tasks\At7.job - C:\WINNT\system32\JHfEDA6I.exe
2007-08-07 06:11:29 C:\WINNT\Tasks\At8.job - C:\WINNT\system32\JHfEDA6I.exe
2007-08-13 12:01:34 C:\WINNT\Tasks\At9.job - C:\WINNT\system32\JHfEDA6I.exe**************************************************************************catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-13 11:42:47
Windows 5.0.2195 Service Pack 4 NTFSscanning hidden processes ...scanning hidden autostart entries ...scanning hidden files ...scan completed successfully
hidden files: 0**************************************************************************Completion time: 2007-08-13 11:43:22
C:\ComboFix-quarantined-files.txt ... 07-08-13 11:43--- E O F ---
407
0
Posted August 13th, 2007 15:00
spmad
You are most welcome.
You have a suspicious file I would like to look at
Please go HERE
Put Your Name, and Dell HJT forum
and In the file to submit box, click Browse.Using Windows Explorer
- (Right click on "Start," select "Explore," and you will see the "tree' of file folders in the left side of the window. Click on the "+" next to any folder name to expand its contents)
- C:\WINNT\system32\JHfEDA6I.exe
In the comments tell them that I asked you to upload the file
Then Select Send File.
CastleCops Instructor
MRU Graduate
"The world is what you make of it"
407
0
Posted August 13th, 2007 17:00
Hello bamajimJust sent the file you requested through the other site. I am not sure if i mentioned your name as "bamajim" or "bamajin", so I may resend the file again. Thanks for all the help. Thanks407
0
Posted August 13th, 2007 20:00
spmad
Got the file. It's bad
1. Open NotePad (not wordpad). Copy and paste the following into Notepad
- File::
C:\WINNT\Tasks\AdwareAlert Scheduled Scan.job
C:\WINNT\Tasks\At1.job
C:\WINNT\Tasks\At10.job
C:\WINNT\Tasks\At11.job
C:\WINNT\Tasks\At12.job
C:\WINNT\Tasks\At13.job
C:\WINNT\Tasks\At14.job
C:\WINNT\Tasks\At15.job
C:\WINNT\Tasks\At16.job
C:\WINNT\Tasks\At17.job
C:\WINNT\Tasks\At18.job
C:\WINNT\Tasks\At19.job
C:\WINNT\Tasks\At2.job
C:\WINNT\Tasks\At20.job
C:\WINNT\Tasks\At21.job
C:\WINNT\Tasks\At22.job
C:\WINNT\Tasks\At23.job
C:\WINNT\Tasks\At24.job
C:\WINNT\Tasks\At3.job
C:\WINNT\Tasks\At4.job
C:\WINNT\Tasks\At5.job
C:\WINNT\Tasks\At6.job
C:\WINNT\Tasks\At7.job
C:\WINNT\Tasks\At8.job
C:\WINNT\Tasks\At9.job
C:\WINNT\system32\JHfEDA6I.exe
C:\WINNT\SYSTEM32\awvtsst.dll
C:\WINNT\SYSTEM32\C_2SSO.dll
C:\DOCUME~1\solai\APPLIC~1\tmp13.tmp.exe
C:\DOCUME~1\solai\APPLIC~1\tmp10.tmp.exe
C:\DOCUME~1\solai\APPLIC~1\tmp11.tmp.exe
C:\DOCUME~1\solai\APPLIC~1\tmp7B.tmp.exe
C:\DOCUME~1\solai\APPLIC~1\tmp26.tmp.exe
C:\DOCUME~1\solai\APPLIC~1\tmp19.tmp.exe
C:\Program Files\AdwareAlert\AdwareAlert.exe
Folder::
C:\Program Files\AdwareAlert
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{bb9bfd03-3999-4cef-bf84-c49e059552c4}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{f2b6b1ad-967f-4fee-957b-3f31e89b9003}]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"DisablePersonalDirChange"=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\C_2SSO]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"appinit_dlls"=-
Save the File as CFScript (Just as indicated no spaces) ->> Save it to your Desktop
Using the Image as a reference, drag CFScript into ComboFix.exe
- You will be prompted to run Combofix again, Do so
Following the same rules as indicated in my first post
Then post the contents of the C:\ComboFix.txt log in your reply
CastleCops Instructor
MRU Graduate
"The world is what you make of it"
- File::
407
0
Posted August 14th, 2007 15:00
Thanks bamajim. Looks like it is working allright now. You are just too good. Here is the hijackthis file. Please let me know what else i need to do.Logfile of HijackThis v1.99.1
Scan saved at 12:55, on 2007-08-14
Platform: Windows 2000 SP4 (WinNT 5.00.2195)
MSIE: Internet Explorer v6.00 SP1 (6.00.2800.1106)Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\spoolsv.exe
C:\WINNT\system32\basfipm.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Symantec AntiVirus\DefWatch.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\system32\hidserv.exe
C:\WINNT\system32\regsvc.exe
C:\WINNT\system32\MSTask.exe
C:\WINNT\system32\stisvc.exe
C:\Program Files\Symantec AntiVirus\Rtvscan.exe
C:\WINNT\System32\WBEM\WinMgmt.exe
C:\Program Files\TightVNC\WinVNC.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\WINNT\system32\svchost.exe
C:\WINNT\Explorer.EXE
C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Microsoft Office97\Office\FINDFAST.EXE
C:\Program Files\Microsoft Office97\Office\OSA.EXE
C:\Program Files\WinZip\WZQKPICK.EXE
\Feb-5fwds61\c$\PROGRA~1\Palm\HOTSYNC.EXE
C:\Program Files\Common Files\System\MAPI\1033\nt\MAPISP32.EXE
C:\PROGRA~1\MICROS~2\Office\OUTLOOK.EXE
C:\Program Files\INTERN~1\iexplore.exe
C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
C:\PROGRA~1\WINZIP\winzip32.exe
C:\Documents and Settings\solai.FEBLO_PDC\Local Settings\Temp\HijackThis.exeR0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.hotmail.com/
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = C:\WINDOWS\system32\blank.htm
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINNT\system32\dla\tfswshx.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll
O3 - Toolbar: @msdxmLC.dll,-1@1033,&Radio - {8E718888-423F-11D2-876E-00A0C9082467} - C:\WINNT\system32\msdxm.ocx
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [IgfxTray] C:\WINNT\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINNT\system32\hkcmd.exe
O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [dla] C:\WINNT\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
O4 - HKLM\..\Run: [HP Software Update] "C:\Program Files\HP\HP Software Update\HPWuSchd2.exe"
O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [WinVNC] "C:\Program Files\TightVNC\WinVNC.exe" -servicehelper
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - Startup: HotSync Manager.lnk = Program Files\Palm\HOTSYNC.EXE
O4 - Global Startup: Microsoft Find Fast.lnk = C:\Program Files\Microsoft Office97\Office\FINDFAST.EXE
O4 - Global Startup: Office Startup.lnk = C:\Program Files\Microsoft Office97\Office\OSA.EXE
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O15 - Trusted IP range: 192.168.10.85
O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://www.drivecleaner.com/.freeware/installdrivecleanerstart.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1186165816592
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = feblo.hlgllc.com
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = feblo.hlgllc.com
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = feblo.hlgllc.com
O20 - Winlogon Notify: igfxcui - C:\WINNT\SYSTEM32\igfxsrvc.dll
O20 - Winlogon Notify: NavLogon - C:\WINNT\system32\NavLogon.dll
O23 - Service: Broadcom ASF IP monitoring service v6.0.4 (BAsfIpM) - Broadcom Corp. - C:\WINNT\system32\basfipm.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
O23 - Service: Logical Disk Manager Administrative Service (dmadmin) - VERITAS Software Corp. - C:\WINNT\System32\dmadmin.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: OracleOraHome81ClientCache - Unknown owner - C:\oracle\ora81\BIN\ONRSD.EXE (file missing)
O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
O23 - Service: VNC Server (winvnc) - Unknown owner - C:\Program Files\TightVNC\WinVNC.exe" -service (file missing)407
0
Posted August 14th, 2007 15:00
Hi bamajimI submitted the malaware file to bleeping computes, thanks.407
0
Posted August 14th, 2007 15:00
spmadGood job. Could I see a fresh Hijackthis log407
0
Posted August 14th, 2007 15:00
Bamajim,I am amazed as to how you do this but thanks anyway. I had some difficulty as the Combofix froze. I had to click the mouse as Spybot was popping up some stuff. Disabled and then had to run the combofix. here is the file you requested. Thanks.ComboFix 07-08-13.3 - "solai" 2007-08-14 11:50:41.4 - NTFSx86
Microsoft Windows 2000 Professional 5.0.2195.4.1252.1.1033.18.278 [GMT -4:00]
Command switches used :: C:\Documents and Settings\solai.FEBLO_PDC\Desktop\CFScript.txtFILE::
C:\WINNT\Tasks\AdwareAlert Scheduled Scan.job
C:\WINNT\Tasks\At1.job
C:\WINNT\Tasks\At10.job
C:\WINNT\Tasks\At11.job
C:\WINNT\Tasks\At12.job
C:\WINNT\Tasks\At13.job
C:\WINNT\Tasks\At14.job
C:\WINNT\Tasks\At15.job
C:\WINNT\Tasks\At16.job
C:\WINNT\Tasks\At17.job
C:\WINNT\Tasks\At18.job
C:\WINNT\Tasks\At19.job
C:\WINNT\Tasks\At2.job
C:\WINNT\Tasks\At20.job
C:\WINNT\Tasks\At21.job
C:\WINNT\Tasks\At22.job
C:\WINNT\Tasks\At23.job
C:\WINNT\Tasks\At24.job
C:\WINNT\Tasks\At3.job
C:\WINNT\Tasks\At4.job
C:\WINNT\Tasks\At5.job
C:\WINNT\Tasks\At6.job
C:\WINNT\Tasks\At7.job
C:\WINNT\Tasks\At8.job
C:\WINNT\Tasks\At9.job
C:\WINNT\system32\JHfEDA6I.exe
C:\WINNT\SYSTEM32\awvtsst.dll
C:\WINNT\SYSTEM32\C_2SSO.dll
C:\DOCUME~1\solai\APPLIC~1\tmp13.tmp.exe
C:\DOCUME~1\solai\APPLIC~1\tmp10.tmp.exe
C:\DOCUME~1\solai\APPLIC~1\tmp11.tmp.exe
C:\DOCUME~1\solai\APPLIC~1\tmp7B.tmp.exe
C:\DOCUME~1\solai\APPLIC~1\tmp26.tmp.exe
C:\DOCUME~1\solai\APPLIC~1\tmp19.tmp.exe
C:\Program Files\AdwareAlert\AdwareAlert.exe
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
C:\DOCUME~1\SOLAI~1.FEB\APPLIC~1\tmpD5.tmp.exe
C:\DOCUME~1\SOLAI~1.FEB\APPLIC~1\tmpD7.tmp.exe
C:\WINNT\SYSTEM32\C_2SSO.dll
((((((((((((((((((((((((( Files Created from 2007-07-14 to 2007-08-14 )))))))))))))))))))))))))))))))
2007-08-13 10:51 51,200 --a------ C:\WINNT\nircmd.exe
2007-08-07 02:08d-------- C:\WINNT\SYSTEM32\Windows Media
2007-08-07 02:07d--h-c--- C:\WINNT\$NtUpdateRollupPackUninstall$
2007-08-07 02:07d-------- C:\WINNT\msiinst.tmp
2007-08-07 02:05d--h-c--- C:\WINNT\$SQLUninstallMDAC28-KB927779-x86-ENU$
2007-08-07 02:02d-------- C:\Program Files\MSXML 4.0
2007-08-06 08:13 44,032 --------- C:\WINNT\SYSTEM32\DLLCACHE\msxml3r.dll
2007-08-06 08:09 86,288 --------- C:\WINNT\SYSTEM32\DLLCACHE\srvsvc.dll
2007-08-06 08:05 2,174,976 --------- C:\WINNT\SYSTEM32\DLLCACHE\wmvcore.dll
2007-08-06 08:03 840,976 --------- C:\WINNT\SYSTEM32\DLLCACHE\mmcndmgr.dll
2007-08-03 15:10d-------- C:\WINNT\SYSTEM32\BITS
2007-08-03 14:30 549,720 --a------ C:\WINNT\SYSTEM32\wuapi.dll
2007-08-03 14:30 43,352 --a------ C:\WINNT\SYSTEM32\wups2.dll
2007-08-03 14:30 33,624 --a------ C:\WINNT\SYSTEM32\wups.dll
2007-08-03 14:30 325,976 --a------ C:\WINNT\SYSTEM32\wucltui.dll
2007-08-03 14:30d-------- C:\WINNT\SoftwareDistribution
2007-08-03 09:38 2,379,776 --ah----- C:\DOCUME~1\SOLAI~1.FEB\NTUSER.DAT
2007-08-03 09:38d-a------ C:\DOCUME~1\SOLAI~1.FEB\SapWorkDir
2007-08-03 09:38d-a------ C:\DOCUME~1\SOLAI~1.FEB\pnlinks
2007-08-03 09:38d-a------ C:\DOCUME~1\SOLAI~1.FEB\APPLIC~1\Sonic
2007-08-03 09:38d-a------ C:\DOCUME~1\SOLAI~1.FEB\APPLIC~1\Real
2007-08-03 09:38d-a------ C:\DOCUME~1\SOLAI~1.FEB\APPLIC~1\Murasu
2007-08-03 09:38d-a------ C:\DOCUME~1\SOLAI~1.FEB\APPLIC~1\Microsoft Web Folders
2007-08-03 09:38d-a------ C:\DOCUME~1\SOLAI~1.FEB\APPLIC~1\Leadertech
2007-08-03 09:38d-a------ C:\DOCUME~1\SOLAI~1.FEB\APPLIC~1\Lavasoft
2007-08-03 09:38d-a------ C:\DOCUME~1\SOLAI~1.FEB\APPLIC~1\ICAClient
2007-08-03 09:38d-a------ C:\DOCUME~1\SOLAI~1.FEB\APPLIC~1\Help
2007-08-03 09:38d-a------ C:\DOCUME~1\SOLAI~1.FEB\APPLIC~1\Google
2007-08-03 09:38d-a------ C:\DOCUME~1\SOLAI~1.FEB\APPLIC~1\Arcsoft
2007-08-03 09:38d-a------ C:\DOCUME~1\SOLAI~1.FEB\APPLIC~1\AdobeUM
2007-08-03 09:38d---s---- C:\DOCUME~1\SOLAI~1.FEB\UserData
2007-08-03 09:38d-------- C:\DOCUME~1\SOLAI~1.FEB\APPLIC~1\AdwareAlert
2007-08-02 12:26d-------- C:\DOCUME~1\solai\APPLIC~1\AdwareAlert
2007-07-31 10:27 499,712 --a------ C:\WINNT\SYSTEM32\msvcp71.dll
2007-07-31 10:27 1,060,864 --a------ C:\WINNT\SYSTEM32\mfc71.dll
2007-07-23 15:05d-------- C:\WINNT\Cache
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))07-08-14 11:53 --------- d-------- C:\Program Files\Symantec AntiVirus
03-07-10 15:54 271 --ah----- C:\Program Files\DESKTOP.INI
03-07-10 15:54 21952 --ah----- C:\Program Files\FOLDER.HTT
03-06-20 09:00 32528 --a------ C:\WINNT\inf\WBFIRDMA.SYS
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Synchronization Manager"="mobsync.exe" [03-06-20 09:00 C:\WINNT\SYSTEM32\MOBSYNC.EXE]
"IgfxTray"="C:\WINNT\system32\igfxtray.exe" [04-08-20 17:55 ]
"HotKeysCmds"="C:\WINNT\system32\hkcmd.exe" [04-08-20 17:51 ]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [04-04-26 10:04 ]
"UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [04-01-07 03:01 ]
"dla"="C:\WINNT\system32\dla\tfswctrl.exe" [04-08-13 03:05 ]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [04-02-29 17:44 ]
"vptray"="C:\PROGRA~1\SYMANT~1\VPTray.exe" [04-03-12 16:18 ]
"HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [04-02-12 14:38 ]
"HP Component Manager"="C:\Program Files\HP\hpcoretech\hpcmpmgr.exe" [04-05-12 16:18 ]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [05-05-05 12:44 ]
"WinVNC"="C:\Program Files\TightVNC\WinVNC.exe" [03-08-01 19:28 ][HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [04-05-12 01:03 ]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [][HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop[HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
"internat.exe"=internat.exeC:\Documents and Settings\solai.FEBLO_PDC\Start Menu\Programs\Startup\
HotSync Manager.lnk - \\Feb-5fwds61\c$\PROGRA~1\Palm\HOTSYNC.EXE [2003-03-07 18:46:14]C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Microsoft Find Fast.lnk - C:\Program Files\Microsoft Office97\Office\FINDFAST.EXE [1997-07-11 01:00:00]
Office Startup.lnk - C:\Program Files\Microsoft Office97\Office\OSA.EXE [1997-07-11 01:00:00]
WinZip Quick Pick.lnk - C:\Program Files\WinZip\WZQKPICK.EXE [2005-02-16 09:46:18][HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{FBF23B40-E3F0-101B-8488-00AA003E56F8}"= shdocvw.dll [ ][HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]
@="Driver"[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]
@="Driver"R0 fasttrak;fasttrak;C:\WINNT\system32\DRIVERS\fasttrak.sys
R0 Fd16_700;Fd16_700;C:\WINNT\system32\DRIVERS\fd16_700.sys
R0 mraid2k;mraid2k;C:\WINNT\system32\DRIVERS\mraid2k.sys
R2 BASFND;BASFND;\??\C:\WINNT\system32\Drivers\BASFND.sys
R3 usbhub20;USB 2.0 Root Hub Support;C:\WINNT\system32\DRIVERS\usbhub20.sys
S3 EL90BC;3Com EtherLink XL B/C Adapter Driver;C:\WINNT\system32\DRIVERS\el90xbc5.sys
S3 OracleOraHome81ClientCache;OracleOraHome81ClientCache;C:\oracle\ora81\BIN\ONRSD.EXE
**************************************************************************catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-08-14 11:55:58
Windows 5.0.2195 Service Pack 4 NTFSscanning hidden processes ...scanning hidden autostart entries ...scanning hidden files ...scan completed successfully
hidden files: 0**************************************************************************Completion time: 2007-08-14 11:57:18 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 07-08-14 11:57
C:\ComboFix2.txt ... 07-08-13 11:43--- E O F ---
252
0
Posted August 14th, 2007 17:00
spmad
Thank you for the compliment
1. Rerun Hijackthis ( scan only) and place checks beside the following entries
- R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://www.drivecleaner.com/.freeware/installdrivecleanerstart.cab
Close all other open windows except Hijackthis and Select " Fix checked"
Close Hijackthis and reboot your PC
2. *NOTE* CCleaner deletes EVERYTHING out of temp/temporary folders. If you have anything in a temp folder, back it up or move it to a permanent folder prior to running CCleaner!
Download CCleaner from here to clean temp files from your computer.
- Double click on the file to start the installation of the program.
- Select your language and click OK, then next.
- Read the license agreement and click I Agree.
- Click next to use the default install location. Click Install then finish to complete installation.
- Double click the CCleaner shortcut on the desktop to start the program.
- On the "Windows" tab, under "Internet Explorer," uncheck "Cookies" if you do not want them deleted. (If deleted, you will likely need to reenter your passwords at all sites where a cookie is used to recognize you when you visit).
- If you use either the Firefox or Mozilla browsers, the box to uncheck for "Cookies" is on the Applications tab, under Firefox/Mozilla.
- Click on the "Options" icon at the left side of the window, then click on "Advanced." deselect "Only delete files in Windows Temp folders older than 48 hours."
- Click on the "Cleaner" icon on the left side of the window, then click Run Cleaner to run the program.
- Caution: It is not recommended that you use the "Issues" feature unless you are very familiar with the registry as it has been known to find legitimate items.
- After CCleaner has completed its process, click Exit.
3. Run an online virus scan called Kaspersky from HERE.
- 1. Click on " Kaspersky Online Scanner"
2. A new smaller window will pop up. Press on " Accept". After reading the contents.
3. Now Kaspersky will update the anti-virus database. Let it run.
4. Click on " Next"->>" Scan Settings", and make sure the database is set to " extended". And check both the scan options. Then click OK.
5. Then click on " My Computer". And the scan will start.
6. Once finished, save a log as ". txt" to the desktop.
Copy and post the results of the Kaspersky Online scan
CastleCops Instructor
MRU Graduate
"The world is what you make of it"
- R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
bamajim
1 Rookie
•
10376 Posts
407
0
Posted August 13th, 2007 12:00
Please download Combofix and save to your desktop:
Close any open browsers.
Double click on combofix.exe and follow the prompts.
When it's finished it will produce a log.
Post the contents of the C:\ComboFix.txt into your next reply.
Note: Do not mouseclick combofix's window whilst it's running.
That may cause the program to freeze/hang.
MRU Graduate
"The world is what you make of it"