Found a Nasty and need help

View previous topic View next topic Go down

Found a Nasty and need help

Post by Mel Adjusted on 6th March 2009, 1:03 pm

I was copying some music from a friends memory stick and got a virus warning.... I run Spybot S & D and sure enough it popped up with Win32.rungbu.a.... I removed it... rebooted and low and behold, it was back again... How go I get rid of it?

Here's a copy of my HJT....

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:54:02 AM, on 3/6/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Comodo\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Comodo\CBOClean\BOCORE.exe
C:\Program Files\Bonjour\mDNSResponder.exe
d:\Program Files\Spotmau WinCare 2008\sub\FSDRIVER\FolderProtectService.exe
C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\TUProgSt.exe
C:\Program Files\Webroot\Washer\WasherSvc.exe
d:\Program Files\Spotmau WinCare 2008\sub\FSDRIVER\FolderProtect.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\PROGRA~1\Comodo\CBOClean\BOC427.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\WINDOWS\tsnpstd3.exe
C:\WINDOWS\vsnpstd3.exe
C:\WINDOWS\tppaldr.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Babylon\Babylon-Pro\Babylon.exe
C:\Program Files\Comodo\COMODO Internet Security\cfp.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Mozilla Firefox 3.1 Beta 2\firefox.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = [You must be registered and logged in to see this link.]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = [You must be registered and logged in to see this link.]
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = [You must be registered and logged in to see this link.]
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: myBabylon English Toolbar - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files\myBabylon_English\tbmyB1.dll
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - C:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SearchHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.0.926.3450\swg.dll
O2 - BHO: myBabylon English Toolbar - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files\myBabylon_English\tbmyB1.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - C:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: myBabylon English Toolbar - {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - C:\Program Files\myBabylon_English\tbmyB1.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [BOC-427] C:\PROGRA~1\Comodo\CBOClean\BOC427.exe
O4 - HKLM\..\Run: [SpywareTerminator] "C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe"
O4 - HKLM\..\Run: [tsnpstd3] C:\WINDOWS\tsnpstd3.exe
O4 - HKLM\..\Run: [snpstd3] C:\WINDOWS\vsnpstd3.exe
O4 - HKLM\..\Run: [TPP Auto Loader] C:\WINDOWS\tppaldr.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [Babylon Client] C:\Program Files\Babylon\Babylon-Pro\Babylon.exe -AutoStart
O4 - HKLM\..\Run: [COMODO Internet Security] "C:\Program Files\Comodo\COMODO Internet Security\cfp.exe" -h
O4 - HKLM\..\Run: [Ad-Watch] C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Startup Manager] "C:\Program Files\Advanced System Optimizer\startUp manager.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O8 - Extra context menu item: Easy-WebPrint Add To Print List - [You must be registered and logged in to see this link.] Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - [You must be registered and logged in to see this link.] Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - [You must be registered and logged in to see this link.] Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - [You must be registered and logged in to see this link.] Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O8 - Extra context menu item: Translate with &Babylon - [You must be registered and logged in to see this link.] Files\Babylon\Babylon-Pro\Utils\BabylonIEPI.dll/Translate.htm
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} (PCPitstop Utility) - [You must be registered and logged in to see this link.]
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - [You must be registered and logged in to see this link.]
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - [You must be registered and logged in to see this link.]
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - [You must be registered and logged in to see this link.]
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - [You must be registered and logged in to see this link.]
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: BOCore - COMODO - C:\Program Files\Comodo\CBOClean\BOCORE.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: COMODO Internet Security Helper Service (cmdAgent) - Unknown owner - C:\Program Files\Comodo\COMODO Internet Security\cmdagent.exe
O23 - Service: FolderProtectService - Unknown owner - d:\Program Files\Spotmau WinCare 2008\sub\FSDRIVER\FolderProtectService.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Program Files\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Google Update Service (gupdate1c985d829e7373e) (gupdate1c985d829e7373e) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: PD91Agent - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe
O23 - Service: PD91Engine - Raxco Software, Inc. - C:\Program Files\Raxco\PerfectDisk2008\PD91Engine.exe
O23 - Service: Spyware Terminator Realtime Shield Service (sp_rssrv) - Crawler.com - C:\Program Files\Spyware Terminator\sp_rsser.exe
O23 - Service: TuneUp Program Statistics Service (TuneUp.ProgramStatisticsSvc) - TuneUp Software - C:\WINDOWS\System32\TUProgSt.exe
O23 - Service: Window Washer Engine (wwEngineSvc) - Webroot Software, Inc. - C:\Program Files\Webroot\Washer\WasherSvc.exe

--
End of file - 10317 bytes

Mel Adjusted
Novice
Novice

Posts Posts : 17
Joined Joined : 2009-03-06
Gender Gender : Male
OS OS : WindowsXP SP3
Points Points : 28370
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Found a Nasty and need help

Post by Mel Adjusted on 6th March 2009, 2:49 pm

I also noticed when running Spybot along with Win32.rungbu.a there was another one..... virtumonde.sdn

Mel Adjusted
Novice
Novice

Posts Posts : 17
Joined Joined : 2009-03-06
Gender Gender : Male
OS OS : WindowsXP SP3
Points Points : 28370
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Found a Nasty and need help

Post by Belahzur on 6th March 2009, 6:11 pm

Please download and run this tool.

Download Malwarebytes' Anti-Malware from [You must be registered and logged in to see this link.]

Double Click mbam-setup.exe to install the application.

  • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
  • If an update is found, it will download and install the latest version.
  • Once the program has loaded, select "Perform Quick Scan", then click Scan.
  • The scan may take some time to finish,so please be patient.
  • When the scan is complete, click OK, then Show Results to view the results.
  • Make sure that everything is checked, and click Remove Selected.
  • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note)
  • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Note:
If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts.
Click OK to either and let MBAM proceed with the disinfection process.
If asked to restart the computer, please do so immediately.


Post the contents of the MBAM Log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245121
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Found a Nasty and need help

Post by Mel Adjusted on 6th March 2009, 6:42 pm

Malwarebytes' Anti-Malware 1.34
Database version: 1824
Windows 5.1.2600 Service Pack 3

3/6/2009 10:31:45 AM
mbam-log-2009-03-06 (10-31-45).txt

Scan type: Quick Scan
Objects scanned: 64455
Time elapsed: 1 minute(s), 40 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 1
Registry Data Items Infected: 1
Folders Infected: 0
Files Infected: 4

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
HKEY_CLASSES_ROOT\videosoft (Trojan.DNSChanger) -> Quarantined and deleted successfully.

Registry Values Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Startup Manager (Backdoor.Bot) -> Quarantined and deleted successfully.

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\Program Files\Common Files\chd.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Program Files\Advanced System Optimizer\startUp manager.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\service.exe (Backdoor.Bot) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\rqRLbyxu.dll (Trojan.Vundo) -> Quarantined and deleted successfully.

Mel Adjusted
Novice
Novice

Posts Posts : 17
Joined Joined : 2009-03-06
Gender Gender : Male
OS OS : WindowsXP SP3
Points Points : 28370
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Found a Nasty and need help

Post by Belahzur on 6th March 2009, 6:44 pm

Your computer has multiple infections, including a backdoor. A backdoor gives intruders complete control of your computer, logs your keystrokes, steal personal information, etc.

You are strongly advised to do the following:

  • Disconnect the computer from the Internet and from any networked computers until it is cleaned.
  • Back up all your important data except programs. The programs can be reinstalled back from the original disc or from the Net.
  • Call all your banks, financial institutions, credit card companies and inform them that you may be a victim of identity theft and put a watch on your accounts. If you don't mind the hassle, change all your account numbers.
  • From a clean computer, change all your passwords (ISP login password, your email address(es) passwords, financial accounts, PayPal, eBay, Amazon, online groups and forums and any other online activities you carry out which require a username and password).
Do NOT change your passwords from this computer as the attacker will be able to get all the new passwords and transaction records.


  • Please download DDS by sUBs to your Desktop (Important!!) from one of these locations:
    [You must be registered and logged in to see this link.]
    [You must be registered and logged in to see this link.]
    [You must be registered and logged in to see this link.]
  • Double click DDS.scr to run
  • When complete, DDS.txt will open.
  • Save the report to your Desktop.
  • Copy and paste DDS.txt back here, I don't need to see attach.txt.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245121
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Found a Nasty and need help

Post by Mel Adjusted on 6th March 2009, 7:42 pm

RP307: 3/6/2009 10:51:33 AM - Installed Windows Media Format Runtime
RP308: 3/6/2009 10:52:27 AM - Installed Windows Media Format Runtime
RP309: 3/6/2009 10:53:07 AM - Installed Windows Media Format Runtime

==== Installed Programs ======================


µTorrent
2Wire Gateway
Abrosoft FantaMorph 3.0
Acrobat.com
Ad-Aware
Adobe AIR
Adobe Flash Player 10 ActiveX
Adobe Flash Player 10 Plugin
Adobe Reader 9
Advanced System Optimizer
Auslogics BoostSpeed
Babylon
BayGenie eBay Auction Sniper Pro Edition 3.3.1.0
Bejeweled Twist 1.0.3
BOClean
Bonjour
Bricks '2000
Canon iP1700
Canon My Printer
Canon Utilities Easy-PhotoPrint
CCleaner (remove only)
Chicken Invaders v1.30
Choice Guard
COMODO Internet Security
ComputerExpert 2009 V3.6
DeepBurner Pro v1.8.0.225
DIGOpt
DIGReqEx
Disk Investigator 1.4
Doremi FLV to MP3 Converter 1.0
Dramatica Pro 4.0
Driver Genius Professional Edition
DSL Speed V4.5
EASEUS Partition Manager 3.0 Home Edition
Easy-WebPrint
Eusing Free Registry Cleaner
FinePixViewer Ver.4.2
Free YouTube to Mp3 Converter version 3.1
FreeAgent Pro Tools
FUJIFILM USB Driver
Full Tilt Poker
getPlus(R) for Adobe
GIMP 2.6.4
Google Earth
Google Toolbar for Internet Explorer
Google Update Helper
Google Updater
High Definition Audio Driver Package - KB888111
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Windows XP (KB954708)
Identity Finder Professional Edition
ImageMixer VCD2 for FinePix
ImgBurn
Inkscape 0.46
Intel(R) Graphics Media Accelerator Driver
IZArc 3.81
Jardinains!
Java(TM) 6 Update 12
Java(TM) 6 Update 7
Junk Mail filter update
Malwarebytes' Anti-Malware
Mario Forever 4.0
Mathcad 14
Mathcad 14 Help
Mathcad 14 Resource Center
MathPlayer
Microsoft .NET Framework 1.1
Microsoft .NET Framework 2.0 Service Pack 2
Microsoft .NET Framework 3.0 Service Pack 2
Microsoft .NET Framework 3.5 SP1
Microsoft Application Error Reporting
Microsoft Compression Client Pack 1.0 for Windows XP
Microsoft Internationalized Domain Names Mitigation APIs
Microsoft National Language Support Downlevel APIs
Microsoft Picture It! Express 9
Microsoft Picture It! Library 9
Microsoft Search Enhancement Pack
Microsoft SQL Server 2005 Compact Edition [ENU]
Microsoft Sync Framework Runtime Native v1.0 (x86)
Microsoft Sync Framework Services Native v1.0 (x86)
Microsoft Visual C++ 2005 Redistributable
Microsoft Windows Media Video 9 VCM
MicroStaff WINASPI
Miro
Modem Booster
Mozilla Firefox (3.1b2)
MSN
MSN Encarta Plus Support Files
MSVCRT
myBabylon_English Toolbar
OpenOffice.org 3.0
PC Pitstop Optimize 1.5
PerfectDisk 2008 Professional
Performance Center
PokerStars
PokerStars.net
PowerISO
QuickTime
QuuxPlayer
RAW FILE CONVERTER LE
REALTEK GbE & FE Ethernet PCI-E NIC Driver
Realtek High Definition Audio Driver
RegCure 1.5.2.7
Security Update for Windows Internet Explorer 7 (KB956390)
Security Update for Windows Internet Explorer 7 (KB961260)
Segoe UI
Skype™ 3.8
Spotmau Wincare 2008
Spybot - Search & Destroy
Spyware Terminator
Student and Home Edition
System Requirements Lab
The Rosetta Stone
The Ultimate Troubleshooter
ToSearch
Uninstall 1.0.0.1
USB Storage Adapter V3 (TPP)
VDownloader 0.77
Virtual Engine Calculator Advanced
Visual C++ 2008 x86 Runtime - (v9.0.30729)
Visual C++ 2008 x86 Runtime - v9.0.30729.01
VLC media player 0.9.8a
VMC The KEY, Release Candidate
WebFldrs XP
Windows Internet Explorer 7
Windows Live Call
Windows Live Communications Platform
Windows Live Essentials
Windows Live Mail
Windows Live Messenger
Windows Live Photo Gallery
Windows Live Sign-in Assistant
Windows Live Sync
Windows Live Toolbar
Windows Live Upload Tool
Windows Media Format Runtime
Windows Media Player 10
Windows XP Service Pack 3
Womens Murder Club a Darker Shade of Grey 1.00
Word Magic Professional Suite Premier 5.0
Xara Xtreme Pro 4 e-version
Yahoo! Toolbar
ZipItFree 1.90
Zuma Deluxe RA

==== Event Viewer Messages From Past Week ========

3/2/2009 10:48:03 PM, error: Service Control Manager [7000] - The BOClean Kernel Monitor. service failed to start due to the following error: Access is denied.
3/2/2009 10:48:00 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: FolderProtectDriver
3/2/2009 10:47:59 PM, error: Service Control Manager [7023] - The TuneUp Theme Extension service terminated with the following error: The system cannot find the file specified.
3/5/2009 5:53:18 PM, error: MRxSmb [8003] - The master browser has received a server announcement from the computer NEPHITEWARRIOR that believes that it is the master browser for the domain on transport NetBT_Tcpip_{42F6FC79-0748. The master browser is stopping or an election is being forced.
3/5/2009 7:16:59 PM, error: Service Control Manager [7001] - The DHCP Client service depends on the NetBios over Tcpip service which failed to start because of the following error: A device attached to the system is not functioning.
3/5/2009 7:16:59 PM, error: Service Control Manager [7001] - The DNS Client service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
3/5/2009 7:16:59 PM, error: Service Control Manager [7001] - The TCP/IP NetBIOS Helper service depends on the AFD service which failed to start because of the following error: A device attached to the system is not functioning.
3/5/2009 7:16:59 PM, error: Service Control Manager [7001] - The Bonjour Service service depends on the TCP/IP Protocol Driver service which failed to start because of the following error: A device attached to the system is not functioning.
3/5/2009 7:16:59 PM, error: Service Control Manager [7026] - The following boot-start or system-start driver(s) failed to load: AFD cmdGuard cmdHlp Fips FolderProtectDriver intelppm IPSec MRxSmb NetBIOS NetBT RasAcd Rdbss SCDEmu sp_rsdrv2 Tcpip
3/5/2009 7:17:28 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service EventSystem with arguments "" in order to run the server: {1BE1F766-5536-11D1-B726-00C04FB926AF}
3/5/2009 7:17:31 PM, error: DCOM [10005] - DCOM got error "%1084" attempting to start the service netman with arguments "" in order to run the server: {BA126AE5-2166-11D1-B1D0-00805FC1270E}
3/6/2009 3:18:44 AM, error: Service Control Manager [7006] - The ScRegSetValueExW call failed for ImagePath with the following error: Access is denied.

==== End Of File ===========================

Mel Adjusted
Novice
Novice

Posts Posts : 17
Joined Joined : 2009-03-06
Gender Gender : Male
OS OS : WindowsXP SP3
Points Points : 28370
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Found a Nasty and need help

Post by Belahzur on 6th March 2009, 7:47 pm

Wrong log file.
I need to see DDS.txt

Go to Start > Control Panel > Add/Remove Programs and remove the following programs if present.

    µTorrent
    Java(TM) 6 Update 7


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245121
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Found a Nasty and need help

Post by Mel Adjusted on 6th March 2009, 7:51 pm

DDS (Ver_09-02-01.01) - NTFSx86
Run by K. Albert at 11:40:28.10 on Fri 03/06/2009
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_12
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2037.1159 [GMT -8:00]

AV: COMODO Antivirus *On-access scanning enabled* (Updated)
FW: COMODO Firewall *enabled*

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
svchost.exe
C:\Program Files\Comodo\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
svchost.exe
svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Comodo\CBOClean\BOC427.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\WINDOWS\tsnpstd3.exe
C:\WINDOWS\vsnpstd3.exe
C:\WINDOWS\tppaldr.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Babylon\Babylon-Pro\Babylon.exe
C:\Program Files\Comodo\COMODO Internet Security\cfp.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Comodo\CBOClean\BOCORE.exe
C:\Program Files\Bonjour\mDNSResponder.exe
d:\Program Files\Spotmau WinCare 2008\sub\FSDRIVER\FolderProtectService.exe
d:\Program Files\Spotmau WinCare 2008\sub\FSDRIVER\FolderProtect.exe
C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\System32\TUProgSt.exe
C:\Program Files\Webroot\Washer\WasherSvc.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
C:\Program Files\MSN\MSNCoreFiles\msn.exe
C:\Program Files\Mozilla Firefox 3.1 Beta 2\firefox.exe
C:\Documents and Settings\K. Albert\Desktop\dds.scr

============== Pseudo HJT Report ===============

uSearch Page = [You must be registered and logged in to see this link.]
uSearch Bar = [You must be registered and logged in to see this link.]
uInternet Settings,ProxyOverride = *.local
mSearchAssistant = [You must be registered and logged in to see this link.]
uURLSearchHooks: myBabylon English Toolbar: {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - c:\program files\mybabylon_english\tbmyB1.dll
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: EWPBrowseObject Class: {68f9551e-0411-48e4-9aaf-4bc42a6a46be} - c:\program files\canon\easy-webprint\EWPBrowseLoader.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SearchHelper.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.0.926.3450\swg.dll
BHO: myBabylon English Toolbar: {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - c:\program files\mybabylon_english\tbmyB1.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Easy-WebPrint: {327c2873-e90d-4c37-aa9d-10ac9baba46c} - c:\program files\canon\easy-webprint\Toolband.dll
TB: myBabylon English Toolbar: {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - c:\program files\mybabylon_english\tbmyB1.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
uRun: [MsnMsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [FreeRAM XP] "c:\program files\yourware solutions\freeram xp pro\FreeRAM XP Pro.exe" -win
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
mRun: [BOC-427] c:\progra~1\comodo\cboclean\BOC427.exe
mRun: [SpywareTerminator] "c:\program files\spyware terminator\SpywareTerminatorShield.exe"
mRun: [tsnpstd3] c:\windows\tsnpstd3.exe
mRun: [snpstd3] c:\windows\vsnpstd3.exe
mRun: [TPP Auto Loader] c:\windows\tppaldr.exe
mRun: []
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [Babylon Client] c:\program files\babylon\babylon-pro\Babylon.exe -AutoStart
mRun: [COMODO Internet Security] "c:\program files\comodo\comodo internet security\cfp.exe" -h
mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
IE: Easy-WebPrint Add To Print List - c:\program files\canon\easy-webprint\Toolband.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\canon\easy-webprint\Toolband.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\canon\easy-webprint\Toolband.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\canon\easy-webprint\Toolband.dll/RC_Print.html
IE: Translate with &Babylon - c:\program files\babylon\babylon-pro\utils\BabylonIEPI.dll/Translate.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} - [You must be registered and logged in to see this link.]
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} - [You must be registered and logged in to see this link.]
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - [You must be registered and logged in to see this link.]
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - [You must be registered and logged in to see this link.]
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - [You must be registered and logged in to see this link.]
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - [You must be registered and logged in to see this link.]
DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} - [You must be registered and logged in to see this link.]
DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - [You must be registered and logged in to see this link.]
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - [You must be registered and logged in to see this link.]
DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - [You must be registered and logged in to see this link.]
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxdev.dll

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\kc8a4~1.alb\applic~1\mozilla\firefox\profiles\hcpgmaki.default\
FF - prefs.js: browser.search.selectedEngine - Ixquick
FF - prefs.js: browser.startup.homepage - [You must be registered and logged in to see this link.]
FF - plugin: c:\program files\google\google updater\2.4.1487.6512\npCIDetect13.dll
FF - plugin: c:\program files\google\update\1.2.141.5\npGoogleOneClick7.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: d:\program files\quicktime\plugins\npqtplugin.dll
FF - plugin: d:\program files\quicktime\plugins\npqtplugin2.dll
FF - plugin: d:\program files\quicktime\plugins\npqtplugin3.dll
FF - plugin: d:\program files\quicktime\plugins\npqtplugin4.dll
FF - plugin: d:\program files\quicktime\plugins\npqtplugin5.dll
FF - plugin: d:\program files\quicktime\plugins\npqtplugin6.dll
FF - plugin: d:\program files\quicktime\plugins\npqtplugin7.dll

---- FIREFOX POLICIES ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
c:\program files\mozilla firefox 3.1 beta 2\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox 3.1 beta 2\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox 3.1 beta 2\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox 3.1 beta 2\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox 3.1 beta 2\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);

Mel Adjusted
Novice
Novice

Posts Posts : 17
Joined Joined : 2009-03-06
Gender Gender : Male
OS OS : WindowsXP SP3
Points Points : 28370
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Found a Nasty and need help

Post by Mel Adjusted on 6th March 2009, 7:52 pm

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-3-1 64160]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [2008-12-30 110992]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2008-12-30 24336]
R1 FolderProtectDriver;FolderProtectDriver;d:\program files\spotmau wincare 2008\sub\fsdriver\FolderProtectDriver.sys [2009-2-3 15616]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [2008-12-30 142592]
R2 BOCore;BOCore;c:\program files\comodo\cboclean\BOCore.exe [2008-12-30 73464]
R2 cmdAgent;COMODO Internet Security Helper Service;c:\program files\comodo\comodo internet security\cmdagent.exe [2008-12-30 700152]
R2 FolderProtectService;FolderProtectService;d:\program files\spotmau wincare 2008\sub\fsdriver\FolderProtectService.exe [2009-2-3 10240]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-1-18 951120]
R2 PD91Agent;PD91Agent;c:\program files\raxco\perfectdisk2008\PD91Agent.exe [2008-1-16 664840]
R2 SeaPort;SeaPort;c:\program files\microsoft\search enhancement pack\seaport\SeaPort.exe [2009-1-14 226656]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [2009-1-2 603904]
R2 wwEngineSvc;Window Washer Engine;c:\program files\webroot\washer\WasherSvc.exe [2008-12-31 598856]
S2 gupdate1c985d829e7373e;Google Update Service (gupdate1c985d829e7373e);c:\program files\google\update\GoogleUpdate.exe [2009-2-3 133104]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2009-1-4 1684736]
S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2009-1-25 8704]
S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2009-1-25 3072]
S3 FXDrv32;FXDrv32;\??\e:\fxdrv32.sys --> e:\FXDrv32.sys [?]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\nos\bin\getPlus_HelperSvc.exe [2009-1-1 33752]
S3 PD91Engine;PD91Engine;c:\program files\raxco\perfectdisk2008\PD91Engine.exe [2008-1-16 894216]
S3 TPP300;USB Storage Adapter V3 (TPP);c:\windows\system32\drivers\TPP300.SYS [2002-6-23 35584]

============== File Associations ===============

txtfile=c:\windows\NOTEPAD.EXE %1

=============== Created Last 30 ================

2009-03-06 10:24 --d----- c:\docume~1\kc8a4~1.alb\applic~1\Malwarebytes
2009-03-06 10:24 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-03-06 10:24 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-06 10:24 --d----- c:\program files\Malwarebytes' Anti-Malware
2009-03-06 10:24 --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-03-06 03:22 --d----- C:\MGtools
2009-03-06 03:16 73,728 a------- c:\windows\system32\javacpl.cpl
2009-03-05 19:12 --d----- c:\program files\Yahoo!
2009-03-05 18:17 --d----- c:\docume~1\kc8a4~1.alb\applic~1\GetRightToGo
2009-03-05 17:53 0 a------- C:\broadcast.tmp
2009-03-04 18:56 --d----- c:\documents and settings\k. albert\Saved Games
2009-03-04 18:56 --d----- c:\docume~1\kc8a4~1.alb\applic~1\Flood Light Games
2009-03-04 18:56 --d----- c:\docume~1\alluse~1\applic~1\Flood Light Games
2009-03-04 15:53 --d----- c:\program files\Identity Finder
2009-03-04 15:31 --d----- c:\windows\ZipItFree
2009-03-04 05:58 72 ---shr-- C:\autorun.inf
2009-03-02 10:20 --d----- c:\docume~1\kc8a4~1.alb\applic~1\WebcamZoneTrigger
2009-03-01 14:35 15,688 a------- c:\windows\system32\lsdelete.exe
2009-03-01 00:51 64,160 a------- c:\windows\system32\drivers\Lbd.sys
2009-03-01 00:47 -cd-h--- c:\docume~1\alluse~1\applic~1\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-03-01 00:47 --d----- c:\program files\Lavasoft
2009-02-26 19:18 24,468 a---h--- c:\windows\system32\mlfcache.dat
2009-02-26 19:17 --d----- c:\program files\Bonjour
2009-02-26 00:14 --d----- c:\docume~1\kc8a4~1.alb\applic~1\Systweak
2009-02-26 00:12 --d----- c:\program files\Advanced System Optimizer
2009-02-25 23:57 406 a------- c:\windows\system32\ioloBootDefrag.cfg
2009-02-25 23:40 74,703 a------- c:\windows\system32\mfc45.dll
2009-02-25 23:33 --d----- c:\docume~1\kc8a4~1.alb\applic~1\iolo
2009-02-25 23:33 --d----- c:\docume~1\alluse~1\applic~1\iolo
2009-02-25 21:10 --d----- C:\JUNK
2009-02-25 20:21 68,624 a----r-- c:\windows\system32\drivers\DefragFS.sys
2009-02-25 20:19 --d----- c:\program files\Raxco
2009-02-24 21:30 20 a------- c:\windows\mafosav.INI
2009-02-23 02:54 43 a------- C:\mo.mid
2009-02-21 22:51 344,064 a------- c:\windows\system32\msvcr70.dll
2009-02-21 22:51 --d----- c:\program files\common files\DVDVideoSoft
2009-02-18 17:46 95 a------- c:\windows\wininit.ini
2009-02-18 08:30 71 a------- c:\windows\RmFile.ini
2009-02-18 08:30 53,728 a------- c:\windows\rmfile.exe
2009-02-18 08:30 43,664 a------- c:\windows\addrun.exe
2009-02-18 08:30 890 a------- c:\windows\Win.Fa
2009-02-18 08:30 231 a------- c:\windows\System.Fa
2009-02-18 08:26 27,632 a------- c:\windows\system\Ctl3DV2.Dll
2009-02-18 08:19 --d----- c:\program files\Microsoft SQL Server Compact Edition
2009-02-17 22:39 12,160 ac------ c:\windows\system32\dllcache\mouhid.sys
2009-02-17 22:39 12,160 a------- c:\windows\system32\drivers\mouhid.sys
2009-02-17 16:53 30,208 -------- c:\windows\system32\WNASPI32.DLL
2009-02-17 16:53 4,030 -------- c:\windows\system\WINASPI.DLL
2009-02-17 16:53 291 a------- c:\windows\msfsetup.ini
2009-02-17 16:53 8,096 -------- c:\windows\system32\drivers\MASPINT.SYS
2009-02-17 16:53 2,486 -------- c:\windows\system\AS16POST.BIN
2009-02-17 16:48 155,648 a------- c:\windows\system32\FFRAFLIB.DLL
2009-02-17 16:48 274,432 a------- c:\windows\system32\FFTIFF16.dll
2009-02-17 16:47 81,924 -------- c:\windows\system32\drivers\VC4CB104.SYS
2009-02-17 16:47 --d----- c:\program files\REGSHAVE
2009-02-17 16:47 65,536 -------- c:\windows\system32\FINFCHECK.dll
2009-02-17 16:47 45,056 -------- c:\windows\system32\FINFCOPY.dll
2009-02-17 16:47 69,632 -------- c:\windows\system32\FREGSHEX.DLL
2009-02-17 16:47 45,056 -------- c:\windows\system32\FCLKBTN.DLL
2009-02-15 09:39 --d----- c:\docume~1\kc8a4~1.alb\applic~1\Geometric
2009-02-15 09:37 3,426,072 a------- c:\windows\system32\d3dx9_32.dll
2009-02-14 17:35 53,248 a------- c:\windows\system32\CSVer.dll
2009-02-14 17:35 290,816 a------- c:\windows\vncutil.exe
2009-02-14 17:35 104,992 a------- c:\windows\RtkAudioService.exe
2009-02-14 17:02 1,686,016 a------- c:\windows\system32\clinetsuitex6.ocx
2009-02-14 17:02 662,288 a------- c:\windows\system32\MSCOMCT2.OCX
2009-02-14 17:02 427,864 a------- c:\windows\system32\XceedZip.dll
2009-02-12 23:15 --d----- c:\docume~1\kc8a4~1.alb\applic~1\Auslogics
2009-02-12 20:23 --d----- c:\program files\Ascentive
2009-02-11 15:20 459,264 -c------ c:\windows\system32\dllcache\msfeeds.dll
2009-02-11 15:20 267,776 -c------ c:\windows\system32\dllcache\iertutil.dll
2009-02-11 15:20 52,224 -c------ c:\windows\system32\dllcache\msfeedsbs.dll
2009-02-11 15:20 383,488 -c------ c:\windows\system32\dllcache\ieapfltr.dll
2009-02-11 15:20 63,488 -c------ c:\windows\system32\dllcache\icardie.dll
2009-02-11 15:20 13,824 -c------ c:\windows\system32\dllcache\ieudinit.exe
2009-02-11 15:20 2,455,488 -c------ c:\windows\system32\dllcache\ieapfltr.dat
2009-02-11 15:20 991,232 -c------ c:\windows\system32\dllcache\ieframe.dll.mui
2009-02-11 15:20 6,066,688 -c------ c:\windows\system32\dllcache\ieframe.dll
2009-02-10 19:38 --d----- c:\docume~1\kc8a4~1.alb\applic~1\PCF-VLC
2009-02-10 12:24 --d-h--- c:\program files\Zero G Registry
2009-02-10 12:21 --d-h--- c:\documents and settings\k. albert\InstallAnywhere
2009-02-10 00:03 --d----- c:\windows\vbSkinner
2009-02-09 05:35 --d----- c:\windows\SHELLNEW
2009-02-09 05:05 --d----- c:\docume~1\kc8a4~1.alb\applic~1\Mathsoft
2009-02-09 02:12 334,792 a------- c:\windows\system32\_AxShlEx.dll
2009-02-09 02:10 --d----- c:\program files\Alcohol Soft
2009-02-06 19:03 307,576 a------- c:\windows\WLXPGSS.SCR
2009-02-06 18:52 49,504 a------- c:\windows\system32\sirenacm.dll
2009-02-05 13:58 212,240 a------- c:\windows\system32\RichTx32.ocx
2009-02-05 13:58 124,688 a------- c:\windows\system32\MSWinSck.ocx
2009-02-05 13:58 1,753,088 a------- c:\windows\system32\ExGrid.dll
2009-02-05 13:58 614,400 a------- c:\windows\system32\ExButton.dll
2009-02-05 13:58 602,112 a------- c:\windows\system32\ExMenu.dll
2009-02-05 13:58 307,200 a------- c:\windows\system32\ExPMenu.dll
2009-02-05 13:58 516,096 a------- c:\windows\system32\ExTab.dll
2009-02-05 13:58 356,352 a------- c:\windows\system32\eSellerateEngine.dll
2009-02-05 13:58 118,784 a------- c:\windows\system32\eWebControl.dll
2009-02-05 13:58 --d----- c:\program files\common files\eSellerate
2009-02-05 13:58 368,912 a------- c:\windows\system32\vbar332.dll
2009-02-05 13:58 --d----- c:\program files\AnswersThatWork
2009-02-05 08:32 --d----- c:\program files\Spybot - Search & Destroy
2009-02-05 07:51 --d----- c:\program files\TeaTimer (Spybot - Search & Destroy)
2009-02-05 07:47 --d----- c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2009-02-05 07:46 --d----- c:\program files\SDHelper (Spybot - Search & Destroy)
2009-02-05 07:46 --d----- c:\program files\File Scanner Library (Spybot - Search & Destroy)
2009-02-05 07:39 --d----- c:\docume~1\alluse~1\applic~1\Spybot - Search & Destroy
2009-02-04 21:25 159,744 a------- c:\windows\system32\lfpng13n.dll
2009-02-04 21:25 206,336 a------- c:\windows\system32\ltefx13n.dll
2009-02-04 21:25 69,632 a------- c:\windows\system32\lfgif13n.dll
2009-02-04 21:25 462,848 a------- c:\windows\system32\ltkrn13n.dll
2009-02-04 21:25 450,560 a------- c:\windows\system32\ltimg13n.dll
2009-02-04 21:25 401,408 a------- c:\windows\system32\lfcmp13n.dll
2009-02-04 21:25 299,008 a------- c:\windows\system32\ltdis13n.dll
2009-02-04 21:25 163,840 a------- c:\windows\system32\ltfil13n.dll
2009-02-04 21:25 57,344 a------- c:\windows\system32\lfbmp13n.dll
2009-02-04 16:33 506 a------- c:\windows\PowerReg.dat
2009-02-04 16:32 --d----- c:\program files\Screenplay Systems
2009-02-04 14:42 --d----- c:\docume~1\kc8a4~1.alb\applic~1\Downloaded Installations

==================== Find3M ====================

2009-03-06 03:17 410,984 a------- c:\windows\system32\deploytk.dll
2009-02-26 22:11 155,384 a------- c:\windows\system32\guard32.dll
2009-02-26 22:11 110,992 a------- c:\windows\system32\drivers\cmdguard.sys
2009-02-20 10:01 24,336 a------- c:\windows\system32\drivers\cmdhlp.sys
2009-02-05 01:25 700,928 ----h--- c:\windows\system32\wodfamoh.dll
2009-02-03 17:32 18,085,888 a------- c:\windows\RTHDCPL.EXE
2009-02-03 17:22 5,030,912 a------- c:\windows\system32\drivers\RtkHDAud.sys
2009-02-03 16:35 35,840 a------- c:\windows\system32\RtkCoInstXP.dll
2009-01-30 18:27 717,296 a------- c:\windows\system32\drivers\sptd.sys
2009-01-26 16:06 98,304 a------- c:\windows\system32\CmdLineExt.dll
2009-01-21 15:54 1,206,816 a------- c:\windows\RtlUpd.exe
2009-01-06 03:33 86,327 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2009-01-02 22:53 603,904 a------- c:\windows\system32\TUProgSt.exe
2009-01-01 15:09 12,325 a------- c:\windows\system32\SpoonUninstall-Jardinains!.dat
2009-01-01 15:09 164,352 a------- c:\windows\system32\SpoonUninstall.exe
2008-12-30 18:29 21,640 a------- c:\windows\system32\emptyregdb.dat
2008-12-20 15:15 826,368 a------- c:\windows\system32\wininet.dll
2008-12-12 11:18 87,336 a------- c:\windows\system32\dns-sd.exe
2008-12-12 11:11 61,440 a------- c:\windows\system32\dnssd.dll

============= FINISH: 11:40:58.00 ===============

Mel Adjusted
Novice
Novice

Posts Posts : 17
Joined Joined : 2009-03-06
Gender Gender : Male
OS OS : WindowsXP SP3
Points Points : 28370
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Found a Nasty and need help

Post by Belahzur on 6th March 2009, 7:55 pm

Please download the [You must be registered and logged in to see this link.].

  • Save it to your desktop.
  • Please double-click OTMoveIt3.exe to run it.
  • Copy the bolded text below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose CopyCrying


    :files
    C:\autorun.inf
    C:\Documents and Settings\K. Albert\Desktop\dds.scr


  • Return to OTMoveIt3, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTMoveIt3
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please post the OTMoveIt log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245121
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Found a Nasty and need help

Post by Mel Adjusted on 6th March 2009, 11:02 pm

========== FILES ==========
File/Folder C:\autorun.inf not found.
File/Folder C:\Documents and Settings\K. Albert\Desktop\dds.scr not found.

OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 03062009_150100

Mel Adjusted
Novice
Novice

Posts Posts : 17
Joined Joined : 2009-03-06
Gender Gender : Male
OS OS : WindowsXP SP3
Points Points : 28370
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Found a Nasty and need help

Post by Belahzur on 6th March 2009, 11:15 pm

Hello.
How is the machine now?


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245121
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Found a Nasty and need help

Post by Mel Adjusted on 6th March 2009, 11:33 pm

It seems to be working great.......

Mel Adjusted
Novice
Novice

Posts Posts : 17
Joined Joined : 2009-03-06
Gender Gender : Male
OS OS : WindowsXP SP3
Points Points : 28370
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Found a Nasty and need help

Post by Belahzur on 6th March 2009, 11:34 pm

Great. Smile

Lets remove the tools we have used, they can't be trusted if you don't know how to handle them.

  • Please double-click OTMoveIt3.exe to run it again.
  • Press the green CleanUp! button.
  • Press Yes cleanup process prompt.
  • It will start cleaning now, and will want to reboot after, please allow it to do so.
  • It will make a log of what it has removed, but I don't need to see the log.

====

We need to make a new restore point.

To turn off System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (or the Turn off System Restore on all drives check box), and then click OK.
4. Click Yes when you receive the prompt to the turn off System Restore.

Now we need to make a new restore point.
To turn on System Restore, follow these steps:
1. Click Start, right-click My Computer, and then click Properties.
2. Click the System Restore tab.
3. Click the Turn off System Restore check box (To turn on System Restore), and then click OK.

Below I have included a number of recommendations for how to protect your computer in order to prevent future malware infections. Please take these recommendations seriously; these few simple steps can stave off the vast majority of spyware problems. As happy as we are to help you, for your sake we would rather not have repeat customers. Goofy

1) Please navigate to [You must be registered and logged in to see this link.] and download all the "critical updates" for Windows. This can patch many of the security holes through which attackers can gain access to your computer.

Please either enable Automatic Updates under Start -> Control Panel -> Automatic Updates , or get into the habit of checking for Windows updates regularly. I cannot stress enough how important this is.

2) In order to protect yourself against spyware, you should consider installing and running the following free programs:

[You must be registered and logged in to see this link.]
A tutorial on using Spybot to remove spyware from your computer may be found [You must be registered and logged in to see this link.]. Please also remember to enable Spybot's "Immunize" and "TeaTimer" features.

[You must be registered and logged in to see this link.]
A tutorial on using SpywareBlaster to prevent spyware from ever installing on your computer may be found [You must be registered and logged in to see this link.].

[You must be registered and logged in to see this link.]
A tutorial on using SpywareGuard for realtime protection against spyware and hijackers may be found [You must be registered and logged in to see this link.].

Make sure to keep these programs up-to-date and to run them regularly, as this can prevent a great deal of spyware hassle.

3) Please consider using an alternate browser. Mozilla's Firefox browser is fantastic; it is much more secure than Internet Explorer, immune to almost all known browser hijackers, and also has the best built-in popup blocker (as an added benefit!) that I have ever seen. If you are interested, Firefox may be downloaded from here:
[You must be registered and logged in to see this link.]
I also recommand the following add-ons for Firefox, they will help keep you safe from malicious scripts or activeX exploits.
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]
[You must be registered and logged in to see this link.]

4) Also make sure to run your antivirus software regularly, and to keep it up-to-date.

To help you keep your software updated, please considering using this free software program that will check for program updates.
[You must be registered and logged in to see this link.]

5) Finally, consider maintaining a firewall. Some good free firewalls are [You must be registered and logged in to see this link.], or
[You must be registered and logged in to see this link.]
A tutorial on understanding and using firewalls may be found [You must be registered and logged in to see this link.].

Please also read Tony Klein's excellent article: [You must be registered and logged in to see this link.]

If you would take a moment to fill out our feedback form, we would appreciate it.
The link can be found [You must be registered and logged in to see this link.].

Hopefully this should take care of your problems! Good luck. Big Grin


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245121
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Found a Nasty and need help

Post by Mel Adjusted on 7th March 2009, 12:09 am

I know exactly how I got infected, We were at the races and a friend loaned me a memory stick with some cool music and kaa=boom..

Mel Adjusted
Novice
Novice

Posts Posts : 17
Joined Joined : 2009-03-06
Gender Gender : Male
OS OS : WindowsXP SP3
Points Points : 28370
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Found a Nasty and need help

Post by Belahzur on 7th March 2009, 12:10 am

Protect yourself from autorun worms.
Turn off autoplay, this will do it all for you.

Please download Flash_Disinfector from [You must be registered and logged in to see this link.]

  • First, download it to your desktop.
  • Now double click it to run it and will tell it you what to do when you open it.
  • It will temporarily kill explorer.exe and your desktop will go blank.
  • Let Flash_Disinfector do it's job and it will restart explorer.exe for you.
  • It will make a dummy autorun.inf in the root of every drive.
  • You can now delete Flash_Disinfector.exe.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245121
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Found a Nasty and need help

Post by Mel Adjusted on 7th March 2009, 6:41 am

Belahzur, I tried to download Flash_Disinfector and the link is/was broken. Then I Googled Flash_Disinfector and found the same problem. Some other forums also are talking about the link being broken...
Anyways I'll be racing this weekend and will get back to you Monday AM...

Thanks Much,

Mel Adjusted

Mel Adjusted
Novice
Novice

Posts Posts : 17
Joined Joined : 2009-03-06
Gender Gender : Male
OS OS : WindowsXP SP3
Points Points : 28370
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Found a Nasty and need help

Post by Mel Adjusted on 8th March 2009, 2:21 am

I got up this morning and run the computer before installing it in the car and Malwarebytes found the following again...

Registry Data Items Infected:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Folder\Hidden\SHOWALL\CheckedValue (Hijack.System.Hidden)
-> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\olhrwef.exe (Trojan.Agent) -> Quarantined and deleted successfully.

Mel Adjusted
Novice
Novice

Posts Posts : 17
Joined Joined : 2009-03-06
Gender Gender : Male
OS OS : WindowsXP SP3
Points Points : 28370
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Found a Nasty and need help

Post by Belahzur on 8th March 2009, 2:25 am

Please go back here and download DDS again and run it.
[You must be registered and logged in to see this link.]

Post the new DDS log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245121
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Found a Nasty and need help

Post by Mel Adjusted on 8th March 2009, 3:18 am

DDS (Ver_09-02-01.01) - NTFSx86
Run by K. Albert at 19:16:28.34 on Sat 03/07/2009
Internet Explorer: 7.0.5730.13 BrowserJavaVersion: 1.6.0_12
Microsoft Windows XP Professional 5.1.2600.3.1252.1.1033.18.2037.1279 [GMT -8:00]

AV: COMODO Antivirus *On-access scanning enabled* (Updated)
FW: COMODO Firewall *enabled*

============== Running Processes ===============

C:\WINDOWS\system32\svchost -k DcomLaunch
C:\WINDOWS\system32\svchost -k rpcss
C:\Program Files\Comodo\COMODO Internet Security\cmdagent.exe
C:\WINDOWS\system32\svchost.exe -k netsvcs
C:\WINDOWS\system32\svchost.exe -k NetworkService
C:\WINDOWS\system32\svchost.exe -k LocalService
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Comodo\CBOClean\BOC427.exe
C:\Program Files\Spyware Terminator\SpywareTerminatorShield.exe
C:\WINDOWS\tsnpstd3.exe
C:\WINDOWS\vsnpstd3.exe
C:\WINDOWS\tppaldr.exe
C:\WINDOWS\system32\igfxpers.exe
C:\Program Files\Babylon\Babylon-Pro\Babylon.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Program Files\Comodo\COMODO Internet Security\cfp.exe
C:\Program Files\Lavasoft\Ad-Aware\AAWTray.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Windows Live\Messenger\msnmsgr.exe
C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Google\Update\GoogleUpdate.exe
C:\Program Files\Comodo\CBOClean\BOCORE.exe
C:\Program Files\Bonjour\mDNSResponder.exe
d:\Program Files\Spotmau WinCare 2008\sub\FSDRIVER\FolderProtectService.exe
C:\Program Files\Raxco\PerfectDisk2008\PD91Agent.exe
C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
C:\Program Files\Spyware Terminator\sp_rsser.exe
C:\WINDOWS\system32\svchost.exe -k imgsvc
C:\WINDOWS\System32\TUProgSt.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\Program Files\Webroot\Washer\WasherSvc.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\Program Files\Windows Live\Contacts\wlcomm.exe
C:\Program Files\Skype\Phone\Skype.exe
C:\Program Files\Skype\Plugin Manager\skypePM.exe
D:\Program Files\FrostWire\FrostWire.exe
C:\Program Files\MSN\MSNCoreFiles\msn.exe
C:\Program Files\Mozilla Firefox 3.1 Beta 2\firefox.exe
C:\Documents and Settings\K. Albert\Desktop\dds.scr
C:\WINDOWS\system32\wbem\wmiprvse.exe

============== Pseudo HJT Report ===============

uSearch Page = [You must be registered and logged in to see this link.]
uSearch Bar = [You must be registered and logged in to see this link.]
uInternet Settings,ProxyOverride = *.local
mSearchAssistant = [You must be registered and logged in to see this link.]
uURLSearchHooks: myBabylon English Toolbar: {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - c:\program files\mybabylon_english\tbmyB0.dll
uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn\yt.dll
BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
BHO: Spybot-S&D IE Protection: {53707962-6f74-2d53-2644-206d7942484f} - c:\progra~1\spybot~1\SDHelper.dll
BHO: EWPBrowseObject Class: {68f9551e-0411-48e4-9aaf-4bc42a6a46be} - c:\program files\canon\easy-webprint\EWPBrowseLoader.dll
BHO: Search Helper: {6ebf7485-159f-4bff-a14f-b9e3aac4465b} - c:\program files\microsoft\search enhancement pack\search helper\SearchHelper.dll
BHO: SSVHelper Class: {761497bb-d6f0-462c-b6eb-d4daf1d92d43} - c:\program files\java\jre6\bin\ssv.dll
BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
BHO: Google Toolbar Helper: {aa58ed58-01dd-4d91-8333-cf10577473f7} - c:\program files\google\google toolbar\GoogleToolbar.dll
BHO: Google Toolbar Notifier BHO: {af69de43-7d58-4638-b6fa-ce66b5ad205d} - c:\program files\google\googletoolbarnotifier\5.0.926.3450\swg.dll
BHO: myBabylon English Toolbar: {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - c:\program files\mybabylon_english\tbmyB0.dll
BHO: Windows Live Toolbar Helper: {e15a8dc0-8516-42a1-81ea-dc94ec1acf10} - c:\program files\windows live\toolbar\wltcore.dll
BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
TB: Easy-WebPrint: {327c2873-e90d-4c37-aa9d-10ac9baba46c} - c:\program files\canon\easy-webprint\Toolband.dll
TB: myBabylon English Toolbar: {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7} - c:\program files\mybabylon_english\tbmyB0.dll
TB: &Windows Live Toolbar: {21fa44ef-376d-4d53-9b0f-8a89d3229068} - c:\program files\windows live\toolbar\wltcore.dll
TB: &Google Toolbar: {2318c2b1-4965-11d4-9b18-009027a5cd4f} - c:\program files\google\google toolbar\GoogleToolbar.dll
uRun: [MsnMsgr] "c:\program files\windows live\messenger\msnmsgr.exe" /background
uRun: [FreeRAM XP] "c:\program files\yourware solutions\freeram xp pro\FreeRAM XP Pro.exe" -win
uRun: [SpybotSD TeaTimer] c:\program files\spybot - search & destroy\TeaTimer.exe
uRun: [ctfmon.exe] c:\windows\system32\ctfmon.exe
uRun: [swg] c:\program files\google\googletoolbarnotifier\GoogleToolbarNotifier.exe
mRun: [BOC-427] c:\progra~1\comodo\cboclean\BOC427.exe
mRun: [SpywareTerminator] "c:\program files\spyware terminator\SpywareTerminatorShield.exe"
mRun: [tsnpstd3] c:\windows\tsnpstd3.exe
mRun: [snpstd3] c:\windows\vsnpstd3.exe
mRun: [TPP Auto Loader] c:\windows\tppaldr.exe
mRun: []
mRun: [IgfxTray] c:\windows\system32\igfxtray.exe
mRun: [Persistence] c:\windows\system32\igfxpers.exe
mRun: [Babylon Client] c:\program files\babylon\babylon-pro\Babylon.exe -AutoStart
mRun: [COMODO Internet Security] "c:\program files\comodo\comodo internet security\cfp.exe" -h
mRun: [Ad-Watch] c:\program files\lavasoft\ad-aware\AAWTray.exe
mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe"
IE: Easy-WebPrint Add To Print List - c:\program files\canon\easy-webprint\Toolband.dll/RC_AddToList.html
IE: Easy-WebPrint High Speed Print - c:\program files\canon\easy-webprint\Toolband.dll/RC_HSPrint.html
IE: Easy-WebPrint Preview - c:\program files\canon\easy-webprint\Toolband.dll/RC_Preview.html
IE: Easy-WebPrint Print - c:\program files\canon\easy-webprint\Toolband.dll/RC_Print.html
IE: Translate with &Babylon - c:\program files\babylon\babylon-pro\utils\BabylonIEPI.dll/Translate.htm
IE: {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe
IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
IE: {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBC} - c:\program files\java\jre6\bin\ssv.dll
IE: {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - {53707962-6F74-2D53-2644-206D7942484F} - c:\progra~1\spybot~1\SDHelper.dll
DPF: {0E5F0222-96B9-11D3-8997-00104BD12D94} - [You must be registered and logged in to see this link.]
DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} - [You must be registered and logged in to see this link.]
DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} - [You must be registered and logged in to see this link.]
DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - [You must be registered and logged in to see this link.]
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - [You must be registered and logged in to see this link.]
DPF: {8FFBE65D-2C9C-4669-84BD-5829DC0B603C} - [You must be registered and logged in to see this link.]
DPF: {CAFEEFAC-0016-0000-0012-ABCDEFFEDCBA} - [You must be registered and logged in to see this link.]
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - [You must be registered and logged in to see this link.]
DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} - [You must be registered and logged in to see this link.]
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
Notify: igfxcui - igfxdev.dll

Mel Adjusted
Novice
Novice

Posts Posts : 17
Joined Joined : 2009-03-06
Gender Gender : Male
OS OS : WindowsXP SP3
Points Points : 28370
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Found a Nasty and need help

Post by Mel Adjusted on 8th March 2009, 3:19 am

================= FIREFOX ===================

FF - ProfilePath - c:\docume~1\kc8a4~1.alb\applic~1\mozilla\firefox\profiles\hcpgmaki.default\
FF - prefs.js: browser.search.selectedEngine - Ixquick
FF - prefs.js: browser.startup.homepage - [You must be registered and logged in to see this link.]
FF - plugin: c:\program files\google\google updater\2.4.1487.6512\npCIDetect13.dll
FF - plugin: c:\program files\google\update\1.2.141.5\npGoogleOneClick7.dll
FF - plugin: c:\program files\windows live\photo gallery\NPWLPG.dll
FF - plugin: d:\program files\quicktime\plugins\npqtplugin.dll
FF - plugin: d:\program files\quicktime\plugins\npqtplugin2.dll
FF - plugin: d:\program files\quicktime\plugins\npqtplugin3.dll
FF - plugin: d:\program files\quicktime\plugins\npqtplugin4.dll
FF - plugin: d:\program files\quicktime\plugins\npqtplugin5.dll
FF - plugin: d:\program files\quicktime\plugins\npqtplugin6.dll
FF - plugin: d:\program files\quicktime\plugins\npqtplugin7.dll

---- FIREFOX POLICIES ----
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
c:\program files\mozilla firefox 3.1 beta 2\defaults\pref\firefox.js - pref("extensions.blocklist.level", 2);
c:\program files\mozilla firefox 3.1 beta 2\defaults\pref\firefox.js - pref("browser.ssl_override_behavior", 2);
c:\program files\mozilla firefox 3.1 beta 2\defaults\pref\firefox.js - pref("security.alternate_certificate_error_page", "certerror");
c:\program files\mozilla firefox 3.1 beta 2\defaults\pref\firefox.js - pref("browser.privatebrowsing.autostart", false);
c:\program files\mozilla firefox 3.1 beta 2\defaults\pref\firefox.js - pref("browser.privatebrowsing.dont_prompt_on_enter", false);

============= SERVICES / DRIVERS ===============

R0 Lbd;Lbd;c:\windows\system32\drivers\Lbd.sys [2009-3-1 64160]
R1 cmdGuard;COMODO Internet Security Sandbox Driver;c:\windows\system32\drivers\cmdguard.sys [2008-12-30 110992]
R1 cmdHlp;COMODO Internet Security Helper Driver;c:\windows\system32\drivers\cmdhlp.sys [2008-12-30 24336]
R1 sp_rsdrv2;Spyware Terminator Driver 2;c:\windows\system32\drivers\sp_rsdrv2.sys [2008-12-30 142592]
R2 BOCore;BOCore;c:\program files\comodo\cboclean\BOCore.exe [2008-12-30 73464]
R2 cmdAgent;COMODO Internet Security Helper Service;c:\program files\comodo\comodo internet security\cmdagent.exe [2008-12-30 700152]
R2 FolderProtectService;FolderProtectService;d:\program files\spotmau wincare 2008\sub\fsdriver\FolderProtectService.exe [2009-2-3 10240]
R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service;c:\program files\lavasoft\ad-aware\AAWService.exe [2009-1-18 951120]
R2 PD91Agent;PD91Agent;c:\program files\raxco\perfectdisk2008\PD91Agent.exe [2008-1-16 664840]
R2 SeaPort;SeaPort;c:\program files\microsoft\search enhancement pack\seaport\SeaPort.exe [2009-1-14 226656]
R2 TuneUp.ProgramStatisticsSvc;TuneUp Program Statistics Service;c:\windows\system32\TUProgSt.exe [2009-1-2 603904]
R2 wwEngineSvc;Window Washer Engine;c:\program files\webroot\washer\WasherSvc.exe [2008-12-31 598856]
S1 FolderProtectDriver;FolderProtectDriver;d:\program files\spotmau wincare 2008\sub\fsdriver\FolderProtectDriver.sys [2009-2-3 15616]
S2 gupdate1c985d829e7373e;Google Update Service (gupdate1c985d829e7373e);c:\program files\google\update\GoogleUpdate.exe [2009-2-3 133104]
S3 Ambfilt;Ambfilt;c:\windows\system32\drivers\Ambfilt.sys [2009-1-4 1684736]
S3 epmntdrv;epmntdrv;c:\windows\system32\epmntdrv.sys [2009-1-25 8704]
S3 EuGdiDrv;EuGdiDrv;c:\windows\system32\EuGdiDrv.sys [2009-1-25 3072]
S3 FXDrv32;FXDrv32;\??\e:\fxdrv32.sys --> e:\FXDrv32.sys [?]
S3 getPlus(R) Helper;getPlus(R) Helper;c:\program files\nos\bin\getPlus_HelperSvc.exe [2009-1-1 33752]
S3 PD91Engine;PD91Engine;c:\program files\raxco\perfectdisk2008\PD91Engine.exe [2008-1-16 894216]
S3 TPP300;USB Storage Adapter V3 (TPP);c:\windows\system32\drivers\TPP300.SYS [2002-6-23 35584]

============== File Associations ===============

txtfile=c:\windows\NOTEPAD.EXE %1

=============== Created Last 30 ================

2009-03-07 18:33 --d----- c:\program files\common files\PC Tools
2009-03-07 18:33 --d----- c:\program files\Spyware Doctor
2009-03-07 17:39 --d----- c:\docume~1\kc8a4~1.alb\applic~1\FrostWire
2009-03-07 16:12 72 ---shr-- C:\autorun.inf
2009-03-07 15:14 --d----- c:\docume~1\kc8a4~1.alb\applic~1\LimeWire
2009-03-07 15:14 --d----- c:\program files\LimeWire
2009-03-07 10:17 --d----- c:\program files\SupervisionCam
2009-03-07 02:38 94,720 ---shr-- c:\windows\system32\nmdfgds1.dll
2009-03-07 02:38 94,720 ---shr-- c:\windows\system32\nmdfgds0.dll
2009-03-06 10:24 --d----- c:\docume~1\kc8a4~1.alb\applic~1\Malwarebytes
2009-03-06 10:24 15,504 a------- c:\windows\system32\drivers\mbam.sys
2009-03-06 10:24 38,496 a------- c:\windows\system32\drivers\mbamswissarmy.sys
2009-03-06 10:24 --d----- c:\program files\Malwarebytes' Anti-Malware
2009-03-06 10:24 --d----- c:\docume~1\alluse~1\applic~1\Malwarebytes
2009-03-06 03:16 73,728 a------- c:\windows\system32\javacpl.cpl
2009-03-05 19:12 --d----- c:\program files\Yahoo!
2009-03-05 18:17 --d----- c:\docume~1\kc8a4~1.alb\applic~1\GetRightToGo
2009-03-05 17:53 0 a------- C:\broadcast.tmp
2009-03-04 18:56 --d----- c:\documents and settings\k. albert\Saved Games
2009-03-04 18:56 --d----- c:\docume~1\kc8a4~1.alb\applic~1\Flood Light Games
2009-03-04 18:56 --d----- c:\docume~1\alluse~1\applic~1\Flood Light Games
2009-03-04 15:53 --d----- c:\program files\Identity Finder
2009-03-04 15:31 --d----- c:\windows\ZipItFree
2009-03-02 10:20 --d----- c:\docume~1\kc8a4~1.alb\applic~1\WebcamZoneTrigger
2009-03-01 14:35 15,688 a------- c:\windows\system32\lsdelete.exe
2009-03-01 00:51 64,160 a------- c:\windows\system32\drivers\Lbd.sys
2009-03-01 00:47 -cd-h--- c:\docume~1\alluse~1\applic~1\{83C91755-2546-441D-AC40-9A6B4B860800}
2009-03-01 00:47 --d----- c:\program files\Lavasoft
2009-02-26 19:18 24,468 a---h--- c:\windows\system32\mlfcache.dat
2009-02-26 19:17 --d----- c:\program files\Bonjour
2009-02-26 00:14 --d----- c:\docume~1\kc8a4~1.alb\applic~1\Systweak
2009-02-26 00:12 --d----- c:\program files\Advanced System Optimizer
2009-02-25 23:57 406 a------- c:\windows\system32\ioloBootDefrag.cfg
2009-02-25 23:40 74,703 a------- c:\windows\system32\mfc45.dll
2009-02-25 23:33 --d----- c:\docume~1\kc8a4~1.alb\applic~1\iolo
2009-02-25 23:33 --d----- c:\docume~1\alluse~1\applic~1\iolo
2009-02-25 21:10 --d----- C:\JUNK
2009-02-25 20:21 68,624 a----r-- c:\windows\system32\drivers\DefragFS.sys
2009-02-25 20:19 --d----- c:\program files\Raxco
2009-02-24 21:30 20 a------- c:\windows\mafosav.INI
2009-02-21 22:51 344,064 a------- c:\windows\system32\msvcr70.dll
2009-02-21 22:51 --d----- c:\program files\common files\DVDVideoSoft
2009-02-18 17:46 95 a------- c:\windows\wininit.ini
2009-02-18 08:30 71 a------- c:\windows\RmFile.ini
2009-02-18 08:30 53,728 a------- c:\windows\rmfile.exe
2009-02-18 08:30 43,664 a------- c:\windows\addrun.exe
2009-02-18 08:30 890 a------- c:\windows\Win.Fa
2009-02-18 08:30 231 a------- c:\windows\System.Fa
2009-02-18 08:26 27,632 a------- c:\windows\system\Ctl3DV2.Dll
2009-02-18 08:19 --d----- c:\program files\Microsoft SQL Server Compact Edition
2009-02-17 22:39 12,160 ac------ c:\windows\system32\dllcache\mouhid.sys
2009-02-17 22:39 12,160 a------- c:\windows\system32\drivers\mouhid.sys
2009-02-17 16:53 30,208 -------- c:\windows\system32\WNASPI32.DLL
2009-02-17 16:53 4,030 -------- c:\windows\system\WINASPI.DLL
2009-02-17 16:53 291 a------- c:\windows\msfsetup.ini
2009-02-17 16:53 8,096 -------- c:\windows\system32\drivers\MASPINT.SYS
2009-02-17 16:53 2,486 -------- c:\windows\system\AS16POST.BIN
2009-02-17 16:48 155,648 a------- c:\windows\system32\FFRAFLIB.DLL
2009-02-17 16:48 274,432 a------- c:\windows\system32\FFTIFF16.dll
2009-02-17 16:47 81,924 -------- c:\windows\system32\drivers\VC4CB104.SYS
2009-02-17 16:47 --d----- c:\program files\REGSHAVE
2009-02-17 16:47 65,536 -------- c:\windows\system32\FINFCHECK.dll
2009-02-17 16:47 45,056 -------- c:\windows\system32\FINFCOPY.dll
2009-02-17 16:47 69,632 -------- c:\windows\system32\FREGSHEX.DLL
2009-02-17 16:47 45,056 -------- c:\windows\system32\FCLKBTN.DLL
2009-02-15 09:39 --d----- c:\docume~1\kc8a4~1.alb\applic~1\Geometric
2009-02-15 09:37 3,426,072 a------- c:\windows\system32\d3dx9_32.dll
2009-02-14 17:35 53,248 a------- c:\windows\system32\CSVer.dll
2009-02-14 17:35 290,816 a------- c:\windows\vncutil.exe
2009-02-14 17:35 104,992 a------- c:\windows\RtkAudioService.exe
2009-02-14 17:02 1,686,016 a------- c:\windows\system32\clinetsuitex6.ocx
2009-02-14 17:02 662,288 a------- c:\windows\system32\MSCOMCT2.OCX
2009-02-14 17:02 427,864 a------- c:\windows\system32\XceedZip.dll
2009-02-12 23:15 --d----- c:\docume~1\kc8a4~1.alb\applic~1\Auslogics
2009-02-12 20:23 --d----- c:\program files\Ascentive
2009-02-11 15:20 459,264 -c------ c:\windows\system32\dllcache\msfeeds.dll
2009-02-11 15:20 267,776 -c------ c:\windows\system32\dllcache\iertutil.dll
2009-02-11 15:20 52,224 -c------ c:\windows\system32\dllcache\msfeedsbs.dll
2009-02-11 15:20 383,488 -c------ c:\windows\system32\dllcache\ieapfltr.dll
2009-02-11 15:20 63,488 -c------ c:\windows\system32\dllcache\icardie.dll
2009-02-11 15:20 13,824 -c------ c:\windows\system32\dllcache\ieudinit.exe
2009-02-11 15:20 2,455,488 -c------ c:\windows\system32\dllcache\ieapfltr.dat
2009-02-11 15:20 991,232 -c------ c:\windows\system32\dllcache\ieframe.dll.mui
2009-02-11 15:20 6,066,688 -c------ c:\windows\system32\dllcache\ieframe.dll
2009-02-10 19:38 --d----- c:\docume~1\kc8a4~1.alb\applic~1\PCF-VLC
2009-02-10 12:24 --d-h--- c:\program files\Zero G Registry
2009-02-10 12:21 --d-h--- c:\documents and settings\k. albert\InstallAnywhere
2009-02-10 00:03 --d----- c:\windows\vbSkinner
2009-02-09 05:35 --d----- c:\windows\SHELLNEW
2009-02-09 05:05 --d----- c:\docume~1\kc8a4~1.alb\applic~1\Mathsoft
2009-02-09 02:12 334,792 a------- c:\windows\system32\_AxShlEx.dll
2009-02-09 02:10 --d----- c:\program files\Alcohol Soft
2009-02-06 19:03 307,576 a------- c:\windows\WLXPGSS.SCR
2009-02-06 18:52 49,504 a------- c:\windows\system32\sirenacm.dll

==================== Find3M ====================

2009-03-06 03:17 410,984 a------- c:\windows\system32\deploytk.dll
2009-02-26 22:11 155,384 a------- c:\windows\system32\guard32.dll
2009-02-26 22:11 110,992 a------- c:\windows\system32\drivers\cmdguard.sys
2009-02-20 10:01 24,336 a------- c:\windows\system32\drivers\cmdhlp.sys
2009-02-05 01:25 700,928 ----h--- c:\windows\system32\wodfamoh.dll
2009-02-03 17:32 18,085,888 a------- c:\windows\RTHDCPL.EXE
2009-02-03 17:22 5,030,912 a------- c:\windows\system32\drivers\RtkHDAud.sys
2009-02-03 16:35 35,840 a------- c:\windows\system32\RtkCoInstXP.dll
2009-01-30 18:27 717,296 a------- c:\windows\system32\drivers\sptd.sys
2009-01-26 16:06 98,304 a------- c:\windows\system32\CmdLineExt.dll
2009-01-21 15:54 1,206,816 a------- c:\windows\RtlUpd.exe
2009-01-06 03:33 86,327 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
2009-01-02 22:53 603,904 a------- c:\windows\system32\TUProgSt.exe
2009-01-01 15:09 12,325 a------- c:\windows\system32\SpoonUninstall-Jardinains!.dat
2009-01-01 15:09 164,352 a------- c:\windows\system32\SpoonUninstall.exe
2008-12-30 18:29 21,640 a------- c:\windows\system32\emptyregdb.dat
2008-12-20 15:15 826,368 a------- c:\windows\system32\wininet.dll
2008-12-12 11:18 87,336 a------- c:\windows\system32\dns-sd.exe
2008-12-12 11:11 61,440 a------- c:\windows\system32\dnssd.dll

============= FINISH: 19:17:39.87 ===============

Mel Adjusted
Novice
Novice

Posts Posts : 17
Joined Joined : 2009-03-06
Gender Gender : Male
OS OS : WindowsXP SP3
Points Points : 28370
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Found a Nasty and need help

Post by Belahzur on 8th March 2009, 3:10 pm

I'm not suprised it came back, Limewire and frostwire are installed. You will ALWAYS get infected using P2P. Stay away from P2P.


Please download the [You must be registered and logged in to see this link.].

  • Save it to your desktop.
  • Please double-click OTMoveIt3.exe to run it.
  • Copy the bolded text below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose CopyCrying


    :files
    C:\autorun.inf
    c:\windows\system32\nmdfgds1.dll
    c:\windows\system32\nmdfgds0.dll
    c:\docume~1\kc8a4~1.alb\applic~1\FrostWire
    c:\docume~1\kc8a4~1.alb\applic~1\LimeWire
    c:\program files\LimeWire


  • Return to OTMoveIt3, right click in the "Paste instructions for items to be Moved" window (under the light blue bar) and choose Paste.
  • Click the red Moveit! button.
  • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
  • Close OTMoveIt3
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.

Please post the OTMoveIt log.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245121
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Found a Nasty and need help

Post by Mel Adjusted on 8th March 2009, 5:00 pm

========== FILES ==========
C:\autorun.inf moved successfully.
File/Folder c:\windows\system32\nmdfgds1.dll not found.
File/Folder c:\windows\system32\nmdfgds0.dll not found.
c:\docume~1\kc8a4~1.alb\applic~1\FrostWire\xml\data moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\FrostWire\xml moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\FrostWire\themes\frostwirePro_theme moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\FrostWire\themes moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\FrostWire\.NetworkShare\Incomplete moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\FrostWire\.NetworkShare moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\FrostWire\.AppSpecialShare moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\FrostWire moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\xml\data moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\xml moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\promotion moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\mozilla-profile\updates\0 moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\mozilla-profile\updates moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\mozilla-profile\extensions moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\mozilla-profile\Cache moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\mozilla-profile moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser\xulrunner\res\html moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser\xulrunner\res\fonts moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser\xulrunner\res\entityTables moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser\xulrunner\res\dtd moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser\xulrunner\res moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser\xulrunner\plugins moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser\xulrunner\modules moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser\xulrunner\greprefs moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser\xulrunner\dictionaries moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser\xulrunner\defaults\profile\US\chrome moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser\xulrunner\defaults\profile\US moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser\xulrunner\defaults\profile\chrome moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser\xulrunner\defaults\profile moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser\xulrunner\defaults\pref moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser\xulrunner\defaults\autoconfig moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser\xulrunner\defaults moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser\xulrunner\components moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser\xulrunner\chrome moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser\xulrunner moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\browser moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire\.AppSpecialShare moved successfully.
c:\docume~1\kc8a4~1.alb\applic~1\LimeWire moved successfully.
c:\program files\LimeWire\lib moved successfully.
c:\program files\LimeWire moved successfully.

OTMoveIt3 by OldTimer - Version 1.0.8.0 log created on 03082009_095952

Mel Adjusted
Novice
Novice

Posts Posts : 17
Joined Joined : 2009-03-06
Gender Gender : Male
OS OS : WindowsXP SP3
Points Points : 28370
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Found a Nasty and need help

Post by Belahzur on 8th March 2009, 5:02 pm

It should be okay now.


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245121
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Found a Nasty and need help

Post by Mel Adjusted on 8th March 2009, 5:12 pm

I hope so were at the races right now and I need this computer to hatch whats going on in the car.... I'll keep a eye on it...

Mel Adjusted
Novice
Novice

Posts Posts : 17
Joined Joined : 2009-03-06
Gender Gender : Male
OS OS : WindowsXP SP3
Points Points : 28370
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Found a Nasty and need help

Post by Mel Adjusted on 8th March 2009, 6:18 pm

We just got a break and I run Spybot S & D and got the following:

ABetterInternet
Bestsearch.Scvlost
XPPreload
TNS-Search
Smitfraud.C
Sgrunt
MediaMotor
CoolWWWSearch
CoolWWWSearch.Goolems
CoolWWWSearch.BadZoneMap

Mel Adjusted
Novice
Novice

Posts Posts : 17
Joined Joined : 2009-03-06
Gender Gender : Male
OS OS : WindowsXP SP3
Points Points : 28370
# Likes # Likes : 0

View user profile

Back to top Go down

Re: Found a Nasty and need help

Post by Belahzur on 8th March 2009, 7:23 pm

Does Spybot say where it found them? They could be OTMoveIt backups.

Delete this folder in bold.
C:\_OTMoveIt


[You must be registered and logged in to see this link.] - [You must be registered and logged in to see this link.] - Please PM me if I fail to respond within 24hrs.


Belahzur
Administrator
Administrator

Posts Posts : 34918
Joined Joined : 2008-08-03
Gender Gender : Male
OS OS : 7 Home Premium x64
Points Points : 245121
# Likes # Likes : 1

View user profile

Back to top Go down

Re: Found a Nasty and need help

Post by Mel Adjusted on 9th March 2009, 9:35 am

I removed C:\_OTMoveIt...Yesterday and this morning I checked my system and everything is clean...
You did a execrably job...Thank you very much

From the Mel Adjusted Racing Team and K. Albert, Thank you very much

Mel Adjusted
Novice
Novice

Posts Posts : 17
Joined Joined : 2009-03-06
Gender Gender : Male
OS OS : WindowsXP SP3
Points Points : 28370
# Likes # Likes : 0

View user profile

Back to top Go down

View previous topic View next topic Back to top

- Similar topics

 
Permissions in this forum:
You cannot reply to topics in this forum