|
| ||
| New Win32 Virus McAfee just informed me that I have the New Win32 Virus, can someone help me remove it? I ran HijackThis and here's the log: Logfile of HijackThis v1.99.1 Scan saved at 10:32:39 AM, on 5/7/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\WLTRYSVC.EXE C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\ehome\ehtray.exe C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe C:\WINDOWS\system32\WLTRAY.exe C:\WINDOWS\stsystra.exe C:\Program Files\Dell\QuickSet\quickset.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\McAfee\MSK\MskAgent.exe C:\Program Files\SiteAdvisor\6066\SiteAdv.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe C:\Program Files\DellSupport\DSAgnt.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\program files\common files\mcafee\mna\mcnasvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe C:\PROGRA~1\McAfee\MSC\mcpromgr.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\McAfee\MPF\MPFSrv.exe C:\PROGRA~1\McAfee\MPS\mps.exe C:\Program Files\McAfee\MSK\MskSrver.exe C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe C:\Program Files\SiteAdvisor\6066\SAService.exe C:\Program Files\McAfee\MPS\mpsevh.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\system32\imapi.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\WINDOWS\eHome\ehmsas.exe C:\WINDOWS\system32\dllhost.exe C:\WINDOWS\system32\taskmgr.exe c:\program files\aim6\anotify.exe C:\DOCUME~1\Allison\LOCALS~1\Temp\Temporary Directory 1 for Hijack This.zip\HijackThis.exe c:\dell\E-center\gtb.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://login.live.com/login.srf?id=2...lang=EN&vv=400 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\Program Files\BAE\BAE.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [ShowLOMControl] O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [ECenter] "c:\dell\E-Center\gtb.exe" O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6066\SiteAdv.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup O4 - HKCU\..\Run: [Firewall auto setup] C:\DOCUME~1\Allison\LOCALS~1\Temp\winlogon.exe O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: Picture Package Menu.lnk = ? O4 - Global Startup: Picture Package VCD Maker.lnk = ? O4 - Global Startup: Remote Backup.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by120fd.bay120.hotmail.msn.co...s/MsnPUpld.cab O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/...toUploader.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramewor...o.cab53083.cab O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Program Files\SiteAdvisor\6066\SAService.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE Thank you!! |
| ||
| Re: New Win32 Virus No one can help me fix this? It is giving me errors left and right and will not let me open programs sometimes. |
| ||
| Re: New Win32 Virus Heya, sleepy, would you do these things for me, please? First off, hijackthis is running from an unsafe [for your sys] location. Please delete it and dl a new copy: ==download hijackthis: http://216.180.233.162/~merijn/files/HijackThis.exe -install it to a new folder alongside your program files and then rename the Hijackthis.exe to imabunny.exe. -in that folder start HijackThis by dclicking the .exe; next press the Open Misc Tools button and then the Generate Startup List log, and yes. Post that log. ==Get CCleaner from http://www.ccleaner.com/ - and put it in a new folder. You should aim to keep this one for general use. I set it from the install checkboxes to only open from the recycle bin. It's neater that way. Now run Ccleaner from the recycle bin rclick menu using its default settings [if you set up CCleaner as i suggested, rclicking the bin icon should give you the Open CCleaner option...]. Select the Cleaner icon and the Windows tab; press Run Cleaner. Next select the Applications tab and Run Cleaner again. ==Please do an online scan at panda:- http://www.pandasoftware.com/products/activescan? -select a link to the scan... free online virus scan...., enter a valid? email and follow through, choosing My Computer for a full system scan. Post the log it produces here with that startup list. |
| ||
| Re: New Win32 Virus Here's the start up List Log: StartupList report, 5/11/2007, 8:32:06 AM StartupList version: 1.52.2 Started from : C:\Program Files\HiijackThis\imabunny.EXE Detected: Windows XP SP2 (WinNT 5.01.2600) Detected: Internet Explorer v6.00 SP2 (6.00.2900.2180) * Using default options ================================================== Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\WLTRYSVC.EXE C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\Explorer.EXE C:\WINDOWS\ehome\ehtray.exe C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe C:\WINDOWS\system32\WLTRAY.exe C:\WINDOWS\stsystra.exe C:\Program Files\Dell\QuickSet\quickset.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\McAfee\MSK\MskAgent.exe C:\Program Files\SiteAdvisor\6066\SiteAdv.exe C:\Program Files\QuickTime\qttask.exe C:\WINDOWS\system32\igfxsrvc.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\AIM6\aim6.exe C:\Program Files\DellSupport\DSAgnt.exe C:\Program Files\AIM6\aolsoftware.exe C:\Program Files\Digital Line Detect\DLG.exe C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\program files\common files\mcafee\mna\mcnasvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe C:\PROGRA~1\McAfee\MSC\mcpromgr.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\McAfee\MPF\MPFSrv.exe C:\PROGRA~1\McAfee\MPS\mps.exe C:\Program Files\McAfee\MSK\MskSrver.exe C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe C:\Program Files\SiteAdvisor\6066\SAService.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\McAfee\MPS\mpsevh.exe C:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\Program Files\iPod\bin\iPodService.exe C:\WINDOWS\eHome\ehmsas.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE c:\program files\aim6\anotify.exe c:\dell\E-center\gtb2.exe C:\Program Files\HiijackThis\imabunny.exe -------------------------------------------------- Listing of startup folders: Shell folders Common Startup: [C:\Documents and Settings\All Users\Start Menu\Programs\Startup] Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe Digital Line Detect.lnk = ? Picture Package Menu.lnk = ? Picture Package VCD Maker.lnk = ? -------------------------------------------------- Checking Windows NT UserInit: [HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon] UserInit = C:\WINDOWS\system32\userinit.exe, -------------------------------------------------- Autorun entries from Registry: HKLM\Software\Microsoft\Windows\CurrentVersion\Run ehTray = C:\WINDOWS\ehome\ehtray.exe SunJavaUpdateSched = C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe Broadcom Wireless Manager UI = C:\WINDOWS\system32\WLTRAY.exe SigmatelSysTrayApp = stsystra.exe Dell QuickSet = C:\Program Files\Dell\QuickSet\quickset.exe SynTPEnh = C:\Program Files\Synaptics\SynTP\SynTPEnh.exe DVDLauncher = "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" RealTray = C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER dla = C:\WINDOWS\system32\dla\tfswctrl.exe ISUSPM Startup = "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup ISUSScheduler = "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start ECenter = "c:\dell\E-Center\gtb.exe" igfxtray = C:\WINDOWS\system32\igfxtray.exe igfxhkcmd = C:\WINDOWS\system32\hkcmd.exe igfxpers = C:\WINDOWS\system32\igfxpers.exe MskAgentexe = C:\Program Files\McAfee\MSK\MskAgent.exe SiteAdvisor = C:\Program Files\SiteAdvisor\6066\SiteAdv.exe QuickTime Task = "C:\Program Files\QuickTime\qttask.exe" -atboottime iTunesHelper = "C:\Program Files\iTunes\iTunesHelper.exe" -------------------------------------------------- Autorun entries from Registry: HKCU\Software\Microsoft\Windows\CurrentVersion\Run ModemOnHold = C:\Program Files\NetWaiting\netWaiting.exe MSMSGS = "C:\Program Files\Messenger\msmsgs.exe" /background ctfmon.exe = C:\WINDOWS\system32\ctfmon.exe swg = C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe Aim6 = "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp Yahoo! Pager = "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet DellSupport = "C:\Program Files\DellSupport\DSAgnt.exe" /startup Firewall auto setup = C:\DOCUME~1\Allison\LOCALS~1\Temp\winlogon.exe -------------------------------------------------- Shell & screensaver key from C:\WINDOWS\SYSTEM.INI: Shell=*INI section not found* SCRNSAVE.EXE=*INI section not found* drivers=*INI section not found* Shell & screensaver key from Registry: Shell=Explorer.exe SCRNSAVE.EXE=C:\WINDOWS\system32\ELECTR~1.SCR drivers=*Registry value not found* Policies Shell key: HKCU\..\Policies: Shell=*Registry key not found* HKLM\..\Policies: Shell=*Registry value not found* -------------------------------------------------- Enumerating Browser Helper Objects: (no name) - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} (no name) - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll - {089FD14D-132B-48FC-8861-0048AE113215} (no name) - C:\WINDOWS\system32\dla\tfswshx.dll - {5CA3D70E-1895-11CF-8E15-001234567890} (no name) - c:\program files\mcafee\virusscan\scriptcl.dll - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} (no name) - c:\program files\google\googletoolbar3.dll - {AA58ED58-01DD-4d91-8333-CF10577473F7} (no name) - c:\Program Files\BAE\BAE.dll - {CA6319C0-31B7-401E-A518-A07C3DB8F777} -------------------------------------------------- Enumerating Task Scheduler jobs: McDefragTask.job McQcTask.job -------------------------------------------------- Enumerating Download Program Files: [YInstStarter Class] InProcServer32 = C:\Program Files\Yahoo!\Common\yinsthelper.dll CODEBASE = C:\Program Files\Yahoo!\Common\yinsthelper.dll [MSN Photo Upload Tool] InProcServer32 = C:\WINDOWS\Downloaded Program Files\MsnPUpld.dll CODEBASE = http://by120fd.bay120.hotmail.msn.co...s/MsnPUpld.cab [Facebook Photo Uploader Control] InProcServer32 = C:\WINDOWS\Downloaded Program Files\FacebookPhotoUploader.ocx CODEBASE = http://upload.facebook.com/controls/...toUploader.cab [ZoneIntro Class] InProcServer32 = C:\WINDOWS\Downloaded Program Files\ZIntro.ocx CODEBASE = http://cdn2.zone.msn.com/binFramewor...o.cab53083.cab [Shockwave Flash Object] InProcServer32 = C:\WINDOWS\system32\Macromed\Flash\Flash9b.ocx CODEBASE = http://download.macromedia.com/pub/s...sh/swflash.cab -------------------------------------------------- Enumerating ShellServiceObjectDelayLoad items: PostBootReminder: C:\WINDOWS\system32\SHELL32.dll CDBurn: C:\WINDOWS\system32\SHELL32.dll WebCheck: C:\WINDOWS\system32\webcheck.dll SysTray: C:\WINDOWS\system32\stobject.dll -------------------------------------------------- End of report, 8,919 bytes Report generated in 0.141 seconds Command line options: /verbose - to add additional info on each section /complete - to include empty sections and unsuspicious data /full - to include several rarely-important sections /force9x - to include Win9x-only startups even if running on WinNT /forcent - to include WinNT-only startups even if running on Win9x /forceall - to include all Win9x and WinNT startups, regardless of platform /history - to list version history only I'm having trouble installing CCleaner. When I go to install it somewhere, it doesn't actually download the file because I created a new folder for it in the start menu but nothing appeared. What am I doing wrong? Thanks for helping! |
| ||
| Re: New Win32 Virus Understood. Because of the file you posted we'll step back and restart with these instructions. You must be in an Administrator-privileged account to run this procedure...: ==Download Avenger from http://swandog46.geekstogo.com/avenger.zip -unzip it to your desktop, leave it for the moment. ==CCleaner: more detailed instructions - Dl the file ccsetup139.exe from filehippo to a downloads folder, dclick it and agree to everything - either let it open its own new folder or point it at a folder you created by your other pgms folder [DON'T you create folders in the start menu!! Leave installing pgms to make entries if they wish!]. The only box I left checked was the "Add Open CCleaner to Recycle bin context menu". And press Install. Should go okay... leave it for the moment. ==start HijackThis by dclicking the .exe; now close ALL other applications and any open windows including the explorer window containing HijackThis. -Select Scan Only, place checkmarks against all the entries listed below that still exist, and then press Fix Checked. R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file) O4 - HKCU\..\Run: [Firewall auto setup] C:\DOCUME~1\Allison\LOCALS~1\Temp\winlogon.exe ==start Avenger; select “Input script manually” and then click the magnifying glass icon. Paste into the box as one block all the text between the lines:- _____________________________________ Files to delete: C:\DOCUME~1\Allison\LOCALS~1\Temp\winlogon.exe _____________________________________ ...and click Done, and finally the green light. Follow promps to reboot your machine. [The files, etc., that you asked Avenger to delete are zipped to C:\avenger\backup.zip.] Avenger creates a log file that should open with the results of its actions. This file is located at C:\avenger.txt ==Now start and run CCleaner as I posted previously, and follow it with the Panda Onlinescan. Please post Avenger and Panda scan logs, plus a fresh [run last of all] hijackthis log. While you await feedback, you should/must do a JAVA Update... ===Java update!!! This is for security reasons. Go control panel > java > update, & press update now. Restart after installing the update, and then go into control panel again, add/remove pgms and remove all old versions of java. Vsn 1.6.0.1 is current.... |
| ||
| Re: New Win32 Virus Avenger log: Logfile of The Avenger version 1, by Swandog46 Running from registry key: \Registry\Machine\System\CurrentControlSet\Services\ausbxaqq ******************* Script file located at: \??\C:\Documents and Settings\ufyxbobb.txt Script file opened successfully. Script file read successfully Backups directory opened successfully at C:\Avenger ******************* Beginning to process script file: File C:\DOCUME~1\Allison\LOCALS~1\Temp\winlogon.exe not found! Deletion of file C:\DOCUME~1\Allison\LOCALS~1\Temp\winlogon.exe failed! Could not process line: C:\DOCUME~1\Allison\LOCALS~1\Temp\winlogon.exe Status: 0xc0000034 Completed script processing. ******************* Finished! Terminate. Pandascan log: Incident Status Location Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.mediaplex.com/] Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.doubleclick.net/] Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.atdmt.com/] Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.questionmarket.com/] Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.advertising.com/] Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[servedby.advertising.com/] Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.advertising.com/] Spyware:Cookie/Weborama Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.weborama.fr/] Spyware:Cookie/Linksynergy Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.linksynergy.com/] Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.2o7.net/] Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.atwola.com/] Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.2o7.net/] Spyware:Cookie/Tradedoubler Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.tradedoubler.com/] Spyware:Cookie/Zedo Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.zedo.com/] Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.overture.com/] Spyware:Cookie/AdDynamix Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.ads.addynamix.com/] Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.ads.pointroll.com/] Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.tribalfusion.com/] Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.realmedia.com/] Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.adrevolver.com/] Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.ad.yieldmanager.com/] Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[ad.yieldmanager.com/] Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.ad.yieldmanager.com/] Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[ad.yieldmanager.com/] Spyware:Cookie/Bluestreak Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.bluestreak.com/] Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.bs.serving-sys.com/] Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.serving-sys.com/] Spyware:Cookie/BurstNet Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.burstnet.com/] Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.casalemedia.com/] Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.hitbox.com/] Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.fastclick.net/] Spyware:Cookie/Hitbox Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.phg.hitbox.com/] Spyware:Cookie/myaffiliateprogram Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.www.myaffiliateprogram.com/] Spyware:Cookie/myaffiliateprogram Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[www.myaffiliateprogram.com/] Spyware:Cookie/Maxserving Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.maxserving.com/] Spyware:Cookie/Seeq Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.www48.seeq.com/] Spyware:Cookie/Adserver Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.z1.adserver.com/] Spyware:Cookie/Valueclick Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.valueclick.com/] Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.statcounter.com/] Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.statse.webtrendslive.com/] Spyware:Cookie/Seeq Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.seeq.com/] Spyware:Cookie/WUpd Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.revenue.net/] Spyware:Cookie/Bridgetrack Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.citi.bridgetrack.com/] Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.com.com/] Spyware:Cookie/did-it Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.did-it.com/] Spyware:Cookie/Falkag Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.as-us.falkag.net/] Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.belnk.com/] Spyware:Cookie/Bfast Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.bfast.com/] Spyware:Cookie/Adtech Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.adtech.de/] Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Allison\Application Data\Mozilla\Firefox\Profiles\5aqzya79.default\cookies.txt[.ath.belnk.com/] Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Allison\Cookies\allison@2o7[1].txt Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Allison\Cookies\allison@ad.yieldmanager[1].txt Spyware:Cookie/Hbmediapro Not disinfected C:\Documents and Settings\Allison\Cookies\allison@adopt.hbmediapro[2].txt Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Allison\Cookies\allison@adrevolver[1].txt Spyware:Cookie/Adrevolver Not disinfected C:\Documents and Settings\Allison\Cookies\allison@adrevolver[3].txt Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Allison\Cookies\allison@ads.pointroll[2].txt Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Allison\Cookies\allison@advertising[2].txt Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Allison\Cookies\allison@apmebf[2].txt Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Allison\Cookies\allison@atdmt[2].txt Spyware:Cookie/Atwola Not disinfected C:\Documents and Settings\Allison\Cookies\allison@atwola[1].txt Spyware:Cookie/Azjmp Not disinfected C:\Documents and Settings\Allison\Cookies\allison@azjmp[1].txt Spyware:Cookie/Cgi-bin Not disinfected C:\Documents and Settings\Allison\Cookies\allison@cgi-bin[1].txt Spyware:Cookie/Cgi-bin Not disinfected C:\Documents and Settings\Allison\Cookies\allison@cgi-bin[2].txt Spyware:Cookie/Cgi-bin Not disinfected C:\Documents and Settings\Allison\Cookies\allison@cgi-bin[5].txt Spyware:Cookie/Bridgetrack Not disinfected C:\Documents and Settings\Allison\Cookies\allison@citi.bridgetrack[2].txt Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\Allison\Cookies\allison@com[1].txt Spyware:Cookie/Hitslink Not disinfected C:\Documents and Settings\Allison\Cookies\allison@counter.hitslink[2].txt Spyware:Cookie/did-it Not disinfected C:\Documents and Settings\Allison\Cookies\allison@did-it[1].txt Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Allison\Cookies\allison@doubleclick[1].txt Spyware:Cookie/Findwhat Not disinfected C:\Documents and Settings\Allison\Cookies\allison@findwhat[1].txt Spyware:Cookie/Comclick Not disinfected C:\Documents and Settings\Allison\Cookies\allison@fl01.ct2.comclick[1].txt Spyware:Cookie/FortuneCity Not disinfected C:\Documents and Settings\Allison\Cookies\allison@fortunecity[2].txt Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Allison\Cookies\allison@go[1].txt Spyware:Cookie/Screensavers Not disinfected C:\Documents and Settings\Allison\Cookies\allison@i.screensavers[1].txt Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Allison\Cookies\allison@mediaplex[1].txt Spyware:Cookie/QkSrv Not disinfected C:\Documents and Settings\Allison\Cookies\allison@qksrv[1].txt Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Allison\Cookies\allison@realmedia[1].txt Spyware:Cookie/Seeq Not disinfected C:\Documents and Settings\Allison\Cookies\allison@seeq[1].txt Spyware:Cookie/onestat.com Not disinfected C:\Documents and Settings\Allison\Cookies\allison@stat.onestat[2].txt Spyware:Cookie/DriveCleaner Not disinfected C:\Documents and Settings\Allison\Cookies\allison@stats.drivecleaner[2].txt Spyware:Cookie/WebtrendsLive Not disinfected C:\Documents and Settings\Allison\Cookies\allison@statse.webtrendslive[2].txt Spyware:Cookie/Target Not disinfected C:\Documents and Settings\Allison\Cookies\allison@target[2].txt Spyware:Cookie/Toplist Not disinfected C:\Documents and Settings\Allison\Cookies\allison@toplist[1].txt Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Allison\Cookies\allison@tribalfusion[2].txt Spyware:Cookie/BurstBeacon Not disinfected C:\Documents and Settings\Allison\Cookies\allison@www.burstbeacon[1].txt Spyware:Cookie/myaffiliateprogram Not disinfected C:\Documents and Settings\Allison\Cookies\allison@www.myaffiliateprogram[2].txt Spyware:Cookie/Seeq Not disinfected C:\Documents and Settings\Allison\Cookies\allison@www48.seeq[1].txt Spyware:Cookie/Xiti Not disinfected C:\Documents and Settings\Allison\Cookies\allison@xiti[1].txt New HijackThis log: Logfile of HijackThis v1.99.1 Scan saved at 11:34:56 PM, on 5/11/2007 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\System32\WLTRYSVC.EXE C:\WINDOWS\System32\bcmwltry.exe C:\WINDOWS\system32\spoolsv.exe C:\WINDOWS\eHome\ehRecvr.exe C:\WINDOWS\eHome\ehSched.exe C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe c:\program files\common files\mcafee\mna\mcnasvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe C:\PROGRA~1\McAfee\MSC\mcpromgr.exe c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe C:\WINDOWS\Explorer.EXE c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE C:\Program Files\McAfee\MPF\MPFSrv.exe C:\PROGRA~1\McAfee\MPS\mps.exe C:\Program Files\McAfee\MSK\MskSrver.exe C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe C:\Program Files\SiteAdvisor\6066\SAService.exe C:\WINDOWS\system32\svchost.exe C:\Program Files\Viewpoint\Common\ViewpointService.exe C:\Program Files\McAfee\MPS\mpsevh.exe C:\WINDOWS\ehome\ehtray.exe C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe C:\WINDOWS\system32\WLTRAY.exe C:\WINDOWS\stsystra.exe C:\Program Files\Dell\QuickSet\quickset.exe C:\Program Files\Synaptics\SynTP\SynTPEnh.exe C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe C:\Program Files\Real\RealPlayer\RealPlay.exe C:\WINDOWS\system32\dla\tfswctrl.exe C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe C:\WINDOWS\system32\hkcmd.exe C:\WINDOWS\system32\igfxpers.exe C:\Program Files\McAfee\MSK\MskAgent.exe C:\Program Files\SiteAdvisor\6066\SiteAdv.exe C:\Program Files\QuickTime\qttask.exe C:\Program Files\iTunes\iTunesHelper.exe C:\Program Files\Messenger\msmsgs.exe C:\WINDOWS\system32\igfxsrvc.exe C:\PROGRA~1\mcafee.com\agent\mcagent.exe C:\WINDOWS\system32\ctfmon.exe C:\Program Files\DellSupport\DSAgnt.exe C:\Program Files\Digital Line Detect\DLG.exe C:\WINDOWS\system32\dllhost.exe C:\Program Files\Sony Corporation\Picture Package\Picture Package Menu\SonyTray.exe C:\Program Files\Sony Corporation\Picture Package\Picture Package Applications\Residence.exe C:\WINDOWS\eHome\ehmsas.exe C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe C:\Program Files\iPod\bin\iPodService.exe C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe C:\Program Files\Internet Explorer\IEXPLORE.EXE C:\Program Files\HiijackThis\imabunny.exe c:\dell\E-center\gtb2.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://login.live.com/login.srf?id=2...lang=EN&vv=400 R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell.com R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.dell.com O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: (no name) - {089FD14D-132B-48FC-8861-0048AE113215} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: scriptproxy - {7DB2D5A0-7241-4E79-B68D-6309F01C5231} - c:\program files\mcafee\virusscan\scriptcl.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar3.dll O2 - BHO: CBrowserHelperObject Object - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - c:\Program Files\BAE\BAE.dll O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar3.dll O3 - Toolbar: McAfee SiteAdvisor - {0BF43445-2F28-4351-9252-17FE6E806AA0} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_03\bin\jusched.exe O4 - HKLM\..\Run: [Broadcom Wireless Manager UI] C:\WINDOWS\system32\WLTRAY.exe O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe O4 - HKLM\..\Run: [ShowLOMControl] O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [ECenter] "c:\dell\E-Center\gtb.exe" O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe O4 - HKLM\..\Run: [MskAgentexe] C:\Program Files\McAfee\MSK\MskAgent.exe O4 - HKLM\..\Run: [SiteAdvisor] C:\Program Files\SiteAdvisor\6066\SiteAdv.exe O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe" O4 - HKCU\..\Run: [ModemOnHold] C:\Program Files\NetWaiting\netWaiting.exe O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe O4 - Global Startup: Adobe Reader Synchronizer.lnk = C:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe O4 - Global Startup: Digital Line Detect.lnk = ? O4 - Global Startup: Picture Package Menu.lnk = ? O4 - Global Startup: Picture Package VCD Maker.lnk = ? O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe O9 - Extra button: (no name) - {B205A35E-1FC4-4CE3-818B-899DBBB3388C} - C:\Program Files\Common Files\Microsoft Shared\Encarta Search Bar\ENCSBAR.DLL O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by120fd.bay120.hotmail.msn.co...s/MsnPUpld.cab O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/...toUploader.cab O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/actives...ree/asinst.cab O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (ZoneIntro Class) - http://cdn2.zone.msn.com/binFramewor...o.cab53083.cab O18 - Protocol: siteadvisor - {3A5DC592-7723-4EAA-9EE6-AF4222BCF879} - C:\Program Files\SiteAdvisor\6066\SiteAdv.dll O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxdev.dll O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe O23 - Service: McAfee E-mail Proxy (Emproxy) - McAfee, Inc. - C:\PROGRA~1\COMMON~1\McAfee\EmProxy\emproxy.exe O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe O23 - Service: McAfee HackerWatch Service - McAfee, Inc. - C:\Program Files\Common Files\McAfee\HackerWatch\HWAPI.exe O23 - Service: McAfee Update Manager (mcmispupdmgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcupdmgr.exe O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\program files\common files\mcafee\mna\mcnasvc.exe O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe O23 - Service: McAfee Protection Manager (mcpromgr) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcpromgr.exe O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe O23 - Service: McAfee Redirector Service (McRedirector) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\redirsvc\redirsvc.exe O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe O23 - Service: McAfee Privacy Service (MPS9) - McAfee, Inc. - C:\PROGRA~1\McAfee\MPS\mps.exe O23 - Service: McAfee SpamKiller Service (MSK80Service) - McAfee Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe O23 - Service: SiteAdvisor Service - McAfee, Inc. - C:\Program Files\SiteAdvisor\6066\SAService.exe O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE Thank you! |
| ||
| Re: New Win32 Virus Ack! All those cookies! Hmmm....did you run CCleaner under both Windows and Applications tabs before the Panda scan? Oh well.... Anyway, your sys appears clean. What symptoms are showing still? |
| All times are GMT -4. The time now is 1:46 am. |
Forum system based on vBulletin Copyright ©2000 - 2009, Jelsoft Enterprises Ltd.
©2003 - 2009 DaniWeb® LLC