 |  |  |  |  |  |  |  |
Can't get rid of URL Logic Pop up generator
 |
I am having a really hard time trying to get URL logic off of my computer. It keeps poping up ads as I surf the web. I have sweeped my system with Spy Sweeper but it cannot find and remove the spyware. I have tried also tried to use hijack this to try and remove stuff myself but have gotten really confused as to what is good and what isn't. I've pasted the hijackthis log below. I'd really appreciate anyone's help:
Logfile of HijackThis v1.99.1
Scan saved at 1:12:00 PM, on 3/18/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\atievxx.exe
C:\Program Files\BigFix Enterprise\BES Client\BESClient.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Stanford\PC-Leland\krbcc32s.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\WebRoot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Stanford\PC-Leland\pcleland.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopOE.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\iowkur.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\strings.exe
C:\WINDOWS\system32\find.exe
C:\Documents and Settings\Sam the man\Desktop\hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.stanford.edu/
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Narrator] C:\WINDOWS\system32\iowkur.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\WebRoot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [Active Desktop Calendar] C:\Program Files\XemiComputers\Active Desktop Calendar\ADC.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: PC-Leland.lnk = ?
O4 - Global Startup: strings.exe
O4 - Global Startup: uphngt.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - https://a248.e.akamai.net/7/248/1149...t/qtplugin.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/pro...tor/WebAAS.cab
O16 - DPF: {A48D0309-8DA3-41AA-98E4-89194D471890} (Pulse V5 ActiveX Control) - http://www.pulse3d.com/players/engli...er5.2AxWin.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAV...oadManager.ocx
O16 - DPF: {CE8267C2-D41A-4A50-A69D-F32B5C289F14} (FileOpenInstaller) - http://64.106.242.160/0664/FileOpen.CAB
O20 - Winlogon Notify: Controls Folder - C:\WINDOWS\system32\irr6l59s1.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: BES Client (BESClient) - BigFix Inc. - C:\Program Files\BigFix Enterprise\BES Client\BESClient.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
Logfile of HijackThis v1.99.1
Scan saved at 1:12:00 PM, on 3/18/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\atievxx.exe
C:\Program Files\BigFix Enterprise\BES Client\BESClient.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Stanford\PC-Leland\krbcc32s.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\WebRoot\Spy Sweeper\SpySweeper.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Stanford\PC-Leland\pcleland.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopOE.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\iowkur.exe
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Real\RealPlayer\RealPlay.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\strings.exe
C:\WINDOWS\system32\find.exe
C:\Documents and Settings\Sam the man\Desktop\hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak = http://www.stanford.edu/
O1 - Hosts: 69.20.16.183 auto.search.msn.com
O1 - Hosts: 69.20.16.183 search.netscape.com
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [Narrator] C:\WINDOWS\system32\iowkur.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\WebRoot\Spy Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [Active Desktop Calendar] C:\Program Files\XemiComputers\Active Desktop Calendar\ADC.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: PC-Leland.lnk = ?
O4 - Global Startup: strings.exe
O4 - Global Startup: uphngt.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - https://a248.e.akamai.net/7/248/1149...t/qtplugin.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware Scanner) - http://download.zonelabs.com/bin/pro...tor/WebAAS.cab
O16 - DPF: {A48D0309-8DA3-41AA-98E4-89194D471890} (Pulse V5 ActiveX Control) - http://www.pulse3d.com/players/engli...er5.2AxWin.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAV...oadManager.ocx
O16 - DPF: {CE8267C2-D41A-4A50-A69D-F32B5C289F14} (FileOpenInstaller) - http://64.106.242.160/0664/FileOpen.CAB
O20 - Winlogon Notify: Controls Folder - C:\WINDOWS\system32\irr6l59s1.dll
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: BES Client (BESClient) - BigFix Inc. - C:\Program Files\BigFix Enterprise\BES Client\BESClient.exe
O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
At the least, you have the Narrator/qoologic infection, which HijackThis alone is not going to be able to fix. Please do the following:
Download finditnt2000xp.zip.
http://www.thatcomputerguy.us/downlo...itnt2000xp.zip
1. Unzip the contents of finditnt2000xp.zip
2. Open the resulting "Find It NT-2K-XP" folder
3. Double-click on find.bat.
A command prompt will open and it will search your computer for malicious files.
(it may take several minutes for the script to run ... please be patient)
Once it has finished a Notepad window will pop up with output.txt.
4. Copy the entire contents of output.txt into your next post.
Download finditnt2000xp.zip.
http://www.thatcomputerguy.us/downlo...itnt2000xp.zip
1. Unzip the contents of finditnt2000xp.zip
2. Open the resulting "Find It NT-2K-XP" folder
3. Double-click on find.bat.
A command prompt will open and it will search your computer for malicious files.
(it may take several minutes for the script to run ... please be patient)
Once it has finished a Notepad window will pop up with output.txt.
4. Copy the entire contents of output.txt into your next post.
"May the Wombat of Happiness snuffle through your underbrush."
- Ancient Aborigine blessing
Please do not contact me by email or PM for help. We're all volunteers here, and only have so much free time to dedicate to our efforts.
However, if I've been working on a thread with you already, and seem to have "forgotten" your thread, please do send me a message. I try not to let things slip through the cracks, but it does happen sometimes.
- Ancient Aborigine blessing
Please do not contact me by email or PM for help. We're all volunteers here, and only have so much free time to dedicate to our efforts.
However, if I've been working on a thread with you already, and seem to have "forgotten" your thread, please do send me a message. I try not to let things slip through the cracks, but it does happen sometimes.
I downloaded the file and ran it, I've pasted the results below. What should I do now? Thanks!
>>
Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.
Find.bat is running from: C:\Documents and Settings\Sam the man\Desktop\URL Logic Fix\Find It NT-2K-XP\Find It NT-2K-XP
------- System Files in System32 Directory -------
Volume in drive C has no label.
Volume Serial Number is 289D-6B83
Directory of C:\WINDOWS\System32
03/18/2005 01:35 PM 233,306 dnsetup.dll
03/18/2005 01:35 PM 235,156 p0n8la5u1d.dll
03/18/2005 12:10 PM 233,306 zecommdb.dll
03/18/2005 12:10 PM 235,266 r06ulaj91do.dll
03/18/2005 01:52 AM 233,248 fysrch.dll
03/18/2005 01:50 AM 233,306 irr6l59s1.dll
03/17/2005 12:14 AM 233,306 mxaatext.dll
03/16/2005 01:46 AM 233,248 dkband.dll
03/16/2005 01:43 AM 233,248 pJn8lg5u16.dll
03/16/2005 01:43 AM 233,706 l8n40i5qe8.dll
03/15/2005 11:26 AM 232,736 oamanage.dll
03/15/2005 11:26 AM 233,039 fp0o03d3e.dll
03/14/2005 09:51 PM 232,736 rtchost.dll
03/14/2005 09:51 PM 224,996 phchdprf.dll
03/14/2005 09:51 PM 223,081 n64slgh7164.dll
03/12/2005 06:01 PM 224,996 lv4u09h9e.dll
03/10/2005 08:35 AM 224,147 h82olif3182.dll
03/03/2005 09:05 AM 222,857 lvn8095ue.dll
03/01/2005 12:49 PM 223,620 fp6s03j7e.dll
02/28/2005 09:44 AM 226,069 fprm0391e.dll
02/23/2005 08:27 AM 222,903 o0rola931d.dll
02/23/2005 08:10 AM 225,273 jtn2075oe.dll
02/22/2005 06:19 PM 226,005 lv8u09l9e.dll
02/22/2005 06:04 PM 225,299 fp8203loe.dll
02/22/2005 03:07 PM 225,016 p6n8lg5u16.dll
02/22/2005 09:24 AM 226,030 l0j8la1u1d.dll
02/12/2005 11:43 AM 222,920 ir24l5fq1.dll
02/08/2005 05:42 PM <DIR> dllcache
02/07/2005 08:31 AM 223,446 dzeml.dll
02/07/2005 08:25 AM 222,342 u4ru0e99eh.dll
02/05/2005 07:45 PM 222,342 wewfaxui.dll
02/05/2005 07:37 PM 226,273 cStsrvut.dll
02/05/2005 07:00 PM 224,839 dtcpcsvc.dll
02/05/2005 04:34 PM 223,081 irfosoft.dll
02/04/2005 12:50 PM 224,839 nwmsapi.dll
02/03/2005 02:20 AM 223,081 wL2time.dll
02/02/2005 11:47 PM 224,839 dGtaclen.dll
02/02/2005 06:28 PM 222,808 mvpbde40.dll
02/01/2005 05:28 PM 224,839 kjdhela2.dll
02/01/2005 01:17 PM 222,808 mdgsvc.dll
02/01/2005 09:33 AM 223,717 ly0u09d9e.dll
01/30/2005 11:06 PM 222,808 iamui.dll
01/29/2005 07:58 PM 222,991 AWHPRXY.DLL
01/29/2005 05:24 PM 222,808 dunet.dll
01/29/2005 12:41 PM 225,392 ifsecsvc.dll
01/29/2005 10:19 AM 223,065 dmrpsetu.dll
01/29/2005 09:33 AM 225,392 wvashext.dll
01/29/2005 09:31 AM 222,993 t88u0il9e8q.dll
01/28/2005 05:59 PM 224,814 rgoc3260.dll
01/27/2005 04:55 PM 224,814 cLtsrvps.dll
01/27/2005 03:21 PM 222,993 kzdkaz.dll
01/26/2005 04:58 PM 225,733 pTpgasvc.dll
01/26/2005 02:31 PM 223,206 rLsser.dll
01/25/2005 09:36 PM 225,733 adcups.dll
01/25/2005 05:44 PM 223,206 wkcsvc.dll
01/25/2005 04:07 PM 225,733 uarv80a.dll
01/25/2005 01:29 PM 223,908 ksdlt1.dll
01/25/2005 12:51 PM 225,733 lsvesnth.dll
01/25/2005 11:41 AM 223,908 mpvidctl.dll
01/24/2005 10:43 PM 223,120 jsbexec.dll
01/24/2005 08:32 PM 222,577 iNsacct.dll
01/24/2005 07:28 PM 223,120 kxd101c.dll
01/24/2005 04:32 PM 222,577 wedap32.dll
01/24/2005 02:06 PM 225,921 ixetmib1.dll
01/24/2005 11:19 AM 224,757 aai3duag.dll
01/24/2005 12:34 AM 225,921 Csnmhook.dll
01/23/2005 08:01 PM 224,757 mhrdim.dll
01/23/2005 02:07 AM 225,921 qgery.dll
01/22/2005 07:44 PM 224,757 CMA.DLL
01/20/2005 11:11 AM 224,757 ksdsmsno.dll
01/19/2005 09:57 AM 225,921 meaatext.dll
01/18/2005 08:35 AM 224,757 sbi.dll
01/17/2005 06:05 PM 225,921 mevcrt.dll
01/16/2005 08:40 AM 224,757 uerlbva.dll
01/13/2005 03:56 PM 225,921 vphelper.dll
01/11/2005 09:38 AM 224,757 tLpi3.dll
01/10/2005 06:50 PM 225,921 njptools.dll
01/09/2005 02:30 AM 224,757 awl.dll
01/08/2005 05:14 PM 225,921 xtnroll.dll
01/07/2005 02:54 PM 224,757 csvfat.dll
01/06/2005 07:53 PM 225,921 vhinit.dll
01/06/2005 07:48 PM 224,757 cpbcatex.dll
01/05/2005 08:18 PM 225,921 mbminst.dll
01/05/2005 05:27 PM 224,757 wgavideo.dll
01/04/2005 09:19 PM 225,921 smdocvw.dll
01/03/2005 05:20 PM 224,757 qlartz.dll
01/02/2005 11:08 PM 225,921 mchtmled.dll
01/01/2005 02:42 PM 225,921 ksdkor.dll
12/16/2004 04:44 PM 224,757 kadfr.dll
12/16/2004 11:54 AM 225,921 mdrle32.dll
12/14/2004 10:39 PM 224,757 svclient.dll
12/13/2004 02:47 PM 224,757 chvfat.dll
12/11/2004 09:16 AM 225,411 slorage.dll
12/09/2004 07:04 PM 224,757 rRsauto.dll
12/09/2004 06:56 PM 224,757 kzduk.dll
12/09/2004 06:54 PM 224,757 lvp4097qe.dll
12/08/2004 01:07 PM 224,757 qyv.dll
12/07/2004 11:52 AM 224,757 aitiveds.dll
12/07/2004 01:34 AM 224,757 mid32.dll
12/06/2004 06:23 PM 224,757 mdisip.dll
12/06/2004 01:19 PM 224,757 ozbcji32.dll
12/06/2004 12:47 PM 224,757 k080lalm1dqa.dll
12/06/2004 11:55 AM 226,182 en86l1ls1.dll
12/06/2004 11:38 AM 224,757 nzshrui.dll
07/31/2004 06:32 PM <DIR> Microsoft
103 File(s) 23,248,109 bytes
2 Dir(s) 2,195,996,672 bytes free
------- Hidden Files in System32 Directory -------
Volume in drive C has no label.
Volume Serial Number is 289D-6B83
Directory of C:\WINDOWS\System32
03/18/2005 01:35 PM 890 vsconfig.xml
02/08/2005 05:42 PM <DIR> dllcache
02/05/2005 07:34 PM 4,212 zllictbl.dat
04/18/2004 07:49 PM 488 WindowsLogon.manifest
04/18/2004 07:49 PM 488 logonui.exe.manifest
04/18/2004 07:48 PM 749 sapi.cpl.manifest
04/18/2004 07:48 PM 749 wuaucpl.cpl.manifest
04/18/2004 07:48 PM 749 cdplayer.exe.manifest
04/18/2004 07:48 PM 749 nwc.cpl.manifest
04/18/2004 07:48 PM 749 ncpa.cpl.manifest
9 File(s) 9,823 bytes
1 Dir(s) 2,195,992,576 bytes free
------------ Files Named "Guard" ---------------
Volume in drive C has no label.
Volume Serial Number is 289D-6B83
Directory of C:\WINDOWS\System32
------ Temp Files in System32 Directory ------
Volume in drive C has no label.
Volume Serial Number is 289D-6B83
Directory of C:\WINDOWS\System32
12/06/2004 11:45 AM 474,920 saie_kyf.dat.tmp
09/22/2004 05:46 PM 20,480 setb4.tmp
08/18/2001 04:00 AM 2,577 CONFIG.TMP
3 File(s) 497,977 bytes
0 Dir(s) 2,195,992,576 bytes free
------------------ User Agent ----------------
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{7F54D3B9-49D5-8D4D-D6E4-8F6871E11C09}"=""
------------- Keys Under Notify -------------
REGEDIT4
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00
"Logoff"="ChainWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00
"Logoff"="CryptnetWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
"DllName"="C:\\WINDOWS\\system32\\NavLogon.dll"
"StartShell"="NavStartShellEvent"
"Logoff"="NavLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Reliability]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\irr6l59s1.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
------------- Locate.com Results -------------
C:\WINDOWS\SYSTEM32\
aai3duag.dll Mon Jan 24 2005 11:19:48a ..S.R 224,757 219.49 K
adcups.dll Tue Jan 25 2005 9:36:36p ..S.R 225,733 220.44 K
awhprxy.dll Sat Jan 29 2005 7:58:14p ..S.R 222,991 217.76 K
awl.dll Sun Jan 9 2005 2:30:46a ..S.R 224,757 219.49 K
cltsrvps.dll Thu Jan 27 2005 4:55:54p ..S.R 224,814 219.54 K
cma.dll Sat Jan 22 2005 7:44:38p ..S.R 224,757 219.49 K
cpbcatex.dll Thu Jan 6 2005 7:48:32p ..S.R 224,757 219.49 K
csnmhook.dll Mon Jan 24 2005 12:34:26a ..S.R 225,921 220.63 K
cstsrvut.dll Sat Feb 5 2005 7:37:06p ..S.R 226,273 220.97 K
csvfat.dll Fri Jan 7 2005 2:54:26p ..S.R 224,757 219.49 K
dgtaclen.dll Wed Feb 2 2005 11:47:28p ..S.R 224,839 219.57 K
dkband.dll Wed Mar 16 2005 1:46:54a ..S.R 233,248 227.78 K
dmrpsetu.dll Sat Jan 29 2005 10:19:26a ..S.R 223,065 217.84 K
dnsetup.dll Fri Mar 18 2005 1:35:24p ..S.R 233,306 227.84 K
dtcpcsvc.dll Sat Feb 5 2005 7:00:54p ..S.R 224,839 219.57 K
dunet.dll Sat Jan 29 2005 5:24:38p ..S.R 222,808 217.59 K
dzeml.dll Mon Feb 7 2005 8:31:02a ..S.R 223,446 218.21 K
fp0o03~1.dll Tue Mar 15 2005 11:26:18a ..S.R 233,039 227.57 K
fp6s03~1.dll Tue Mar 1 2005 12:49:34p ..S.R 223,620 218.38 K
fp8203~1.dll Tue Feb 22 2005 6:04:04p ..S.R 225,299 220.02 K
fprm03~1.dll Mon Feb 28 2005 9:44:20a ..S.R 226,069 220.77 K
fysrch.dll Fri Mar 18 2005 1:52:08a ..S.R 233,248 227.78 K
h82oli~1.dll Thu Mar 10 2005 8:35:54a ..S.R 224,147 218.89 K
iamui.dll Sun Jan 30 2005 11:06:54p ..S.R 222,808 217.59 K
ifsecsvc.dll Sat Jan 29 2005 12:41:48p ..S.R 225,392 220.11 K
insacct.dll Mon Jan 24 2005 8:32:12p ..S.R 222,577 217.36 K
ir24l5~1.dll Sat Feb 12 2005 11:43:44a ..S.R 222,920 217.70 K
irfosoft.dll Sat Feb 5 2005 4:34:24p ..S.R 223,081 217.85 K
irr6l5~1.dll Fri Mar 18 2005 1:50:12a ..S.R 233,306 227.84 K
ixetmib1.dll Mon Jan 24 2005 2:06:40p ..S.R 225,921 220.63 K
jsbexec.dll Mon Jan 24 2005 10:43:14p ..S.R 223,120 217.89 K
jtn207~1.dll Wed Feb 23 2005 8:10:02a ..S.R 225,273 219.99 K
kjdhela2.dll Tue Feb 1 2005 5:28:44p ..S.R 224,839 219.57 K
ksdkor.dll Sat Jan 1 2005 2:42:40p ..S.R 225,921 220.63 K
ksdlt1.dll Tue Jan 25 2005 1:29:38p ..S.R 223,908 218.66 K
ksdsmsno.dll Thu Jan 20 2005 11:11:14a ..S.R 224,757 219.49 K
kxd101c.dll Mon Jan 24 2005 7:28:50p ..S.R 223,120 217.89 K
kzdkaz.dll Thu Jan 27 2005 3:21:20p ..S.R 222,993 217.77 K
l0j8la~1.dll Tue Feb 22 2005 9:24:20a ..S.R 226,030 220.73 K
l8n40i~1.dll Wed Mar 16 2005 1:43:30a ..S.R 233,706 228.23 K
lsvesnth.dll Tue Jan 25 2005 12:51:26p ..S.R 225,733 220.44 K
lv4u09~1.dll Sat Mar 12 2005 6:01:42p ..S.R 224,996 219.72 K
lv8u09~1.dll Tue Feb 22 2005 6:19:58p ..S.R 226,005 220.71 K
lvn809~1.dll Thu Mar 3 2005 9:05:18a ..S.R 222,857 217.63 K
ly0u09~1.dll Tue Feb 1 2005 9:33:18a ..S.R 223,717 218.47 K
mbminst.dll Wed Jan 5 2005 8:18:04p ..S.R 225,921 220.63 K
mchtmled.dll Sun Jan 2 2005 11:08:26p ..S.R 225,921 220.63 K
mdgsvc.dll Tue Feb 1 2005 1:17:56p ..S.R 222,808 217.59 K
meaatext.dll Wed Jan 19 2005 9:57:28a ..S.R 225,921 220.63 K
mevcrt.dll Mon Jan 17 2005 6:05:52p ..S.R 225,921 220.63 K
mhrdim.dll Sun Jan 23 2005 8:01:44p ..S.R 224,757 219.49 K
mpvidctl.dll Tue Jan 25 2005 11:42:00a ..S.R 223,908 218.66 K
mvpbde40.dll Wed Feb 2 2005 6:28:36p ..S.R 222,808 217.59 K
mxaatext.dll Thu Mar 17 2005 12:14:06a ..S.R 233,306 227.84 K
n64slg~1.dll Mon Mar 14 2005 9:51:08p ..S.R 223,081 217.85 K
njptools.dll Mon Jan 10 2005 6:50:54p ..S.R 225,921 220.63 K
nwmsapi.dll Fri Feb 4 2005 12:50:34p ..S.R 224,839 219.57 K
o0rola~1.dll Wed Feb 23 2005 8:27:50a ..S.R 222,903 217.68 K
oamanage.dll Tue Mar 15 2005 11:26:18a ..S.R 232,736 227.28 K
p0n8la~1.dll Fri Mar 18 2005 1:35:24p ..S.R 235,156 229.64 K
p6n8lg~1.dll Tue Feb 22 2005 3:07:06p ..S.R 225,016 219.74 K
phchdprf.dll Mon Mar 14 2005 9:51:08p ..S.R 224,996 219.72 K
pjn8lg~1.dll Wed Mar 16 2005 1:43:30a ..S.R 233,248 227.78 K
ptpgasvc.dll Wed Jan 26 2005 4:58:46p ..S.R 225,733 220.44 K
qgery.dll Sun Jan 23 2005 2:07:36a ..S.R 225,921 220.63 K
qlartz.dll Mon Jan 3 2005 5:20:04p ..S.R 224,757 219.49 K
r06ula~1.dll Fri Mar 18 2005 12:11:00p ..S.R 235,266 229.75 K
rgoc3260.dll Fri Jan 28 2005 5:59:06p ..S.R 224,814 219.54 K
rlsser.dll Wed Jan 26 2005 2:31:02p ..S.R 223,206 217.97 K
rtchost.dll Mon Mar 14 2005 9:51:22p ..S.R 232,736 227.28 K
sbi.dll Tue Jan 18 2005 8:35:20a ..S.R 224,757 219.49 K
smdocvw.dll Tue Jan 4 2005 9:19:16p ..S.R 225,921 220.63 K
t88u0i~1.dll Sat Jan 29 2005 9:31:12a ..S.R 222,993 217.77 K
tlpi3.dll Tue Jan 11 2005 9:38:52a ..S.R 224,757 219.49 K
u4ru0e~1.dll Mon Feb 7 2005 8:25:06a ..S.R 222,342 217.13 K
uarv80a.dll Tue Jan 25 2005 4:07:24p ..S.R 225,733 220.44 K
uerlbva.dll Sun Jan 16 2005 8:40:52a ..S.R 224,757 219.49 K
vhinit.dll Thu Jan 6 2005 7:53:42p ..S.R 225,921 220.63 K
vphelper.dll Thu Jan 13 2005 3:56:16p ..S.R 225,921 220.63 K
vsconfig.xml Fri Mar 18 2005 1:35:08p A..H. 890 0.87 K
wedap32.dll Mon Jan 24 2005 4:32:38p ..S.R 222,577 217.36 K
wewfaxui.dll Sat Feb 5 2005 7:45:32p ..S.R 222,342 217.13 K
wgavideo.dll Wed Jan 5 2005 5:27:30p ..S.R 224,757 219.49 K
wkcsvc.dll Tue Jan 25 2005 5:44:58p ..S.R 223,206 217.97 K
wl2time.dll Thu Feb 3 2005 2:20:16a ..S.R 223,081 217.85 K
wvashext.dll Sat Jan 29 2005 9:33:34a ..S.R 225,392 220.11 K
xtnroll.dll Sat Jan 8 2005 5:14:06p ..S.R 225,921 220.63 K
zecommdb.dll Fri Mar 18 2005 12:11:00p ..S.R 233,306 227.84 K
zllictbl.dat Sat Feb 5 2005 7:34:56p ...H. 4,212 4.11 K
89 items found: 89 files, 0 directories.
Total of file sizes: 19,653,856 bytes 18.74 M
-------- Strings.exe Qoologic Results --------
C:\WINDOWS\system32\oueapb.dll: updates.qoologic.com
C:\WINDOWS\system32\yzcpuo.dll: updates.qoologic.com
C:\WINDOWS\system32\zmhquw.exe: updates.qoologic.com
--------- Strings.exe Aspack Results ---------
C:\WINDOWS\system32\aypvub.dat: .aspack
C:\WINDOWS\system32\iowkur.exe: .aspack
C:\WINDOWS\system32\ntdll.dll: .aspack
-------------- HKLM Run Key ----------------
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"Zone Labs Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"
>>
Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.
Find.bat is running from: C:\Documents and Settings\Sam the man\Desktop\URL Logic Fix\Find It NT-2K-XP\Find It NT-2K-XP
------- System Files in System32 Directory -------
Volume in drive C has no label.
Volume Serial Number is 289D-6B83
Directory of C:\WINDOWS\System32
03/18/2005 01:35 PM 233,306 dnsetup.dll
03/18/2005 01:35 PM 235,156 p0n8la5u1d.dll
03/18/2005 12:10 PM 233,306 zecommdb.dll
03/18/2005 12:10 PM 235,266 r06ulaj91do.dll
03/18/2005 01:52 AM 233,248 fysrch.dll
03/18/2005 01:50 AM 233,306 irr6l59s1.dll
03/17/2005 12:14 AM 233,306 mxaatext.dll
03/16/2005 01:46 AM 233,248 dkband.dll
03/16/2005 01:43 AM 233,248 pJn8lg5u16.dll
03/16/2005 01:43 AM 233,706 l8n40i5qe8.dll
03/15/2005 11:26 AM 232,736 oamanage.dll
03/15/2005 11:26 AM 233,039 fp0o03d3e.dll
03/14/2005 09:51 PM 232,736 rtchost.dll
03/14/2005 09:51 PM 224,996 phchdprf.dll
03/14/2005 09:51 PM 223,081 n64slgh7164.dll
03/12/2005 06:01 PM 224,996 lv4u09h9e.dll
03/10/2005 08:35 AM 224,147 h82olif3182.dll
03/03/2005 09:05 AM 222,857 lvn8095ue.dll
03/01/2005 12:49 PM 223,620 fp6s03j7e.dll
02/28/2005 09:44 AM 226,069 fprm0391e.dll
02/23/2005 08:27 AM 222,903 o0rola931d.dll
02/23/2005 08:10 AM 225,273 jtn2075oe.dll
02/22/2005 06:19 PM 226,005 lv8u09l9e.dll
02/22/2005 06:04 PM 225,299 fp8203loe.dll
02/22/2005 03:07 PM 225,016 p6n8lg5u16.dll
02/22/2005 09:24 AM 226,030 l0j8la1u1d.dll
02/12/2005 11:43 AM 222,920 ir24l5fq1.dll
02/08/2005 05:42 PM <DIR> dllcache
02/07/2005 08:31 AM 223,446 dzeml.dll
02/07/2005 08:25 AM 222,342 u4ru0e99eh.dll
02/05/2005 07:45 PM 222,342 wewfaxui.dll
02/05/2005 07:37 PM 226,273 cStsrvut.dll
02/05/2005 07:00 PM 224,839 dtcpcsvc.dll
02/05/2005 04:34 PM 223,081 irfosoft.dll
02/04/2005 12:50 PM 224,839 nwmsapi.dll
02/03/2005 02:20 AM 223,081 wL2time.dll
02/02/2005 11:47 PM 224,839 dGtaclen.dll
02/02/2005 06:28 PM 222,808 mvpbde40.dll
02/01/2005 05:28 PM 224,839 kjdhela2.dll
02/01/2005 01:17 PM 222,808 mdgsvc.dll
02/01/2005 09:33 AM 223,717 ly0u09d9e.dll
01/30/2005 11:06 PM 222,808 iamui.dll
01/29/2005 07:58 PM 222,991 AWHPRXY.DLL
01/29/2005 05:24 PM 222,808 dunet.dll
01/29/2005 12:41 PM 225,392 ifsecsvc.dll
01/29/2005 10:19 AM 223,065 dmrpsetu.dll
01/29/2005 09:33 AM 225,392 wvashext.dll
01/29/2005 09:31 AM 222,993 t88u0il9e8q.dll
01/28/2005 05:59 PM 224,814 rgoc3260.dll
01/27/2005 04:55 PM 224,814 cLtsrvps.dll
01/27/2005 03:21 PM 222,993 kzdkaz.dll
01/26/2005 04:58 PM 225,733 pTpgasvc.dll
01/26/2005 02:31 PM 223,206 rLsser.dll
01/25/2005 09:36 PM 225,733 adcups.dll
01/25/2005 05:44 PM 223,206 wkcsvc.dll
01/25/2005 04:07 PM 225,733 uarv80a.dll
01/25/2005 01:29 PM 223,908 ksdlt1.dll
01/25/2005 12:51 PM 225,733 lsvesnth.dll
01/25/2005 11:41 AM 223,908 mpvidctl.dll
01/24/2005 10:43 PM 223,120 jsbexec.dll
01/24/2005 08:32 PM 222,577 iNsacct.dll
01/24/2005 07:28 PM 223,120 kxd101c.dll
01/24/2005 04:32 PM 222,577 wedap32.dll
01/24/2005 02:06 PM 225,921 ixetmib1.dll
01/24/2005 11:19 AM 224,757 aai3duag.dll
01/24/2005 12:34 AM 225,921 Csnmhook.dll
01/23/2005 08:01 PM 224,757 mhrdim.dll
01/23/2005 02:07 AM 225,921 qgery.dll
01/22/2005 07:44 PM 224,757 CMA.DLL
01/20/2005 11:11 AM 224,757 ksdsmsno.dll
01/19/2005 09:57 AM 225,921 meaatext.dll
01/18/2005 08:35 AM 224,757 sbi.dll
01/17/2005 06:05 PM 225,921 mevcrt.dll
01/16/2005 08:40 AM 224,757 uerlbva.dll
01/13/2005 03:56 PM 225,921 vphelper.dll
01/11/2005 09:38 AM 224,757 tLpi3.dll
01/10/2005 06:50 PM 225,921 njptools.dll
01/09/2005 02:30 AM 224,757 awl.dll
01/08/2005 05:14 PM 225,921 xtnroll.dll
01/07/2005 02:54 PM 224,757 csvfat.dll
01/06/2005 07:53 PM 225,921 vhinit.dll
01/06/2005 07:48 PM 224,757 cpbcatex.dll
01/05/2005 08:18 PM 225,921 mbminst.dll
01/05/2005 05:27 PM 224,757 wgavideo.dll
01/04/2005 09:19 PM 225,921 smdocvw.dll
01/03/2005 05:20 PM 224,757 qlartz.dll
01/02/2005 11:08 PM 225,921 mchtmled.dll
01/01/2005 02:42 PM 225,921 ksdkor.dll
12/16/2004 04:44 PM 224,757 kadfr.dll
12/16/2004 11:54 AM 225,921 mdrle32.dll
12/14/2004 10:39 PM 224,757 svclient.dll
12/13/2004 02:47 PM 224,757 chvfat.dll
12/11/2004 09:16 AM 225,411 slorage.dll
12/09/2004 07:04 PM 224,757 rRsauto.dll
12/09/2004 06:56 PM 224,757 kzduk.dll
12/09/2004 06:54 PM 224,757 lvp4097qe.dll
12/08/2004 01:07 PM 224,757 qyv.dll
12/07/2004 11:52 AM 224,757 aitiveds.dll
12/07/2004 01:34 AM 224,757 mid32.dll
12/06/2004 06:23 PM 224,757 mdisip.dll
12/06/2004 01:19 PM 224,757 ozbcji32.dll
12/06/2004 12:47 PM 224,757 k080lalm1dqa.dll
12/06/2004 11:55 AM 226,182 en86l1ls1.dll
12/06/2004 11:38 AM 224,757 nzshrui.dll
07/31/2004 06:32 PM <DIR> Microsoft
103 File(s) 23,248,109 bytes
2 Dir(s) 2,195,996,672 bytes free
------- Hidden Files in System32 Directory -------
Volume in drive C has no label.
Volume Serial Number is 289D-6B83
Directory of C:\WINDOWS\System32
03/18/2005 01:35 PM 890 vsconfig.xml
02/08/2005 05:42 PM <DIR> dllcache
02/05/2005 07:34 PM 4,212 zllictbl.dat
04/18/2004 07:49 PM 488 WindowsLogon.manifest
04/18/2004 07:49 PM 488 logonui.exe.manifest
04/18/2004 07:48 PM 749 sapi.cpl.manifest
04/18/2004 07:48 PM 749 wuaucpl.cpl.manifest
04/18/2004 07:48 PM 749 cdplayer.exe.manifest
04/18/2004 07:48 PM 749 nwc.cpl.manifest
04/18/2004 07:48 PM 749 ncpa.cpl.manifest
9 File(s) 9,823 bytes
1 Dir(s) 2,195,992,576 bytes free
------------ Files Named "Guard" ---------------
Volume in drive C has no label.
Volume Serial Number is 289D-6B83
Directory of C:\WINDOWS\System32
------ Temp Files in System32 Directory ------
Volume in drive C has no label.
Volume Serial Number is 289D-6B83
Directory of C:\WINDOWS\System32
12/06/2004 11:45 AM 474,920 saie_kyf.dat.tmp
09/22/2004 05:46 PM 20,480 setb4.tmp
08/18/2001 04:00 AM 2,577 CONFIG.TMP
3 File(s) 497,977 bytes
0 Dir(s) 2,195,992,576 bytes free
------------------ User Agent ----------------
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{7F54D3B9-49D5-8D4D-D6E4-8F6871E11C09}"=""
------------- Keys Under Notify -------------
REGEDIT4
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00
"Logoff"="ChainWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00
"Logoff"="CryptnetWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
"DllName"="C:\\WINDOWS\\system32\\NavLogon.dll"
"StartShell"="NavStartShellEvent"
"Logoff"="NavLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Reliability]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\irr6l59s1.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
------------- Locate.com Results -------------
C:\WINDOWS\SYSTEM32\
aai3duag.dll Mon Jan 24 2005 11:19:48a ..S.R 224,757 219.49 K
adcups.dll Tue Jan 25 2005 9:36:36p ..S.R 225,733 220.44 K
awhprxy.dll Sat Jan 29 2005 7:58:14p ..S.R 222,991 217.76 K
awl.dll Sun Jan 9 2005 2:30:46a ..S.R 224,757 219.49 K
cltsrvps.dll Thu Jan 27 2005 4:55:54p ..S.R 224,814 219.54 K
cma.dll Sat Jan 22 2005 7:44:38p ..S.R 224,757 219.49 K
cpbcatex.dll Thu Jan 6 2005 7:48:32p ..S.R 224,757 219.49 K
csnmhook.dll Mon Jan 24 2005 12:34:26a ..S.R 225,921 220.63 K
cstsrvut.dll Sat Feb 5 2005 7:37:06p ..S.R 226,273 220.97 K
csvfat.dll Fri Jan 7 2005 2:54:26p ..S.R 224,757 219.49 K
dgtaclen.dll Wed Feb 2 2005 11:47:28p ..S.R 224,839 219.57 K
dkband.dll Wed Mar 16 2005 1:46:54a ..S.R 233,248 227.78 K
dmrpsetu.dll Sat Jan 29 2005 10:19:26a ..S.R 223,065 217.84 K
dnsetup.dll Fri Mar 18 2005 1:35:24p ..S.R 233,306 227.84 K
dtcpcsvc.dll Sat Feb 5 2005 7:00:54p ..S.R 224,839 219.57 K
dunet.dll Sat Jan 29 2005 5:24:38p ..S.R 222,808 217.59 K
dzeml.dll Mon Feb 7 2005 8:31:02a ..S.R 223,446 218.21 K
fp0o03~1.dll Tue Mar 15 2005 11:26:18a ..S.R 233,039 227.57 K
fp6s03~1.dll Tue Mar 1 2005 12:49:34p ..S.R 223,620 218.38 K
fp8203~1.dll Tue Feb 22 2005 6:04:04p ..S.R 225,299 220.02 K
fprm03~1.dll Mon Feb 28 2005 9:44:20a ..S.R 226,069 220.77 K
fysrch.dll Fri Mar 18 2005 1:52:08a ..S.R 233,248 227.78 K
h82oli~1.dll Thu Mar 10 2005 8:35:54a ..S.R 224,147 218.89 K
iamui.dll Sun Jan 30 2005 11:06:54p ..S.R 222,808 217.59 K
ifsecsvc.dll Sat Jan 29 2005 12:41:48p ..S.R 225,392 220.11 K
insacct.dll Mon Jan 24 2005 8:32:12p ..S.R 222,577 217.36 K
ir24l5~1.dll Sat Feb 12 2005 11:43:44a ..S.R 222,920 217.70 K
irfosoft.dll Sat Feb 5 2005 4:34:24p ..S.R 223,081 217.85 K
irr6l5~1.dll Fri Mar 18 2005 1:50:12a ..S.R 233,306 227.84 K
ixetmib1.dll Mon Jan 24 2005 2:06:40p ..S.R 225,921 220.63 K
jsbexec.dll Mon Jan 24 2005 10:43:14p ..S.R 223,120 217.89 K
jtn207~1.dll Wed Feb 23 2005 8:10:02a ..S.R 225,273 219.99 K
kjdhela2.dll Tue Feb 1 2005 5:28:44p ..S.R 224,839 219.57 K
ksdkor.dll Sat Jan 1 2005 2:42:40p ..S.R 225,921 220.63 K
ksdlt1.dll Tue Jan 25 2005 1:29:38p ..S.R 223,908 218.66 K
ksdsmsno.dll Thu Jan 20 2005 11:11:14a ..S.R 224,757 219.49 K
kxd101c.dll Mon Jan 24 2005 7:28:50p ..S.R 223,120 217.89 K
kzdkaz.dll Thu Jan 27 2005 3:21:20p ..S.R 222,993 217.77 K
l0j8la~1.dll Tue Feb 22 2005 9:24:20a ..S.R 226,030 220.73 K
l8n40i~1.dll Wed Mar 16 2005 1:43:30a ..S.R 233,706 228.23 K
lsvesnth.dll Tue Jan 25 2005 12:51:26p ..S.R 225,733 220.44 K
lv4u09~1.dll Sat Mar 12 2005 6:01:42p ..S.R 224,996 219.72 K
lv8u09~1.dll Tue Feb 22 2005 6:19:58p ..S.R 226,005 220.71 K
lvn809~1.dll Thu Mar 3 2005 9:05:18a ..S.R 222,857 217.63 K
ly0u09~1.dll Tue Feb 1 2005 9:33:18a ..S.R 223,717 218.47 K
mbminst.dll Wed Jan 5 2005 8:18:04p ..S.R 225,921 220.63 K
mchtmled.dll Sun Jan 2 2005 11:08:26p ..S.R 225,921 220.63 K
mdgsvc.dll Tue Feb 1 2005 1:17:56p ..S.R 222,808 217.59 K
meaatext.dll Wed Jan 19 2005 9:57:28a ..S.R 225,921 220.63 K
mevcrt.dll Mon Jan 17 2005 6:05:52p ..S.R 225,921 220.63 K
mhrdim.dll Sun Jan 23 2005 8:01:44p ..S.R 224,757 219.49 K
mpvidctl.dll Tue Jan 25 2005 11:42:00a ..S.R 223,908 218.66 K
mvpbde40.dll Wed Feb 2 2005 6:28:36p ..S.R 222,808 217.59 K
mxaatext.dll Thu Mar 17 2005 12:14:06a ..S.R 233,306 227.84 K
n64slg~1.dll Mon Mar 14 2005 9:51:08p ..S.R 223,081 217.85 K
njptools.dll Mon Jan 10 2005 6:50:54p ..S.R 225,921 220.63 K
nwmsapi.dll Fri Feb 4 2005 12:50:34p ..S.R 224,839 219.57 K
o0rola~1.dll Wed Feb 23 2005 8:27:50a ..S.R 222,903 217.68 K
oamanage.dll Tue Mar 15 2005 11:26:18a ..S.R 232,736 227.28 K
p0n8la~1.dll Fri Mar 18 2005 1:35:24p ..S.R 235,156 229.64 K
p6n8lg~1.dll Tue Feb 22 2005 3:07:06p ..S.R 225,016 219.74 K
phchdprf.dll Mon Mar 14 2005 9:51:08p ..S.R 224,996 219.72 K
pjn8lg~1.dll Wed Mar 16 2005 1:43:30a ..S.R 233,248 227.78 K
ptpgasvc.dll Wed Jan 26 2005 4:58:46p ..S.R 225,733 220.44 K
qgery.dll Sun Jan 23 2005 2:07:36a ..S.R 225,921 220.63 K
qlartz.dll Mon Jan 3 2005 5:20:04p ..S.R 224,757 219.49 K
r06ula~1.dll Fri Mar 18 2005 12:11:00p ..S.R 235,266 229.75 K
rgoc3260.dll Fri Jan 28 2005 5:59:06p ..S.R 224,814 219.54 K
rlsser.dll Wed Jan 26 2005 2:31:02p ..S.R 223,206 217.97 K
rtchost.dll Mon Mar 14 2005 9:51:22p ..S.R 232,736 227.28 K
sbi.dll Tue Jan 18 2005 8:35:20a ..S.R 224,757 219.49 K
smdocvw.dll Tue Jan 4 2005 9:19:16p ..S.R 225,921 220.63 K
t88u0i~1.dll Sat Jan 29 2005 9:31:12a ..S.R 222,993 217.77 K
tlpi3.dll Tue Jan 11 2005 9:38:52a ..S.R 224,757 219.49 K
u4ru0e~1.dll Mon Feb 7 2005 8:25:06a ..S.R 222,342 217.13 K
uarv80a.dll Tue Jan 25 2005 4:07:24p ..S.R 225,733 220.44 K
uerlbva.dll Sun Jan 16 2005 8:40:52a ..S.R 224,757 219.49 K
vhinit.dll Thu Jan 6 2005 7:53:42p ..S.R 225,921 220.63 K
vphelper.dll Thu Jan 13 2005 3:56:16p ..S.R 225,921 220.63 K
vsconfig.xml Fri Mar 18 2005 1:35:08p A..H. 890 0.87 K
wedap32.dll Mon Jan 24 2005 4:32:38p ..S.R 222,577 217.36 K
wewfaxui.dll Sat Feb 5 2005 7:45:32p ..S.R 222,342 217.13 K
wgavideo.dll Wed Jan 5 2005 5:27:30p ..S.R 224,757 219.49 K
wkcsvc.dll Tue Jan 25 2005 5:44:58p ..S.R 223,206 217.97 K
wl2time.dll Thu Feb 3 2005 2:20:16a ..S.R 223,081 217.85 K
wvashext.dll Sat Jan 29 2005 9:33:34a ..S.R 225,392 220.11 K
xtnroll.dll Sat Jan 8 2005 5:14:06p ..S.R 225,921 220.63 K
zecommdb.dll Fri Mar 18 2005 12:11:00p ..S.R 233,306 227.84 K
zllictbl.dat Sat Feb 5 2005 7:34:56p ...H. 4,212 4.11 K
89 items found: 89 files, 0 directories.
Total of file sizes: 19,653,856 bytes 18.74 M
-------- Strings.exe Qoologic Results --------
C:\WINDOWS\system32\oueapb.dll: updates.qoologic.com
C:\WINDOWS\system32\yzcpuo.dll: updates.qoologic.com
C:\WINDOWS\system32\zmhquw.exe: updates.qoologic.com
--------- Strings.exe Aspack Results ---------
C:\WINDOWS\system32\aypvub.dat: .aspack
C:\WINDOWS\system32\iowkur.exe: .aspack
C:\WINDOWS\system32\ntdll.dll: .aspack
-------------- HKLM Run Key ----------------
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"Zone Labs Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"
Bear with us here- this isn't going to fun or easy. :mad:
Please do not reboot your computer unless instructed to do so during the course of this; the malicious files will morph and multiply if you do.
1. Delete this file:
C:\WINDOWS\System32\saie_kyf.dat.tmp
2. Download L2Mfix and save it to your desktop. Double-click l2mfix.exe and follow the prompts to extract the utility; the installation process will create a new L2M folder on your desktop.
Do not do anything further with the utility at the moment; we'll be using later on.
3. Download Pocket Killbox.
- Unzip the contents of KillBox.zip to a convenient location.
- Close all Browsers and programs that show in the windows taskbar.
- Double-click on KillBox.exe.
- Click "Delete on Reboot"
- Copy/Paste this file into the top "Full Path of File to Delete" box:
C:\\WINDOWS\system32\irr6l59s1.dll
- Click the "Delete File" button which looks like a stop sign.
- Click "Yes" at the Replace on Reboot prompt.
- Click "No" at the Pending Operations prompt.
- Repeat the above steps for each of the following files, but at the Pending Operations prompt you get after the last file (iowkur.exe), click Yes to reboot the system; this will complete the deletion process:
C:\WINDOWS\system32\oueapb.dll
C:\WINDOWS\system32\yzcpuo.dll
C:\WINDOWS\system32\zmhquw.exe
C:\WINDOWS\system32\aypvub.dat
C:\WINDOWS\system32\iowkur.exe
4. After the system has rebooted:
A) Run FindIt's find.bat program again. Save the new FindIt log and post the contents here.
B) Here's where L2Mfix comes in:
From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.
Please do not reboot your computer unless instructed to do so during the course of this; the malicious files will morph and multiply if you do.
1. Delete this file:
C:\WINDOWS\System32\saie_kyf.dat.tmp
2. Download L2Mfix and save it to your desktop. Double-click l2mfix.exe and follow the prompts to extract the utility; the installation process will create a new L2M folder on your desktop.
Do not do anything further with the utility at the moment; we'll be using later on.
3. Download Pocket Killbox.
- Unzip the contents of KillBox.zip to a convenient location.
- Close all Browsers and programs that show in the windows taskbar.
- Double-click on KillBox.exe.
- Click "Delete on Reboot"
- Copy/Paste this file into the top "Full Path of File to Delete" box:
C:\\WINDOWS\system32\irr6l59s1.dll
- Click the "Delete File" button which looks like a stop sign.
- Click "Yes" at the Replace on Reboot prompt.
- Click "No" at the Pending Operations prompt.
- Repeat the above steps for each of the following files, but at the Pending Operations prompt you get after the last file (iowkur.exe), click Yes to reboot the system; this will complete the deletion process:
C:\WINDOWS\system32\oueapb.dll
C:\WINDOWS\system32\yzcpuo.dll
C:\WINDOWS\system32\zmhquw.exe
C:\WINDOWS\system32\aypvub.dat
C:\WINDOWS\system32\iowkur.exe
4. After the system has rebooted:
A) Run FindIt's find.bat program again. Save the new FindIt log and post the contents here.
B) Here's where L2Mfix comes in:
From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.
"May the Wombat of Happiness snuffle through your underbrush."
- Ancient Aborigine blessing
Please do not contact me by email or PM for help. We're all volunteers here, and only have so much free time to dedicate to our efforts.
However, if I've been working on a thread with you already, and seem to have "forgotten" your thread, please do send me a message. I try not to let things slip through the cracks, but it does happen sometimes.
- Ancient Aborigine blessing
Please do not contact me by email or PM for help. We're all volunteers here, and only have so much free time to dedicate to our efforts.
However, if I've been working on a thread with you already, and seem to have "forgotten" your thread, please do send me a message. I try not to let things slip through the cracks, but it does happen sometimes.
•
•
Join Date: Feb 2004
Posts: 10,002
Reputation: 
Solved Threads: 757
Hi shahss. DMR has requested that I take a quick peek at your problem. First up we will need to rid you of the VX2 infection.
Download L2mfix from one of these two locations:
http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe
Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop.
Close any programs you have open since this step requires a reboot.
From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.
IMPORTANT: Do NOT run any other files in the l2mfix folder until you are asked to do so!
Please go here and download Find_qoologic.zip by baskar1234. Unzip the folder and go to the new qoologic folder and doubleclick on qoologic.bat to run it. It will take a few minutes to scan your drive so be patient. When it has finished, open My Computer, doubleclick on C: and copy and paste the contents of the below logs in this thread.
C:\log.txt
C:\win.txt
C:\start.txt
Post another Find_it log too please.
Download L2mfix from one of these two locations:
http://www.atribune.org/downloads/l2mfix.exe
http://www.downloads.subratam.org/l2mfix.exe
Save the file to your desktop and double click l2mfix.exe. Click the Install button to extract the files and follow the prompts, then open the newly added l2mfix folder on your desktop.
Close any programs you have open since this step requires a reboot.
From the l2mfix folder on your desktop, double click l2mfix.bat and select option #2 for Run Fix by typing 2 and then pressing enter, then press any key to reboot your computer. After a reboot, your desktop and icons will appear, then disappear (this is normal). L2mfix will continue to scan your computer and when it's finished, notepad will open with a log. Copy the contents of that log and paste it back into this thread, along with a new hijackthis log.
IMPORTANT: Do NOT run any other files in the l2mfix folder until you are asked to do so!
Please go here and download Find_qoologic.zip by baskar1234. Unzip the folder and go to the new qoologic folder and doubleclick on qoologic.bat to run it. It will take a few minutes to scan your drive so be patient. When it has finished, open My Computer, doubleclick on C: and copy and paste the contents of the below logs in this thread.
C:\log.txt
C:\win.txt
C:\start.txt
Post another Find_it log too please.
Proud member of ASAP (Alliance of Security analysis Professionals).
Opera AVAST anti-virus Comodo Firewall Spywareblaster
Opera AVAST anti-virus Comodo Firewall Spywareblaster
Thank you for all of your help. I ran l2mfix, findqoologic and hijackthis and have pasted the logs below. I also used pocket killbox to delete the files mentioned in the previous note. I have another question about spysweeper, as I was funning the mentioned programs I was receiving spysweeper alerts and didn't know what to do about them. Should I just turn spy sweeper off during this process?
After running Findqoologic this is what I got in the start.txt, log.txt, and win.txt files:
start.txt - The file was empty.
win.txt:
C:\WINDOWS\system32\ntdll.dll: .aspack
log.txt:
C:\Documents and Settings\Sam the man\Desktop\URL Logic Fix\findqoologic
PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Files Found in system Folder............
------------------------
C:\WINDOWS\system32\ntdll.dll: .aspack
Files Found in all users startup Folder............
------------------------
l2mfix log:
Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.
Find.bat is running from: C:\Documents and Settings\Sam the man\Desktop\URL Logic Fix\Find It NT-2K-XP\Find It NT-2K-XP
------- System Files in System32 Directory -------
Volume in drive C has no label.
Volume Serial Number is 289D-6B83
Directory of C:\WINDOWS\System32
03/18/2005 05:34 PM 235,156 llexpand.dll
03/18/2005 05:26 PM 233,306 e6202gfmg62a2.dll
03/18/2005 01:35 PM 233,306 dnsetup.dll
03/18/2005 01:35 PM 235,156 p0n8la5u1d.dll
03/18/2005 12:10 PM 233,306 zecommdb.dll
03/18/2005 12:10 PM 235,266 r06ulaj91do.dll
03/18/2005 01:52 AM 233,248 fysrch.dll
03/17/2005 12:14 AM 233,306 mxaatext.dll
03/16/2005 01:46 AM 233,248 dkband.dll
03/16/2005 01:43 AM 233,248 pJn8lg5u16.dll
03/16/2005 01:43 AM 233,706 l8n40i5qe8.dll
03/15/2005 11:26 AM 232,736 oamanage.dll
03/15/2005 11:26 AM 233,039 fp0o03d3e.dll
03/14/2005 09:51 PM 232,736 rtchost.dll
03/14/2005 09:51 PM 224,996 phchdprf.dll
03/14/2005 09:51 PM 223,081 n64slgh7164.dll
03/12/2005 06:01 PM 224,996 lv4u09h9e.dll
03/10/2005 08:35 AM 224,147 h82olif3182.dll
03/03/2005 09:05 AM 222,857 lvn8095ue.dll
03/01/2005 12:49 PM 223,620 fp6s03j7e.dll
02/28/2005 09:44 AM 226,069 fprm0391e.dll
02/23/2005 08:27 AM 222,903 o0rola931d.dll
02/23/2005 08:10 AM 225,273 jtn2075oe.dll
02/22/2005 06:19 PM 226,005 lv8u09l9e.dll
02/22/2005 06:04 PM 225,299 fp8203loe.dll
02/22/2005 03:07 PM 225,016 p6n8lg5u16.dll
02/22/2005 09:24 AM 226,030 l0j8la1u1d.dll
02/12/2005 11:43 AM 222,920 ir24l5fq1.dll
02/08/2005 05:42 PM <DIR> dllcache
02/07/2005 08:31 AM 223,446 dzeml.dll
02/07/2005 08:25 AM 222,342 u4ru0e99eh.dll
02/05/2005 07:45 PM 222,342 wewfaxui.dll
02/05/2005 07:37 PM 226,273 cStsrvut.dll
02/05/2005 07:00 PM 224,839 dtcpcsvc.dll
02/05/2005 04:34 PM 223,081 irfosoft.dll
02/04/2005 12:50 PM 224,839 nwmsapi.dll
02/03/2005 02:20 AM 223,081 wL2time.dll
02/02/2005 11:47 PM 224,839 dGtaclen.dll
02/02/2005 06:28 PM 222,808 mvpbde40.dll
02/01/2005 05:28 PM 224,839 kjdhela2.dll
02/01/2005 01:17 PM 222,808 mdgsvc.dll
02/01/2005 09:33 AM 223,717 ly0u09d9e.dll
01/30/2005 11:06 PM 222,808 iamui.dll
01/29/2005 07:58 PM 222,991 AWHPRXY.DLL
01/29/2005 05:24 PM 222,808 dunet.dll
01/29/2005 12:41 PM 225,392 ifsecsvc.dll
01/29/2005 10:19 AM 223,065 dmrpsetu.dll
01/29/2005 09:33 AM 225,392 wvashext.dll
01/29/2005 09:31 AM 222,993 t88u0il9e8q.dll
01/28/2005 05:59 PM 224,814 rgoc3260.dll
01/27/2005 04:55 PM 224,814 cLtsrvps.dll
01/27/2005 03:21 PM 222,993 kzdkaz.dll
01/26/2005 04:58 PM 225,733 pTpgasvc.dll
01/26/2005 02:31 PM 223,206 rLsser.dll
01/25/2005 09:36 PM 225,733 adcups.dll
01/25/2005 05:44 PM 223,206 wkcsvc.dll
01/25/2005 04:07 PM 225,733 uarv80a.dll
01/25/2005 01:29 PM 223,908 ksdlt1.dll
01/25/2005 12:51 PM 225,733 lsvesnth.dll
01/25/2005 11:41 AM 223,908 mpvidctl.dll
01/24/2005 10:43 PM 223,120 jsbexec.dll
01/24/2005 08:32 PM 222,577 iNsacct.dll
01/24/2005 07:28 PM 223,120 kxd101c.dll
01/24/2005 04:32 PM 222,577 wedap32.dll
01/24/2005 02:06 PM 225,921 ixetmib1.dll
01/24/2005 11:19 AM 224,757 aai3duag.dll
01/24/2005 12:34 AM 225,921 Csnmhook.dll
01/23/2005 08:01 PM 224,757 mhrdim.dll
01/23/2005 02:07 AM 225,921 qgery.dll
01/22/2005 07:44 PM 224,757 CMA.DLL
01/20/2005 11:11 AM 224,757 ksdsmsno.dll
01/19/2005 09:57 AM 225,921 meaatext.dll
01/18/2005 08:35 AM 224,757 sbi.dll
01/17/2005 06:05 PM 225,921 mevcrt.dll
01/16/2005 08:40 AM 224,757 uerlbva.dll
01/13/2005 03:56 PM 225,921 vphelper.dll
01/11/2005 09:38 AM 224,757 tLpi3.dll
01/10/2005 06:50 PM 225,921 njptools.dll
01/09/2005 02:30 AM 224,757 awl.dll
01/08/2005 05:14 PM 225,921 xtnroll.dll
01/07/2005 02:54 PM 224,757 csvfat.dll
01/06/2005 07:53 PM 225,921 vhinit.dll
01/06/2005 07:48 PM 224,757 cpbcatex.dll
01/05/2005 08:18 PM 225,921 mbminst.dll
01/05/2005 05:27 PM 224,757 wgavideo.dll
01/04/2005 09:19 PM 225,921 smdocvw.dll
01/03/2005 05:20 PM 224,757 qlartz.dll
01/02/2005 11:08 PM 225,921 mchtmled.dll
01/01/2005 02:42 PM 225,921 ksdkor.dll
12/16/2004 04:44 PM 224,757 kadfr.dll
12/16/2004 11:54 AM 225,921 mdrle32.dll
12/14/2004 10:39 PM 224,757 svclient.dll
12/13/2004 02:47 PM 224,757 chvfat.dll
12/11/2004 09:16 AM 225,411 slorage.dll
12/09/2004 07:04 PM 224,757 rRsauto.dll
12/09/2004 06:56 PM 224,757 kzduk.dll
12/09/2004 06:54 PM 224,757 lvp4097qe.dll
12/08/2004 01:07 PM 224,757 qyv.dll
12/07/2004 11:52 AM 224,757 aitiveds.dll
12/07/2004 01:34 AM 224,757 mid32.dll
12/06/2004 06:23 PM 224,757 mdisip.dll
12/06/2004 01:19 PM 224,757 ozbcji32.dll
12/06/2004 12:47 PM 224,757 k080lalm1dqa.dll
12/06/2004 11:55 AM 226,182 en86l1ls1.dll
12/06/2004 11:38 AM 224,757 nzshrui.dll
07/31/2004 06:32 PM <DIR> Microsoft
104 File(s) 23,483,265 bytes
2 Dir(s) 2,187,149,312 bytes free
------- Hidden Files in System32 Directory -------
Volume in drive C has no label.
Volume Serial Number is 289D-6B83
Directory of C:\WINDOWS\System32
03/18/2005 05:34 PM 890 vsconfig.xml
02/08/2005 05:42 PM <DIR> dllcache
02/05/2005 07:34 PM 4,212 zllictbl.dat
04/18/2004 07:49 PM 488 WindowsLogon.manifest
04/18/2004 07:49 PM 488 logonui.exe.manifest
04/18/2004 07:48 PM 749 sapi.cpl.manifest
04/18/2004 07:48 PM 749 wuaucpl.cpl.manifest
04/18/2004 07:48 PM 749 cdplayer.exe.manifest
04/18/2004 07:48 PM 749 nwc.cpl.manifest
04/18/2004 07:48 PM 749 ncpa.cpl.manifest
9 File(s) 9,823 bytes
1 Dir(s) 2,187,145,216 bytes free
------------ Files Named "Guard" ---------------
Volume in drive C has no label.
Volume Serial Number is 289D-6B83
Directory of C:\WINDOWS\System32
------ Temp Files in System32 Directory ------
Volume in drive C has no label.
Volume Serial Number is 289D-6B83
Directory of C:\WINDOWS\System32
09/22/2004 05:46 PM 20,480 setb4.tmp
08/18/2001 04:00 AM 2,577 CONFIG.TMP
2 File(s) 23,057 bytes
0 Dir(s) 2,187,153,408 bytes free
------------------ User Agent ----------------
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{7F54D3B9-49D5-8D4D-D6E4-8F6871E11C09}"=""
------------- Keys Under Notify -------------
REGEDIT4
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00
"Logoff"="ChainWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00
"Logoff"="CryptnetWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
"DllName"="C:\\WINDOWS\\system32\\NavLogon.dll"
"StartShell"="NavStartShellEvent"
"Logoff"="NavLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\URL]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\p0n8la5u1d.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
------------- Locate.com Results -------------
C:\WINDOWS\SYSTEM32\
aai3duag.dll Mon Jan 24 2005 11:19:48a ..S.R 224,757 219.49 K
adcups.dll Tue Jan 25 2005 9:36:36p ..S.R 225,733 220.44 K
awhprxy.dll Sat Jan 29 2005 7:58:14p ..S.R 222,991 217.76 K
awl.dll Sun Jan 9 2005 2:30:46a ..S.R 224,757 219.49 K
cltsrvps.dll Thu Jan 27 2005 4:55:54p ..S.R 224,814 219.54 K
cma.dll Sat Jan 22 2005 7:44:38p ..S.R 224,757 219.49 K
cpbcatex.dll Thu Jan 6 2005 7:48:32p ..S.R 224,757 219.49 K
csnmhook.dll Mon Jan 24 2005 12:34:26a ..S.R 225,921 220.63 K
cstsrvut.dll Sat Feb 5 2005 7:37:06p ..S.R 226,273 220.97 K
csvfat.dll Fri Jan 7 2005 2:54:26p ..S.R 224,757 219.49 K
dgtaclen.dll Wed Feb 2 2005 11:47:28p ..S.R 224,839 219.57 K
dkband.dll Wed Mar 16 2005 1:46:54a ..S.R 233,248 227.78 K
dmrpsetu.dll Sat Jan 29 2005 10:19:26a ..S.R 223,065 217.84 K
dnsetup.dll Fri Mar 18 2005 1:35:24p ..S.R 233,306 227.84 K
dtcpcsvc.dll Sat Feb 5 2005 7:00:54p ..S.R 224,839 219.57 K
dunet.dll Sat Jan 29 2005 5:24:38p ..S.R 222,808 217.59 K
dzeml.dll Mon Feb 7 2005 8:31:02a ..S.R 223,446 218.21 K
e6202g~1.dll Fri Mar 18 2005 5:26:10p ..S.R 233,306 227.84 K
fp0o03~1.dll Tue Mar 15 2005 11:26:18a ..S.R 233,039 227.57 K
fp6s03~1.dll Tue Mar 1 2005 12:49:34p ..S.R 223,620 218.38 K
fp8203~1.dll Tue Feb 22 2005 6:04:04p ..S.R 225,299 220.02 K
fprm03~1.dll Mon Feb 28 2005 9:44:20a ..S.R 226,069 220.77 K
fysrch.dll Fri Mar 18 2005 1:52:08a ..S.R 233,248 227.78 K
h82oli~1.dll Thu Mar 10 2005 8:35:54a ..S.R 224,147 218.89 K
iamui.dll Sun Jan 30 2005 11:06:54p ..S.R 222,808 217.59 K
ifsecsvc.dll Sat Jan 29 2005 12:41:48p ..S.R 225,392 220.11 K
insacct.dll Mon Jan 24 2005 8:32:12p ..S.R 222,577 217.36 K
ir24l5~1.dll Sat Feb 12 2005 11:43:44a ..S.R 222,920 217.70 K
irfosoft.dll Sat Feb 5 2005 4:34:24p ..S.R 223,081 217.85 K
ixetmib1.dll Mon Jan 24 2005 2:06:40p ..S.R 225,921 220.63 K
jsbexec.dll Mon Jan 24 2005 10:43:14p ..S.R 223,120 217.89 K
jtn207~1.dll Wed Feb 23 2005 8:10:02a ..S.R 225,273 219.99 K
kjdhela2.dll Tue Feb 1 2005 5:28:44p ..S.R 224,839 219.57 K
ksdkor.dll Sat Jan 1 2005 2:42:40p ..S.R 225,921 220.63 K
ksdlt1.dll Tue Jan 25 2005 1:29:38p ..S.R 223,908 218.66 K
ksdsmsno.dll Thu Jan 20 2005 11:11:14a ..S.R 224,757 219.49 K
kxd101c.dll Mon Jan 24 2005 7:28:50p ..S.R 223,120 217.89 K
kzdkaz.dll Thu Jan 27 2005 3:21:20p ..S.R 222,993 217.77 K
l0j8la~1.dll Tue Feb 22 2005 9:24:20a ..S.R 226,030 220.73 K
l8n40i~1.dll Wed Mar 16 2005 1:43:30a ..S.R 233,706 228.23 K
llexpand.dll Fri Mar 18 2005 5:34:38p ..S.R 235,156 229.64 K
lsvesnth.dll Tue Jan 25 2005 12:51:26p ..S.R 225,733 220.44 K
lv4u09~1.dll Sat Mar 12 2005 6:01:42p ..S.R 224,996 219.72 K
lv8u09~1.dll Tue Feb 22 2005 6:19:58p ..S.R 226,005 220.71 K
lvn809~1.dll Thu Mar 3 2005 9:05:18a ..S.R 222,857 217.63 K
ly0u09~1.dll Tue Feb 1 2005 9:33:18a ..S.R 223,717 218.47 K
mbminst.dll Wed Jan 5 2005 8:18:04p ..S.R 225,921 220.63 K
mchtmled.dll Sun Jan 2 2005 11:08:26p ..S.R 225,921 220.63 K
mdgsvc.dll Tue Feb 1 2005 1:17:56p ..S.R 222,808 217.59 K
meaatext.dll Wed Jan 19 2005 9:57:28a ..S.R 225,921 220.63 K
mevcrt.dll Mon Jan 17 2005 6:05:52p ..S.R 225,921 220.63 K
mhrdim.dll Sun Jan 23 2005 8:01:44p ..S.R 224,757 219.49 K
mpvidctl.dll Tue Jan 25 2005 11:42:00a ..S.R 223,908 218.66 K
mvpbde40.dll Wed Feb 2 2005 6:28:36p ..S.R 222,808 217.59 K
mxaatext.dll Thu Mar 17 2005 12:14:06a ..S.R 233,306 227.84 K
n64slg~1.dll Mon Mar 14 2005 9:51:08p ..S.R 223,081 217.85 K
njptools.dll Mon Jan 10 2005 6:50:54p ..S.R 225,921 220.63 K
nwmsapi.dll Fri Feb 4 2005 12:50:34p ..S.R 224,839 219.57 K
o0rola~1.dll Wed Feb 23 2005 8:27:50a ..S.R 222,903 217.68 K
oamanage.dll Tue Mar 15 2005 11:26:18a ..S.R 232,736 227.28 K
p0n8la~1.dll Fri Mar 18 2005 1:35:24p ..S.R 235,156 229.64 K
p6n8lg~1.dll Tue Feb 22 2005 3:07:06p ..S.R 225,016 219.74 K
phchdprf.dll Mon Mar 14 2005 9:51:08p ..S.R 224,996 219.72 K
pjn8lg~1.dll Wed Mar 16 2005 1:43:30a ..S.R 233,248 227.78 K
ptpgasvc.dll Wed Jan 26 2005 4:58:46p ..S.R 225,733 220.44 K
qgery.dll Sun Jan 23 2005 2:07:36a ..S.R 225,921 220.63 K
qlartz.dll Mon Jan 3 2005 5:20:04p ..S.R 224,757 219.49 K
r06ula~1.dll Fri Mar 18 2005 12:11:00p ..S.R 235,266 229.75 K
rgoc3260.dll Fri Jan 28 2005 5:59:06p ..S.R 224,814 219.54 K
rlsser.dll Wed Jan 26 2005 2:31:02p ..S.R 223,206 217.97 K
rtchost.dll Mon Mar 14 2005 9:51:22p ..S.R 232,736 227.28 K
sbi.dll Tue Jan 18 2005 8:35:20a ..S.R 224,757 219.49 K
smdocvw.dll Tue Jan 4 2005 9:19:16p ..S.R 225,921 220.63 K
t88u0i~1.dll Sat Jan 29 2005 9:31:12a ..S.R 222,993 217.77 K
tlpi3.dll Tue Jan 11 2005 9:38:52a ..S.R 224,757 219.49 K
u4ru0e~1.dll Mon Feb 7 2005 8:25:06a ..S.R 222,342 217.13 K
uarv80a.dll Tue Jan 25 2005 4:07:24p ..S.R 225,733 220.44 K
uerlbva.dll Sun Jan 16 2005 8:40:52a ..S.R 224,757 219.49 K
vhinit.dll Thu Jan 6 2005 7:53:42p ..S.R 225,921 220.63 K
vphelper.dll Thu Jan 13 2005 3:56:16p ..S.R 225,921 220.63 K
vsconfig.xml Fri Mar 18 2005 5:34:24p A..H. 890 0.87 K
wedap32.dll Mon Jan 24 2005 4:32:38p ..S.R 222,577 217.36 K
wewfaxui.dll Sat Feb 5 2005 7:45:32p ..S.R 222,342 217.13 K
wgavideo.dll Wed Jan 5 2005 5:27:30p ..S.R 224,757 219.49 K
wkcsvc.dll Tue Jan 25 2005 5:44:58p ..S.R 223,206 217.97 K
wl2time.dll Thu Feb 3 2005 2:20:16a ..S.R 223,081 217.85 K
wvashext.dll Sat Jan 29 2005 9:33:34a ..S.R 225,392 220.11 K
xtnroll.dll Sat Jan 8 2005 5:14:06p ..S.R 225,921 220.63 K
zecommdb.dll Fri Mar 18 2005 12:11:00p ..S.R 233,306 227.84 K
zllictbl.dat Sat Feb 5 2005 7:34:56p ...H. 4,212 4.11 K
90 items found: 90 files, 0 directories.
Total of file sizes: 19,889,012 bytes 18.96 M
-------- Strings.exe Qoologic Results --------
--------- Strings.exe Aspack Results ---------
C:\WINDOWS\system32\ntdll.dll: .aspack
-------------- HKLM Run Key ----------------
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"Zone Labs Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"
Hijackthis log:
Logfile of HijackThis v1.99.1
Scan saved at 1:41:04 PM, on 3/20/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\atievxx.exe
C:\Program Files\BigFix Enterprise\BES Client\BESClient.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Stanford\PC-Leland\krbcc32s.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopOE.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Sam the man\Desktop\URL Logic Fix\hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak =
http://www.stanford.edu/
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program
Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop
Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\WebRoot\Spy
Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [Active Desktop Calendar] C:\Program Files\XemiComputers\Active
Desktop Calendar\ADC.exe
O4 - Global Startup: PC-Leland.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -
C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) -
http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) -
https://a248.e.akamai.net/7/248/1149...t/qtplugin.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware
Scanner) - http://download.zonelabs.com/bin/pro...tor/WebAAS.cab
O16 - DPF: {A48D0309-8DA3-41AA-98E4-89194D471890} (Pulse V5 ActiveX Control) -
http://www.pulse3d.com/players/engli...er5.2AxWin.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) -
https://h17000.www1.hp.com/ewfrf-JAV...oadManager.ocx
O16 - DPF: {CE8267C2-D41A-4A50-A69D-F32B5C289F14} (FileOpenInstaller) -
http://64.106.242.160/0664/FileOpen.CAB
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: BES Client (BESClient) - BigFix Inc. - C:\Program Files\BigFix Enterprise\BES
Client\BESClient.exe
O23 - Service: DefWatch - Symantec Corporation -
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation
- C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. -
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
After running Findqoologic this is what I got in the start.txt, log.txt, and win.txt files:
start.txt - The file was empty.
win.txt:
C:\WINDOWS\system32\ntdll.dll: .aspack
log.txt:
C:\Documents and Settings\Sam the man\Desktop\URL Logic Fix\findqoologic
PLEASE NOTE THAT ALL FILES FOUND BY THIS METHOD ARE NOT BAD FILES, THERE MIGHT BE LEGIT FILES LISTED AND PLEASE BE CAREFUL WHILE FIXING. IF YOU ARE UNSURE OF WHAT IT IS LEAVE THEM ALONE.
Files Found in system Folder............
------------------------
C:\WINDOWS\system32\ntdll.dll: .aspack
Files Found in all users startup Folder............
------------------------
l2mfix log:
Warning! This utility will find legitimate files in addition to malware.
Do not remove anything unless you are sure you know what you're doing.
Find.bat is running from: C:\Documents and Settings\Sam the man\Desktop\URL Logic Fix\Find It NT-2K-XP\Find It NT-2K-XP
------- System Files in System32 Directory -------
Volume in drive C has no label.
Volume Serial Number is 289D-6B83
Directory of C:\WINDOWS\System32
03/18/2005 05:34 PM 235,156 llexpand.dll
03/18/2005 05:26 PM 233,306 e6202gfmg62a2.dll
03/18/2005 01:35 PM 233,306 dnsetup.dll
03/18/2005 01:35 PM 235,156 p0n8la5u1d.dll
03/18/2005 12:10 PM 233,306 zecommdb.dll
03/18/2005 12:10 PM 235,266 r06ulaj91do.dll
03/18/2005 01:52 AM 233,248 fysrch.dll
03/17/2005 12:14 AM 233,306 mxaatext.dll
03/16/2005 01:46 AM 233,248 dkband.dll
03/16/2005 01:43 AM 233,248 pJn8lg5u16.dll
03/16/2005 01:43 AM 233,706 l8n40i5qe8.dll
03/15/2005 11:26 AM 232,736 oamanage.dll
03/15/2005 11:26 AM 233,039 fp0o03d3e.dll
03/14/2005 09:51 PM 232,736 rtchost.dll
03/14/2005 09:51 PM 224,996 phchdprf.dll
03/14/2005 09:51 PM 223,081 n64slgh7164.dll
03/12/2005 06:01 PM 224,996 lv4u09h9e.dll
03/10/2005 08:35 AM 224,147 h82olif3182.dll
03/03/2005 09:05 AM 222,857 lvn8095ue.dll
03/01/2005 12:49 PM 223,620 fp6s03j7e.dll
02/28/2005 09:44 AM 226,069 fprm0391e.dll
02/23/2005 08:27 AM 222,903 o0rola931d.dll
02/23/2005 08:10 AM 225,273 jtn2075oe.dll
02/22/2005 06:19 PM 226,005 lv8u09l9e.dll
02/22/2005 06:04 PM 225,299 fp8203loe.dll
02/22/2005 03:07 PM 225,016 p6n8lg5u16.dll
02/22/2005 09:24 AM 226,030 l0j8la1u1d.dll
02/12/2005 11:43 AM 222,920 ir24l5fq1.dll
02/08/2005 05:42 PM <DIR> dllcache
02/07/2005 08:31 AM 223,446 dzeml.dll
02/07/2005 08:25 AM 222,342 u4ru0e99eh.dll
02/05/2005 07:45 PM 222,342 wewfaxui.dll
02/05/2005 07:37 PM 226,273 cStsrvut.dll
02/05/2005 07:00 PM 224,839 dtcpcsvc.dll
02/05/2005 04:34 PM 223,081 irfosoft.dll
02/04/2005 12:50 PM 224,839 nwmsapi.dll
02/03/2005 02:20 AM 223,081 wL2time.dll
02/02/2005 11:47 PM 224,839 dGtaclen.dll
02/02/2005 06:28 PM 222,808 mvpbde40.dll
02/01/2005 05:28 PM 224,839 kjdhela2.dll
02/01/2005 01:17 PM 222,808 mdgsvc.dll
02/01/2005 09:33 AM 223,717 ly0u09d9e.dll
01/30/2005 11:06 PM 222,808 iamui.dll
01/29/2005 07:58 PM 222,991 AWHPRXY.DLL
01/29/2005 05:24 PM 222,808 dunet.dll
01/29/2005 12:41 PM 225,392 ifsecsvc.dll
01/29/2005 10:19 AM 223,065 dmrpsetu.dll
01/29/2005 09:33 AM 225,392 wvashext.dll
01/29/2005 09:31 AM 222,993 t88u0il9e8q.dll
01/28/2005 05:59 PM 224,814 rgoc3260.dll
01/27/2005 04:55 PM 224,814 cLtsrvps.dll
01/27/2005 03:21 PM 222,993 kzdkaz.dll
01/26/2005 04:58 PM 225,733 pTpgasvc.dll
01/26/2005 02:31 PM 223,206 rLsser.dll
01/25/2005 09:36 PM 225,733 adcups.dll
01/25/2005 05:44 PM 223,206 wkcsvc.dll
01/25/2005 04:07 PM 225,733 uarv80a.dll
01/25/2005 01:29 PM 223,908 ksdlt1.dll
01/25/2005 12:51 PM 225,733 lsvesnth.dll
01/25/2005 11:41 AM 223,908 mpvidctl.dll
01/24/2005 10:43 PM 223,120 jsbexec.dll
01/24/2005 08:32 PM 222,577 iNsacct.dll
01/24/2005 07:28 PM 223,120 kxd101c.dll
01/24/2005 04:32 PM 222,577 wedap32.dll
01/24/2005 02:06 PM 225,921 ixetmib1.dll
01/24/2005 11:19 AM 224,757 aai3duag.dll
01/24/2005 12:34 AM 225,921 Csnmhook.dll
01/23/2005 08:01 PM 224,757 mhrdim.dll
01/23/2005 02:07 AM 225,921 qgery.dll
01/22/2005 07:44 PM 224,757 CMA.DLL
01/20/2005 11:11 AM 224,757 ksdsmsno.dll
01/19/2005 09:57 AM 225,921 meaatext.dll
01/18/2005 08:35 AM 224,757 sbi.dll
01/17/2005 06:05 PM 225,921 mevcrt.dll
01/16/2005 08:40 AM 224,757 uerlbva.dll
01/13/2005 03:56 PM 225,921 vphelper.dll
01/11/2005 09:38 AM 224,757 tLpi3.dll
01/10/2005 06:50 PM 225,921 njptools.dll
01/09/2005 02:30 AM 224,757 awl.dll
01/08/2005 05:14 PM 225,921 xtnroll.dll
01/07/2005 02:54 PM 224,757 csvfat.dll
01/06/2005 07:53 PM 225,921 vhinit.dll
01/06/2005 07:48 PM 224,757 cpbcatex.dll
01/05/2005 08:18 PM 225,921 mbminst.dll
01/05/2005 05:27 PM 224,757 wgavideo.dll
01/04/2005 09:19 PM 225,921 smdocvw.dll
01/03/2005 05:20 PM 224,757 qlartz.dll
01/02/2005 11:08 PM 225,921 mchtmled.dll
01/01/2005 02:42 PM 225,921 ksdkor.dll
12/16/2004 04:44 PM 224,757 kadfr.dll
12/16/2004 11:54 AM 225,921 mdrle32.dll
12/14/2004 10:39 PM 224,757 svclient.dll
12/13/2004 02:47 PM 224,757 chvfat.dll
12/11/2004 09:16 AM 225,411 slorage.dll
12/09/2004 07:04 PM 224,757 rRsauto.dll
12/09/2004 06:56 PM 224,757 kzduk.dll
12/09/2004 06:54 PM 224,757 lvp4097qe.dll
12/08/2004 01:07 PM 224,757 qyv.dll
12/07/2004 11:52 AM 224,757 aitiveds.dll
12/07/2004 01:34 AM 224,757 mid32.dll
12/06/2004 06:23 PM 224,757 mdisip.dll
12/06/2004 01:19 PM 224,757 ozbcji32.dll
12/06/2004 12:47 PM 224,757 k080lalm1dqa.dll
12/06/2004 11:55 AM 226,182 en86l1ls1.dll
12/06/2004 11:38 AM 224,757 nzshrui.dll
07/31/2004 06:32 PM <DIR> Microsoft
104 File(s) 23,483,265 bytes
2 Dir(s) 2,187,149,312 bytes free
------- Hidden Files in System32 Directory -------
Volume in drive C has no label.
Volume Serial Number is 289D-6B83
Directory of C:\WINDOWS\System32
03/18/2005 05:34 PM 890 vsconfig.xml
02/08/2005 05:42 PM <DIR> dllcache
02/05/2005 07:34 PM 4,212 zllictbl.dat
04/18/2004 07:49 PM 488 WindowsLogon.manifest
04/18/2004 07:49 PM 488 logonui.exe.manifest
04/18/2004 07:48 PM 749 sapi.cpl.manifest
04/18/2004 07:48 PM 749 wuaucpl.cpl.manifest
04/18/2004 07:48 PM 749 cdplayer.exe.manifest
04/18/2004 07:48 PM 749 nwc.cpl.manifest
04/18/2004 07:48 PM 749 ncpa.cpl.manifest
9 File(s) 9,823 bytes
1 Dir(s) 2,187,145,216 bytes free
------------ Files Named "Guard" ---------------
Volume in drive C has no label.
Volume Serial Number is 289D-6B83
Directory of C:\WINDOWS\System32
------ Temp Files in System32 Directory ------
Volume in drive C has no label.
Volume Serial Number is 289D-6B83
Directory of C:\WINDOWS\System32
09/22/2004 05:46 PM 20,480 setb4.tmp
08/18/2001 04:00 AM 2,577 CONFIG.TMP
2 File(s) 23,057 bytes
0 Dir(s) 2,187,153,408 bytes free
------------------ User Agent ----------------
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\User Agent\Post Platform]
"{7F54D3B9-49D5-8D4D-D6E4-8F6871E11C09}"=""
------------- Keys Under Notify -------------
REGEDIT4
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\crypt32chain]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,33,32,2e,64,6c,6c,00
"Logoff"="ChainWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cryptnet]
"Asynchronous"=dword:00000000
"Impersonate"=dword:00000000
"DllName"=hex(2):63,72,79,70,74,6e,65,74,2e,64,6c,6c,00
"Logoff"="CryptnetWlxLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cscdll]
"DLLName"="cscdll.dll"
"Logon"="WinlogonLogonEvent"
"Logoff"="WinlogonLogoffEvent"
"ScreenSaver"="WinlogonScreenSaverEvent"
"Startup"="WinlogonStartupEvent"
"Shutdown"="WinlogonShutdownEvent"
"StartShell"="WinlogonStartShellEvent"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\NavLogon]
"DllName"="C:\\WINDOWS\\system32\\NavLogon.dll"
"StartShell"="NavStartShellEvent"
"Logoff"="NavLogoffEvent"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ScCertProp]
"DLLName"="wlnotify.dll"
"Logon"="SCardStartCertProp"
"Logoff"="SCardStopCertProp"
"Lock"="SCardSuspendCertProp"
"Unlock"="SCardResumeCertProp"
"Enabled"=dword:00000001
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\Schedule]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00
"Impersonate"=dword:00000000
"StartShell"="SchedStartShell"
"Logoff"="SchedEventLogOff"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\sclgntfy]
"Logoff"="WLEventLogoff"
"Impersonate"=dword:00000000
"Asynchronous"=dword:00000001
"DllName"=hex(2):73,63,6c,67,6e,74,66,79,2e,64,6c,6c,00
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\SensLogn]
"DLLName"="WlNotify.dll"
"Lock"="SensLockEvent"
"Logon"="SensLogonEvent"
"Logoff"="SensLogoffEvent"
"Safe"=dword:00000001
"MaxWait"=dword:00000258
"StartScreenSaver"="SensStartScreenSaverEvent"
"StopScreenSaver"="SensStopScreenSaverEvent"
"Startup"="SensStartupEvent"
"Shutdown"="SensShutdownEvent"
"StartShell"="SensStartShellEvent"
"PostShell"="SensPostShellEvent"
"Disconnect"="SensDisconnectEvent"
"Reconnect"="SensReconnectEvent"
"Unlock"="SensUnlockEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\termsrv]
"Asynchronous"=dword:00000000
"DllName"=hex(2):77,6c,6e,6f,74,69,66,79,2e,64,6c,6c,00
"Impersonate"=dword:00000000
"Logoff"="TSEventLogoff"
"Logon"="TSEventLogon"
"PostShell"="TSEventPostShell"
"Shutdown"="TSEventShutdown"
"StartShell"="TSEventStartShell"
"Startup"="TSEventStartup"
"MaxWait"=dword:00000258
"Reconnect"="TSEventReconnect"
"Disconnect"="TSEventDisconnect"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\URL]
"Asynchronous"=dword:00000000
"DllName"="C:\\WINDOWS\\system32\\p0n8la5u1d.dll"
"Impersonate"=dword:00000000
"Logon"="WinLogon"
"Logoff"="WinLogoff"
"Shutdown"="WinShutdown"
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\wlballoon]
"DLLName"="wlnotify.dll"
"Logon"="RegisterTicketExpiredNotificationEvent"
"Logoff"="UnregisterTicketExpiredNotificationEvent"
"Impersonate"=dword:00000001
"Asynchronous"=dword:00000001
------------- Locate.com Results -------------
C:\WINDOWS\SYSTEM32\
aai3duag.dll Mon Jan 24 2005 11:19:48a ..S.R 224,757 219.49 K
adcups.dll Tue Jan 25 2005 9:36:36p ..S.R 225,733 220.44 K
awhprxy.dll Sat Jan 29 2005 7:58:14p ..S.R 222,991 217.76 K
awl.dll Sun Jan 9 2005 2:30:46a ..S.R 224,757 219.49 K
cltsrvps.dll Thu Jan 27 2005 4:55:54p ..S.R 224,814 219.54 K
cma.dll Sat Jan 22 2005 7:44:38p ..S.R 224,757 219.49 K
cpbcatex.dll Thu Jan 6 2005 7:48:32p ..S.R 224,757 219.49 K
csnmhook.dll Mon Jan 24 2005 12:34:26a ..S.R 225,921 220.63 K
cstsrvut.dll Sat Feb 5 2005 7:37:06p ..S.R 226,273 220.97 K
csvfat.dll Fri Jan 7 2005 2:54:26p ..S.R 224,757 219.49 K
dgtaclen.dll Wed Feb 2 2005 11:47:28p ..S.R 224,839 219.57 K
dkband.dll Wed Mar 16 2005 1:46:54a ..S.R 233,248 227.78 K
dmrpsetu.dll Sat Jan 29 2005 10:19:26a ..S.R 223,065 217.84 K
dnsetup.dll Fri Mar 18 2005 1:35:24p ..S.R 233,306 227.84 K
dtcpcsvc.dll Sat Feb 5 2005 7:00:54p ..S.R 224,839 219.57 K
dunet.dll Sat Jan 29 2005 5:24:38p ..S.R 222,808 217.59 K
dzeml.dll Mon Feb 7 2005 8:31:02a ..S.R 223,446 218.21 K
e6202g~1.dll Fri Mar 18 2005 5:26:10p ..S.R 233,306 227.84 K
fp0o03~1.dll Tue Mar 15 2005 11:26:18a ..S.R 233,039 227.57 K
fp6s03~1.dll Tue Mar 1 2005 12:49:34p ..S.R 223,620 218.38 K
fp8203~1.dll Tue Feb 22 2005 6:04:04p ..S.R 225,299 220.02 K
fprm03~1.dll Mon Feb 28 2005 9:44:20a ..S.R 226,069 220.77 K
fysrch.dll Fri Mar 18 2005 1:52:08a ..S.R 233,248 227.78 K
h82oli~1.dll Thu Mar 10 2005 8:35:54a ..S.R 224,147 218.89 K
iamui.dll Sun Jan 30 2005 11:06:54p ..S.R 222,808 217.59 K
ifsecsvc.dll Sat Jan 29 2005 12:41:48p ..S.R 225,392 220.11 K
insacct.dll Mon Jan 24 2005 8:32:12p ..S.R 222,577 217.36 K
ir24l5~1.dll Sat Feb 12 2005 11:43:44a ..S.R 222,920 217.70 K
irfosoft.dll Sat Feb 5 2005 4:34:24p ..S.R 223,081 217.85 K
ixetmib1.dll Mon Jan 24 2005 2:06:40p ..S.R 225,921 220.63 K
jsbexec.dll Mon Jan 24 2005 10:43:14p ..S.R 223,120 217.89 K
jtn207~1.dll Wed Feb 23 2005 8:10:02a ..S.R 225,273 219.99 K
kjdhela2.dll Tue Feb 1 2005 5:28:44p ..S.R 224,839 219.57 K
ksdkor.dll Sat Jan 1 2005 2:42:40p ..S.R 225,921 220.63 K
ksdlt1.dll Tue Jan 25 2005 1:29:38p ..S.R 223,908 218.66 K
ksdsmsno.dll Thu Jan 20 2005 11:11:14a ..S.R 224,757 219.49 K
kxd101c.dll Mon Jan 24 2005 7:28:50p ..S.R 223,120 217.89 K
kzdkaz.dll Thu Jan 27 2005 3:21:20p ..S.R 222,993 217.77 K
l0j8la~1.dll Tue Feb 22 2005 9:24:20a ..S.R 226,030 220.73 K
l8n40i~1.dll Wed Mar 16 2005 1:43:30a ..S.R 233,706 228.23 K
llexpand.dll Fri Mar 18 2005 5:34:38p ..S.R 235,156 229.64 K
lsvesnth.dll Tue Jan 25 2005 12:51:26p ..S.R 225,733 220.44 K
lv4u09~1.dll Sat Mar 12 2005 6:01:42p ..S.R 224,996 219.72 K
lv8u09~1.dll Tue Feb 22 2005 6:19:58p ..S.R 226,005 220.71 K
lvn809~1.dll Thu Mar 3 2005 9:05:18a ..S.R 222,857 217.63 K
ly0u09~1.dll Tue Feb 1 2005 9:33:18a ..S.R 223,717 218.47 K
mbminst.dll Wed Jan 5 2005 8:18:04p ..S.R 225,921 220.63 K
mchtmled.dll Sun Jan 2 2005 11:08:26p ..S.R 225,921 220.63 K
mdgsvc.dll Tue Feb 1 2005 1:17:56p ..S.R 222,808 217.59 K
meaatext.dll Wed Jan 19 2005 9:57:28a ..S.R 225,921 220.63 K
mevcrt.dll Mon Jan 17 2005 6:05:52p ..S.R 225,921 220.63 K
mhrdim.dll Sun Jan 23 2005 8:01:44p ..S.R 224,757 219.49 K
mpvidctl.dll Tue Jan 25 2005 11:42:00a ..S.R 223,908 218.66 K
mvpbde40.dll Wed Feb 2 2005 6:28:36p ..S.R 222,808 217.59 K
mxaatext.dll Thu Mar 17 2005 12:14:06a ..S.R 233,306 227.84 K
n64slg~1.dll Mon Mar 14 2005 9:51:08p ..S.R 223,081 217.85 K
njptools.dll Mon Jan 10 2005 6:50:54p ..S.R 225,921 220.63 K
nwmsapi.dll Fri Feb 4 2005 12:50:34p ..S.R 224,839 219.57 K
o0rola~1.dll Wed Feb 23 2005 8:27:50a ..S.R 222,903 217.68 K
oamanage.dll Tue Mar 15 2005 11:26:18a ..S.R 232,736 227.28 K
p0n8la~1.dll Fri Mar 18 2005 1:35:24p ..S.R 235,156 229.64 K
p6n8lg~1.dll Tue Feb 22 2005 3:07:06p ..S.R 225,016 219.74 K
phchdprf.dll Mon Mar 14 2005 9:51:08p ..S.R 224,996 219.72 K
pjn8lg~1.dll Wed Mar 16 2005 1:43:30a ..S.R 233,248 227.78 K
ptpgasvc.dll Wed Jan 26 2005 4:58:46p ..S.R 225,733 220.44 K
qgery.dll Sun Jan 23 2005 2:07:36a ..S.R 225,921 220.63 K
qlartz.dll Mon Jan 3 2005 5:20:04p ..S.R 224,757 219.49 K
r06ula~1.dll Fri Mar 18 2005 12:11:00p ..S.R 235,266 229.75 K
rgoc3260.dll Fri Jan 28 2005 5:59:06p ..S.R 224,814 219.54 K
rlsser.dll Wed Jan 26 2005 2:31:02p ..S.R 223,206 217.97 K
rtchost.dll Mon Mar 14 2005 9:51:22p ..S.R 232,736 227.28 K
sbi.dll Tue Jan 18 2005 8:35:20a ..S.R 224,757 219.49 K
smdocvw.dll Tue Jan 4 2005 9:19:16p ..S.R 225,921 220.63 K
t88u0i~1.dll Sat Jan 29 2005 9:31:12a ..S.R 222,993 217.77 K
tlpi3.dll Tue Jan 11 2005 9:38:52a ..S.R 224,757 219.49 K
u4ru0e~1.dll Mon Feb 7 2005 8:25:06a ..S.R 222,342 217.13 K
uarv80a.dll Tue Jan 25 2005 4:07:24p ..S.R 225,733 220.44 K
uerlbva.dll Sun Jan 16 2005 8:40:52a ..S.R 224,757 219.49 K
vhinit.dll Thu Jan 6 2005 7:53:42p ..S.R 225,921 220.63 K
vphelper.dll Thu Jan 13 2005 3:56:16p ..S.R 225,921 220.63 K
vsconfig.xml Fri Mar 18 2005 5:34:24p A..H. 890 0.87 K
wedap32.dll Mon Jan 24 2005 4:32:38p ..S.R 222,577 217.36 K
wewfaxui.dll Sat Feb 5 2005 7:45:32p ..S.R 222,342 217.13 K
wgavideo.dll Wed Jan 5 2005 5:27:30p ..S.R 224,757 219.49 K
wkcsvc.dll Tue Jan 25 2005 5:44:58p ..S.R 223,206 217.97 K
wl2time.dll Thu Feb 3 2005 2:20:16a ..S.R 223,081 217.85 K
wvashext.dll Sat Jan 29 2005 9:33:34a ..S.R 225,392 220.11 K
xtnroll.dll Sat Jan 8 2005 5:14:06p ..S.R 225,921 220.63 K
zecommdb.dll Fri Mar 18 2005 12:11:00p ..S.R 233,306 227.84 K
zllictbl.dat Sat Feb 5 2005 7:34:56p ...H. 4,212 4.11 K
90 items found: 90 files, 0 directories.
Total of file sizes: 19,889,012 bytes 18.96 M
-------- Strings.exe Qoologic Results --------
--------- Strings.exe Aspack Results ---------
C:\WINDOWS\system32\ntdll.dll: .aspack
-------------- HKLM Run Key ----------------
REGEDIT4
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="\"C:\\Program Files\\Common Files\\Real\\Update_OB\\realsched.exe\" -osboot"
"Zone Labs Client"="\"C:\\Program Files\\Zone Labs\\ZoneAlarm\\zlclient.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\IMAIL]
"Installed"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\OptionalComponents\MSFS]
"Installed"="1"
Hijackthis log:
Logfile of HijackThis v1.99.1
Scan saved at 1:41:04 PM, on 3/20/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\System32\atievxx.exe
C:\Program Files\BigFix Enterprise\BES Client\BESClient.exe
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\Program Files\Stanford\PC-Leland\krbcc32s.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopIndex.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopCrawl.exe
C:\Program Files\Google\Google Desktop Search\GoogleDesktopOE.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\Sam the man\Desktop\URL Logic Fix\hijackthis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page_bak =
http://www.stanford.edu/
O1 - Hosts: 69.20.16.183 ieautosearch
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program
Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common
Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop
Search\GoogleDesktop.exe" /startup
O4 - HKCU\..\Run: [SpySweeper] "C:\Program Files\WebRoot\Spy
Sweeper\SpySweeper.exe" /0
O4 - HKCU\..\Run: [Active Desktop Calendar] C:\Program Files\XemiComputers\Active
Desktop Calendar\ADC.exe
O4 - Global Startup: PC-Leland.lnk = ?
O8 - Extra context menu item: E&xport to Microsoft Excel -
res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} -
C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program
Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger -
{FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) -
http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) -
https://a248.e.akamai.net/7/248/1149...t/qtplugin.cab
O16 - DPF: {9B03C5F1-F5AB-47EE-937D-A8EDA626F876} (Anonymizer Anti-Spyware
Scanner) - http://download.zonelabs.com/bin/pro...tor/WebAAS.cab
O16 - DPF: {A48D0309-8DA3-41AA-98E4-89194D471890} (Pulse V5 ActiveX Control) -
http://www.pulse3d.com/players/engli...er5.2AxWin.cab
O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) -
https://h17000.www1.hp.com/ewfrf-JAV...oadManager.ocx
O16 - DPF: {CE8267C2-D41A-4A50-A69D-F32B5C289F14} (FileOpenInstaller) -
http://64.106.242.160/0664/FileOpen.CAB
O20 - Winlogon Notify: NavLogon - C:\WINDOWS\system32\NavLogon.dll
O23 - Service: BES Client (BESClient) - BigFix Inc. - C:\Program Files\BigFix Enterprise\BES
Client\BESClient.exe
O23 - Service: DefWatch - Symantec Corporation -
C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation
- C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. -
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
|
Similar Threads
- Can't get rid of Unlock Keychain pop-up thingy! (OS X)
- pop ups and trojans (hijackthis log) (Viruses, Spyware and other Nasties)
- Can't get rid of pop up (Viruses, Spyware and other Nasties)
Other Threads in the Viruses, Spyware and other Nasties Forum
- Previous Thread: Trojan Krepper.y?
- Next Thread: I think i am keeping my computer clean!
| Thread Tools | Search this Thread |
You need to join our community in order to build your list of favorite forums. You can visit the forum index for a listing of all forums.
Related Forum Features
Latest Viruses, Spyware and other Nasties Posts
adware anti-malware anti-virussitesaccessissue antivirus attack audio avg backtoschoolspeech bar blackhat botnet botnets censorship china commercial commercials conficker connect control crosssitescripting cyber cybercrime cyberwarfare ddos domains e-mafia education email europe exam exploit facebook fake fancheckvirus gaming gumblar halloween herss.exe hijack hosting internet iphone kaspersky legal logfiles mail malware mcafee mega-d messagelabs microsoft mobile nazi news obama onlinethreats paedophile panel parents patch phishing police policeprovirusmba-mblockedinternetaccess president privacy pro problem redirect redirecting reliability report research risk rogueantivirus samhain sans scareware school search security seopoisoning software spam spyware spywareexternalwindows7adminstratortrojans sqlinjection symantec trojan unwanted update usa virus viruses vista war warning windows worm yahoo zeroday
