"downloader.agent.gat" and "downloader.purityscan.eg"

Question

minakochan 0 Newbie Poster

16 Years Ago

Hello! I have been trying to clean out my laptop for the past few days and I think I've gotten most of it under control. However, these two items keep popping up in my AVG scans even after I've quarantined them.

I have included my AVG and HJT logs. Any help is greatly appreciated! :)

---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------

+ Created at: 12:28:21 PM 12/23/2007

+ Scan result:

C:\System Volume Information\_restore{1EA91CBB-665E-4984-A23B-4EC66935C935}\RP82\A0010328.exe -> Downloader.Agent.gat : No action taken.
C:\System Volume Information\_restore{1EA91CBB-665E-4984-A23B-4EC66935C935}\RP82\A0010329.exe -> Downloader.PurityScan.eg : No action taken.

::Report end

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:30:14 PM, on 12/23/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\progra~1\mozill~1\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {69884846-21DB-44CB-8012-317B3610545E} - C:\WINDOWS\system32\iiiig.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: {2a95bdf4-c4d4-e9bb-38d4-1c4acb8dc298} - {892cd8bc-a4c1-4d83-bb9e-4d4c4fdb59a2} - C:\WINDOWS\system32\qrscagxb.dll (file missing)
O2 - BHO: (no name) - {CDD9AC4D-13FA-0D2A-DA2A-30E671880A96} - C:\WINDOWS\system32\iypujh.dll (file missing)
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Meub] "C:\PROGRA~1\COMMON~1\PPATCH~1\msconfig.exe" -vt yazb
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O20 - Winlogon Notify: awtspnn - awtspnn.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe

--
End of file - 5774 bytes

windows-virus

2 Contributors
7 Replies
76 Views
18 Hours Discussion Span
Latest Post 16 Years Ago Latest Post by crunchie

All 7 Replies

crunchie 990 Most Valuable Poster

16 Years Ago

Hi and welcome to Daniweb forums :).

You must download it to and run it from your Desktop
Physically disconnect from the internet.
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log
Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

crunchie 990 Most Valuable Poster

16 Years Ago

Can you please do the following.

===============

Scan with HijackThis and then place a check next to all the following, if present:

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank

O2 - BHO: (no name) - {69884846-21DB-44CB-8012-317B3610545E} - C:\WINDOWS\system32\iiiig.dll (file missing)
O2 - BHO: {2a95bdf4-c4d4-e9bb-38d4-1c4acb8dc298} - {892cd8bc-a4c1-4d83-bb9e-4d4c4fdb59a2} - C:\WINDOWS\system32\qrscagxb.dll (file missing)
O2 - BHO: (no name) - {CDD9AC4D-13FA-0D2A-DA2A-30E671880A96} - C:\WINDOWS\system32\iypujh.dll (file missing)

O4 - HKCU\..\Run: [Meub] "C:\PROGRA~1\COMMON~1\PPATCH~1\msconfig.exe" -vt yazb

O20 - Winlogon Notify: awtspnn - awtspnn.dll (file missing)

Now, close all instances of Internet Explorer and any other windows you have open except HiJackThis, click "Fix checked".

===============

Locate and delete the following item(s), if present. Make sure you are able to view system and hidden files/ folders:

folders...

C:\PROGRA~1\COMMON~1\PPATCH~1

-

Note that some of these file(s)/folder(s) may or may not be present. If present, and cannot be deleted because they're 'in use', try deleting them in Safe Mode by doing the following:

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
Instead of Windows loading as normal, a menu should appear.

Select the first option to run Windows in Safe Mode hit enter.

-

Reboot.

===============

After rebooting, rescan with hijackthis and post back a new log. Please let me know how your pc is now.

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

minakochan 0 Newbie Poster · Answer 1 · 2007-12-24T05:39:29+00:00

Thank you for your response and friendly welcome~! I followed your instructions and here are my resulting logs:

ComboFix 07-12-21.4 - mina 2007-12-23 15:28:52.1 - NTFSx86
Microsoft Windows XP Home Edition  5.1.2600.2.1252.1.1033.18.288 [GMT -8:00]
Running from: C:\Documents and Settings\mina\Desktop\ComboFix.exe
* Created a new restore point
.


(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))
.


C:\Documents and Settings\mina\Start Menu\Programs\Internet Speed Monitor
C:\Documents and Settings\mina\Start Menu\Programs\Internet Speed Monitor\Check Now.lnk
C:\Documents and Settings\mina\Start Menu\Programs\Internet Speed Monitor\Uninstall.lnk
C:\Documents and Settings\mina\Start Menu\Programs\Outerinfo
C:\Documents and Settings\mina\Start Menu\Programs\Outerinfo\Terms.lnk
C:\Documents and Settings\mina\Start Menu\Programs\Outerinfo\Uninstall.lnk
C:\Program Files\Common Files\Yazzle1552OinUninstaller.exe
C:\Program Files\ISM
C:\Program Files\ISM\ism.exe
C:\Program Files\ISM\Uninstall.exe
C:\Program Files\Temporary


.
(((((((((((((((((((((((((   Files Created from 2007-11-23 to 2007-12-23  )))))))))))))))))))))))))))))))
.


2007-12-22 23:27 . 2007-12-22 23:27 <DIR>    d--------   C:\Documents and Settings\mina\Application Data\Grisoft
2007-12-22 23:27 . 2007-12-22 23:27 <DIR>    d--------   C:\Documents and Settings\All Users\Application Data\Grisoft
2007-12-22 23:27 . 2007-05-30 04:10 10,872  --a------   C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-12-22 21:07 . 2007-12-22 21:31 <DIR>    d--------   C:\VundoFix Backups
2007-12-22 20:50 . 2007-12-22 20:50 14,033  --a------   C:\pos9C3.tmp
2007-12-22 20:50 . 2007-12-22 20:50 6,033   --a------   C:\pos9C4.tmp
2007-12-22 20:48 . 2007-12-22 20:49 14,033  --a------   C:\pos813.tmp
2007-12-22 00:12 . 2007-12-22 00:22 14,033  --a------   C:\pos7CF.tmp
2007-12-22 00:11 . 2007-12-22 00:11 14,033  --a------   C:\pos7A8.tmp
2007-12-22 00:10 . 2007-12-22 00:11 14,033  --a------   C:\pos5FB.tmp
2007-12-22 00:08 . 2007-12-22 00:08 14,033  --a------   C:\pos5BA.tmp
2007-12-21 19:34 . 2007-12-21 19:34 14,033  --a------   C:\pos3E8.tmp
2007-12-21 19:33 . 2007-12-21 19:33 14,033  --a------   C:\posF.tmp
2007-12-21 16:45 . 2007-12-21 16:45 14,033  --a------   C:\pos22C.tmp
2007-12-21 16:44 . 2007-12-21 16:44 165,472 --a------   C:\WINDOWS\system32\atwnmoic.dll
2007-12-19 21:18 . 2007-12-19 21:25 <DIR>    d--------   C:\Program Files\Winamp
2007-12-19 21:18 . 2007-12-19 21:28 <DIR>    d--------   C:\Documents and Settings\mina\Application Data\Winamp
2007-12-19 04:45 . 2007-12-21 16:38 988,800 ---hs----   C:\WINDOWS\system32\mpygxheh.ini
2007-12-18 21:53 . 2007-12-18 21:53 <DIR>    d--------   C:\Documents and Settings\All Users\Application Data\Lavasoft
2007-12-18 21:52 . 2007-12-18 21:52 <DIR>    d--------   C:\Program Files\Common Files\Wise Installation Wizard
2007-12-18 20:57 . 2007-12-18 20:57 <DIR>    d--------   C:\Program Files\Trend Micro
2007-12-18 18:56 . 2007-12-18 18:56 <DIR>    d--------   C:\Documents and Settings\All Users\Application Data\Sonic
2007-12-18 18:56 . 2007-12-18 18:56 <DIR>    d--------   C:\Documents and Settings\All Users\Application Data\InstallShield
2007-12-18 18:25 . 2007-12-22 23:09 <DIR>    d--------   C:\WINDOWS\Downloaded Program Files
2007-12-18 18:25 . 2007-12-18 18:26 <DIR>    d--------   C:\Program Files\Roxio
2007-12-18 18:25 . 2007-12-18 18:53 <DIR>    d--------   C:\Program Files\Common Files\Sonic Shared
2007-12-18 18:25 . 2007-12-18 20:37 <DIR>    d--------   C:\Documents and Settings\All Users\Application Data\Roxio
2007-12-18 18:19 . 2007-12-18 18:27 <DIR>    d--------   C:\Program Files\Common Files\Roxio Shared
2007-12-18 18:13 . 2005-01-28 13:44 142,336 --a------   C:\WINDOWS\system32\setb3.tmp
2007-12-18 18:09 . 2007-01-18 10:24 26,496  -ra------   C:\WINDOWS\system32\drivers\RimSerial.sys
2007-12-18 18:08 . 2007-12-18 18:08 <DIR>    d--------   C:\Documents and Settings\mina\Application Data\Blackberry Desktop
2007-12-18 18:05 . 2007-12-18 18:05 <DIR>    d--------   C:\Program Files\Research In Motion
2007-12-18 18:05 . 2007-12-18 18:06 <DIR>    d--------   C:\Program Files\Common Files\Research In Motion
2007-12-18 07:07 . 2007-12-18 22:46 986,214 ---hs----   C:\WINDOWS\system32\eqtbypel.ini
2007-12-17 18:30 . 2007-12-17 18:30 <DIR>    d--------   C:\Program Files\Enigma Software Group
2007-12-17 04:45 . 2007-12-18 04:45 979,794 ---hs----   C:\WINDOWS\system32\rfqrxmrf.ini
2007-12-16 17:46 . 2007-12-18 21:53 <DIR>    d--------   C:\Program Files\Lavasoft
2007-12-16 17:25 . 2007-12-16 17:35 <DIR>    d--------   C:\WINDOWS\system32\ActiveScan
2007-12-16 17:25 . 2007-12-16 17:25 30,590  --a------   C:\WINDOWS\system32\pavas.ico
2007-12-16 17:25 . 2007-12-16 17:25 2,550   --a------   C:\WINDOWS\system32\Uninstall.ico
2007-12-16 17:25 . 2007-12-16 17:25 1,406   --a------   C:\WINDOWS\system32\Help.ico
2007-12-16 16:46 . 2007-12-16 16:46 <DIR>    d--------   C:\Documents and Settings\All Users\Application Data\Prevx
2007-12-16 16:45 . 2007-12-16 17:13 <DIR>    d--------   C:\Documents and Settings\mina\Application Data\PrevxCSI
2007-11-26 22:12 . 2007-11-26 22:12 38  --a------   C:\WINDOWS\osAviSplitter.INI


.
((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-12-22 02:16    ---------   d-----w C:\Documents and Settings\mina\Application Data\Azureus
2007-12-19 02:25    ---------   d-----w C:\Program Files\Common Files\InstallShield
2007-12-17 01:37    ---------   d-----w C:\Program Files\Bonjour
2007-12-17 01:36    ---------   d-----w C:\Program Files\iTunes
2007-12-17 01:36    ---------   d-----w C:\Program Files\Apoint
2007-12-17 01:35    ---------   d-----w C:\Program Files\Common Files\Stardock
2007-12-05 03:25    ---------   d-----w C:\Program Files\Azureus
2007-11-20 06:04    ---------   d-----w C:\Documents and Settings\mina\Application Data\DivX
2007-11-20 06:02    ---------   d-----w C:\Program Files\DivX
2007-11-20 05:54    ---------   d-----w C:\Program Files\OpenSource AVI Splitter
2007-11-20 05:52    ---------   d-----w C:\Program Files\AviSynth 2.5
2007-11-20 05:51    ---------   d-----w C:\Program Files\Red Kawa
2007-11-17 05:51    ---------   d-----w C:\Program Files\Apple Software Update
2007-11-17 04:58    ---------   d-----w C:\Program Files\iPod
2007-11-17 04:56    ---------   d-----w C:\Program Files\QuickTime
2007-10-31 22:09    30,464  ----a-w C:\WINDOWS\system32\drivers\usbaapl.sys
.


(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{69884846-21DB-44CB-8012-317B3610545E}]
C:\WINDOWS\system32\iiiig.dll


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{892cd8bc-a4c1-4d83-bb9e-4d4c4fdb59a2}]
C:\WINDOWS\system32\qrscagxb.dll


[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CDD9AC4D-13FA-0D2A-DA2A-30E671880A96}]
C:\WINDOWS\system32\iypujh.dll


[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Meub"="C:\PROGRA~1\COMMON~1\PPATCH~1\msconfig.exe" []


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ATIModeChange"="Ati2mdxx.exe" [2001-09-05 00:24 C:\WINDOWS\system32\Ati2mdxx.exe]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2003-01-15 14:03]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2002-10-18 14:58]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe" [2007-07-12 03:00]
"IMJPMIG8.1"="C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe" [2004-08-04 02:00]
"MSPY2002"="C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe" [2004-08-04 02:00]
"PHIME2002ASync"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 02:00]
"PHIME2002A"="C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe" [2004-08-04 02:00]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 02:06]
"QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-11-14 23:43]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-11-15 13:11]
"RoxWatchTray"="C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe" [2007-04-23 11:43]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 01:25]


C:\Documents and Settings\mina\Start Menu\Programs\Startup\
Stardock ObjectDock.lnk - C:\Program Files\Stardock\ObjectDock\ObjectDock.exe [2007-07-29 21:59:45]


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"= 0 (0x0)


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\awtspnn]
awtspnn.dll


[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\080aa50f]
rundll32.exe C:\WINDOWS\system32\fcsbrydo.dll,b


R3 SPI;Sony Programmable I/O Control Device;C:\WINDOWS\system32\DRIVERS\SonyPI.sys [2002-08-20 10:59]
R3 WDM_YAMAHAAC97;YAMAHA AC-XG Audio Device;C:\WINDOWS\system32\drivers\yacxgc.sys [2002-09-19 18:19]
S3 PCX500;Cisco Wireless LAN Adapters Driver;C:\WINDOWS\system32\DRIVERS\pcx500.sys [2004-08-03 21:06]
S3 USBAAPL;Apple Mobile USB Driver;C:\WINDOWS\system32\Drivers\usbaapl.sys [2007-10-31 14:09]


.
Contents of the 'Scheduled Tasks' folder
"2007-12-20 02:59:22 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************


catchme 0.3.1333 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-12-23 15:34:57
Windows 5.1.2600 Service Pack 2 NTFS


scanning hidden processes ...


scanning hidden autostart entries ...


scanning hidden files ...


scan completed successfully
hidden files: 0


**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------


PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.2180]
-> C:\Program Files\Stardock\ObjectDock\DockShellHook.dll
.
Completion time: 2007-12-23 15:36:27 - machine was rebooted


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:37:12 PM, on 12/23/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal


Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe


R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {69884846-21DB-44CB-8012-317B3610545E} - C:\WINDOWS\system32\iiiig.dll (file missing)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O2 - BHO: {2a95bdf4-c4d4-e9bb-38d4-1c4acb8dc298} - {892cd8bc-a4c1-4d83-bb9e-4d4c4fdb59a2} - C:\WINDOWS\system32\qrscagxb.dll (file missing)
O2 - BHO: (no name) - {CDD9AC4D-13FA-0D2A-DA2A-30E671880A96} - C:\WINDOWS\system32\iypujh.dll (file missing)
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Meub] "C:\PROGRA~1\COMMON~1\PPATCH~1\msconfig.exe" -vt yazb
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O20 - Winlogon Notify: awtspnn - awtspnn.dll (file missing)
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe


--
End of file - 5861 bytes

minakochan 0 Newbie Poster · Answer 2 · 2007-12-24T06:21:02+00:00

Ok, I did as you said. However, that folder PPATCH~1 was not present (and yes, I have my folder options to show all hidden folders and files). When I tried to shut down the laptop, it hung, so I manually turned it off. Then I restarted the laptop and ran HJT. Here is the log:

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:17:29 PM, on 12/23/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_02\bin\jusched.exe"
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [RoxWatchTray] "C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatchTray9.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - Startup: Stardock ObjectDock.lnk = C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_02\bin\ssv.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Roxio UPnP Renderer 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUPnPRenderer9.exe
O23 - Service: Roxio Upnp Server 9 - Sonic Solutions - C:\Program Files\Roxio\Digital Home 9\RoxioUpnpService9.exe
O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe
O23 - Service: RoxMediaDB9 - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxMediaDB9.exe
O23 - Service: Roxio Hard Drive Watcher 9 (RoxWatch9) - Sonic Solutions - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxWatch9.exe

--
End of file - 5249 bytes

Thank you for your attention and patience with me! :)

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 3 · 2007-12-24T06:36:20+00:00

Thank you for your attention and patience with me! :)

It's all good :). Log looks clean too. How is the PC?

minakochan 0 Newbie Poster · Answer 4 · 2007-12-24T08:40:32+00:00

It seems to be running just fine! Again, thank you so much for your help. This really is a friendly place~! :D

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 5 · 2007-12-24T14:40:51+00:00

You are welcome :).

Now that your PC is clean you need to follow these easy steps to keeping it this way:

Download CCleaner and install, then run it. It will clear out your temp folders.

Uncheck "Cookies" under "Internet Explorer".
Click on Run Cleaner in the lower right-hand corner. This can take quite a while to run.
Close when finished.

Secure your Internet Explorer by going here and following the instructions there.

Better yet, use an alternative browser! Download FireFox and give it a run. It is far more secure than Internet Explorer. Or, you can get Opera which in my opinion, is better still.

Use a firewall to help prevent your PC's control being usurped by undesireables. There is a link to a good, free firewall in my signature.

Install and keep updated, AVG anti-spyware, Ad-Aware SE and Spybot S&D.
Run them all on a regular basis, following the maker's recommendations.

Install an anti-virus. There are some good, free AV's available today. Make sure that it is updated regularly and have it scan your system often.

Check for Windows Updates. Microsoft regularly post updates for your systems safe running. Make sure to take advantage of this. Reboot when installed and return to make sure there are no others.

Empty the Recycle Bin.

For XP users.
After something like this it is a good idea to Flush the Restore Points and start fresh.
To flush the XP system Restore Points.

Go to Start | Run and type msconfig and press enter.

When msconfig opens, click the Launch System Restore Button.
On the next page, click the System Restore Settings link on the left.

Check the box labelled 'Turn off System restore'.

Reboot. Go back in and Turn System Restore Back on. A new Restore Point will be created.

Note that all previous restore points will be lost.

===============

If you have any more problems, post back.

-

Happy surfing,

crunchie.

"downloader.agent.gat" and "downloader.purityscan.eg"

Recommended Answers Collapse Answers

All 7 Replies

Recommended Answers