malware help

Question

tseyigai 0 Newbie Poster

16 Years Ago

Hello,
I couldn't find the right forum here because your page has changed. I encountered some pop ups and got rid of them with Search and Destroy and Ad-Aware. I also scanned with AVG and there still seems to be a couple of files I can't get rid of. I haven't had any problems with this for some time, but did today for some reason. I did download Hijack this. Should I post a log file so that you can see what's going on with my files?

*I also downloaded Stinger.

Regards,
Tseyigai

windows-virus

3 Contributors
5 Replies
100 Views
3 Days Discussion Span
Latest Post 16 Years Ago Latest Post by Seakros

All 5 Replies

gerbil 216 Industrious Poster

16 Years Ago

This is the place to post it....

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

tseyigai 0 Newbie Poster · Answer 1 · 2007-06-13T03:18:08+00:00

So....Now that we know that this is the right forum, how about someone possibly helping me? I'm ready to post a log file.....I've done "everything else," but still have some pop ups in Explorer.

Tseyigai

tseyigai 0 Newbie Poster · Answer 2 · 2007-06-13T04:31:46+00:00

So....Now that we know that this is the right forum, how about someone possibly helping me? I'm ready to post a log file.....I've done "everything else," but still have some pop ups in Explorer.

Tseyigai

I've run combo fix and here is the latest log from it:

ComboFix 07-06-11.3 - C:\Documents and Settings\Owner\Desktop\ComboFix.exe
"Owner" - 2007-06-11 14:25:04 - Service Pack 2  NTFS  


((((((((((((((((((((((((((((((((((((((((((((   V Log   )))))))))))))))))))))))))))))))))))))))))))))))))))))))


C:\WINDOWS\system32\qyfwwfly.dll 
C:\WINDOWS\system32\awttrrs.dll 
C:\WINDOWS\system32\tuvssqp.dll 
C:\WINDOWS\system32\ylfwwfyq.ini 
C:\WINDOWS\system32\nqstv.bak1 
C:\WINDOWS\system32\nqstv.ini 
C:\WINDOWS\system32\nqstv.bak1 
C:\WINDOWS\system32\nqstv.ini 
C:\WINDOWS\system32\vtsqn.dll 
C:\WINDOWS\system32\xxyaxwx.dll 


* * *  POST RUN FILES/FOLDERS  * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *



(((((((((((((((((((((((((((((((((((((((   Other Deletions   )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Program Files\Common Files\ystem~1
C:\Program Files\Common Files\ystem~1\w?wexec.exe
C:\Temp\tn3
C:\WINDOWS\rau001978.exe
C:\WINDOWS\retadpu1000106.exe
C:\WINDOWS\sks~1
C:\WINDOWS\sks~1\wucrtupd.exe
C:\WINDOWS\svhost.exe
C:\WINDOWS\system32\drivers\core.cache.dsk
C:\WINDOWS\system32\drivers\core.sys
C:\WINDOWS\system32\pog
C:\WINDOWS\system32\T3
C:\WINDOWS\system32\T4
C:\WINDOWS\system32\T4\amst5.exe
C:\WINDOWS\system32\wnscpisv.exe
C:\WINDOWS\wr.txt


(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_CORE
-------\LEGACY_NET_AGENT
-------\core
-------\Net Agent


(((((((((((((((((((((((((   Files Created from 2007-05-11 to 2007-06-11  )))))))))))))))))))))))))))))))


2007-06-11 14:29    <DIR>    d--------   C:\VundoFix Backups
2007-06-11 14:24    49,152  --a------   C:\WINDOWS\nircmd.exe
2007-06-11 09:58    <DIR>    d--------   C:\Temp\x2b
2007-06-11 08:59    <DIR>    d--------   C:\Program Files\CCleaner
2007-06-11 08:32    <DIR>    d--------   C:\Program Files\Lavasoft
2007-06-11 08:32    <DIR>    d--------   C:\DOCUME~1\ALLUSE~1\APPLIC~1\Lavasoft
2007-06-11 07:50    <DIR>    d--------   C:\DOCUME~1\ALLUSE~1\APPLIC~1\Spybot - Search & Destroy
2007-06-11 07:11    <DIR>    d----c---   C:\Program Files\Common Files\WinAntiSpyware 2007
2007-06-11 07:11    <DIR>    d--------   C:\DOCUME~1\ALLUSE~1\APPLIC~1\WinAntiSpyware 2007
2007-06-11 06:47    60,928  --a------   C:\WINDOWS\system32\hqdg.dll
2007-06-11 06:46    172,544 --a------   C:\WINDOWS\system32\eeljubj.dll
2007-06-11 06:46    102,400 --a------   C:\WINDOWS\MBDownloader_876916.exe
2007-06-11 06:46    <DIR>    d--------   C:\WINDOWS\system32\TQ0
2007-06-11 06:46    <DIR>    d--------   C:\WINDOWS\system32\T9QaSQ
2007-06-11 06:46    <DIR>    d--------   C:\WINDOWS\system32\T7
2007-06-11 06:46    <DIR>    d--------   C:\WINDOWS\system32\T6
2007-06-11 06:46    <DIR>    d--------   C:\WINDOWS\system32\T5
2007-06-11 06:46    <DIR>    d--------   C:\Temp
2007-06-11 06:45    36,352  --a------   C:\WINDOWS\poolsv.exe
2007-06-09 08:06    <DIR>    d--------   C:\DOCUME~1\Owner\APPLIC~1\Image Zone Express
2007-06-07 15:37    <DIR>    d----c---   C:\Program Files\Winzip11
2007-06-07 06:23    <DIR>    d----c---   C:\Program Files\RapidSearch Beta ver 0.2
2007-06-05 07:13    <DIR>    d--------   C:\recover
2007-06-05 06:58    <DIR>    d--h-c---   C:\Program Files\Alcohol 120%
2007-06-05 06:58    <DIR>    d--h-c---   C:\Program Files\AdobeStockPhotos
2007-06-05 06:58    <DIR>    d----c---   C:\Program Files\recover
2007-06-04 20:06    <DIR>    d----c---   C:\Program Files\nalkan
2007-06-04 19:58    <DIR>    d-ah-c---   C:\Program Files\Swishmax files
2007-06-04 19:57    <DIR>    d--h-c---   C:\Program Files\Square
2007-06-04 19:57    <DIR>    d--h-c---   C:\Program Files\Slate
2007-06-04 19:57    <DIR>    d--h-c---   C:\Program Files\school
2007-06-04 19:57    <DIR>    d--h-c---   C:\Program Files\RedS
2007-06-04 19:57    <DIR>    d--h-c---   C:\Program Files\prophetic words
2007-06-04 19:57    <DIR>    d--h-c---   C:\Program Files\Park
2007-06-04 19:57    <DIR>    d--h-c---   C:\Program Files\newphotos2
2007-06-04 19:57    <DIR>    d--h-c---   C:\Program Files\My PSP8 Files
2007-06-04 19:56    <DIR>    dr-h-c---   C:\Program Files\My Pictures
2007-06-04 19:56    <DIR>    dr-h-c---   C:\Program Files\My Music
2007-06-04 19:56    <DIR>    d--h-c---   C:\Program Files\My Library
2007-06-04 19:56    <DIR>    d--h-c---   C:\Program Files\My Games
2007-06-04 19:56    <DIR>    d--h-c---   C:\Program Files\My eBooks
2007-06-04 19:56    <DIR>    d--h-c---   C:\Program Files\My Captures
2007-06-04 19:56    <DIR>    d--h-c---   C:\Program Files\Money
2007-06-04 19:56    <DIR>    d--h-c---   C:\Program Files\Misc
2007-06-04 19:56    <DIR>    d--h-c---   C:\Program Files\medieval
2007-06-04 19:56    <DIR>    d--h-c---   C:\Program Files\Magic Tree template
2007-06-04 19:56    <DIR>    d--h-c---   C:\Program Files\Journey
2007-06-04 19:56    <DIR>    d--h-c---   C:\Program Files\internet-computer
2007-06-04 19:56    <DIR>    d--h-c---   C:\Program Files\In His Truth2
2007-06-04 19:56    <DIR>    d--h-c---   C:\Program Files\In His Truth files
2007-06-04 19:56    <DIR>    d--h-c---   C:\Program Files\images
2007-06-04 19:56    <DIR>    d--h-c---   C:\Program Files\High school art pics
2007-06-04 19:56    <DIR>    d--h-c---   C:\Program Files\HansonArtGallery2_data
2007-06-04 19:56    <DIR>    d--h-c---   C:\Program Files\HansonArtGallery_data
2007-06-04 19:56    <DIR>    d--h-c---   C:\Program Files\Hanson Art 2
2007-06-04 19:55    <DIR>    d--h-c---   C:\Program Files\Hanson Art
2007-06-04 19:55    <DIR>    d--h-c---   C:\Program Files\Grid
2007-06-04 19:55    <DIR>    d--h-c---   C:\Program Files\Gifted & Talented
2007-06-04 19:55    <DIR>    d--h-c---   C:\Program Files\Futurist
2007-06-04 19:55    <DIR>    d--h-c---   C:\Program Files\Fabric
2007-06-04 19:55    <DIR>    d--h-c---   C:\Program Files\Elevation
2007-06-04 19:55    <DIR>    d--h-c---   C:\Program Files\EasyShare
2007-06-04 19:55    <DIR>    d--h-c---   C:\Program Files\Door
2007-06-04 19:55    <DIR>    d--h-c---   C:\Program Files\DessieThanksgiving
2007-06-04 19:55    <DIR>    d--h-c---   C:\Program Files\Dessie New pics
2007-06-04 19:55    <DIR>    d--h-c---   C:\Program Files\Dessie easter
2007-06-04 19:55    <DIR>    d--h-c---   C:\Program Files\Dessie
2007-06-04 19:54    <DIR>    d--h-c---   C:\Program Files\Contrast
2007-06-04 19:54    <DIR>    d--h-c---   C:\Program Files\Close
2007-06-04 19:54    <DIR>    d--h-c---   C:\Program Files\Christmas songs
2007-06-04 19:54    <DIR>    d--h-c---   C:\Program Files\CCWin9
2007-06-04 19:54    <DIR>    d--h-c---   C:\Program Files\Carousel
2007-06-04 19:54    <DIR>    d--h-c---   C:\Program Files\Bucksworth News
2007-06-04 19:54    <DIR>    d--h-c---   C:\Program Files\Brent and Pams
2007-06-04 19:54    <DIR>    d--h-c---   C:\Program Files\backups
2007-06-04 17:24    <DIR>    d----c---   C:\Program Files\FileRescue Pro
2007-06-04 15:18    9,344   --a------   C:\WINDOWS\system32\drivers\NSDriver.sys
2007-06-04 15:17    8,320   --a------   C:\WINDOWS\system32\drivers\AWRTRD.sys
2007-06-04 15:14    6,272   --a------   C:\WINDOWS\system32\drivers\AWRTPD.sys
2007-06-04 14:28    1,694,520   --a--c---   C:\Program Files\filerescuepro_setup.exe
2007-06-03 11:28    5,505,024   --a------   C:\DOCUME~1\Owner\ntuser.dat
2007-06-03 08:42    109,568 --a------   C:\WINDOWS\system32\JGFR400.DLL
2007-06-03 08:42    <DIR>    d--------   C:\AOLPRESS
2007-06-03 06:26    <DIR>    d----c---   C:\Program Files\Framing Studio Pro
2007-06-03 06:19    <DIR>    d----c---   C:\Program Files\FramingStudioPro_v2.61
2007-06-02 18:03    <DIR>    d----c---   C:\Program Files\Zeallsoft
2007-06-02 16:50    <DIR>    d----c---   C:\Program Files\Frames
2007-06-02 14:10    12,800  --a------   C:\WINDOWS\system32\Wing32.dll
2007-06-02 13:19    <DIR>    d--------   C:\hegames
2007-06-02 11:20    <DIR>    d----c---   C:\Program Files\Common Files\Adobe Systems Shared
2007-06-02 11:20    <DIR>    d--------   C:\DOCUME~1\ALLUSE~1\APPLIC~1\Adobe Systems
2007-06-02 11:10    1,177,209   --a--c---   C:\Program Files\emu.dll
2007-06-02 08:39    <DIR>    d----c---   C:\Program Files\ACASystems
2007-06-02 08:09    <DIR>    d----c---   C:\Program Files\SWiSHpresenter
2007-06-01 14:45    <DIR>    d----c---   C:\Program Files\100+ Great Games Vol 2
2007-06-01 14:36    286,720 --a------   C:\WINDOWS\iun506.exe
2007-06-01 14:36    <DIR>    d----c---   C:\Program Files\Ultimate Game Pak
2007-06-01 06:44    <DIR>    d--h-c---   C:\Program Files\Artistic
2007-06-01 06:20    <DIR>    d--h-c---   C:\Program Files\Architect
2007-05-31 06:35    <DIR>    d----c---   C:\Program Files\7-Zip


((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-06-11 20:32:30 --------    d-----w C:\DOCUME~1\Owner\APPLIC~1\AdobeUM
2007-06-11 16:05:42 --------    dc-h--w C:\Program Files\InstallShield Installation Information
2007-06-11 14:31:53 --------    dc----w C:\Program Files\Common Files\Wise Installation Wizard
2007-06-09 19:25:48 --------    dc----w C:\Program Files\e frontier
2007-06-08 12:25:22 --------    dc----w C:\Program Files\FlashGet
2007-06-06 12:20:01 6,300   ----a-w C:\DOCUME~1\Owner\APPLIC~1\wklnhst.dat
2007-06-02 11:00:51 --------    dc----w C:\Program Files\Common Files\DAZ
2007-05-20 20:30:31 79,017  ----a-w C:\WINDOWS\hpfins05.dat
2007-05-19 00:55:40 --------    dc----w C:\Program Files\Pure Networks
2007-05-18 23:01:17 --------    dc----w C:\Program Files\SHARM 1.4
2007-05-18 23:01:15 --------    dc----w C:\Program Files\Common Files\AOL
2007-05-18 23:00:36 --------    d-----w C:\DOCUME~1\Owner\APPLIC~1\AOL
2007-05-18 12:13:15 --------    d-----w C:\Program Files\TuneUp Utilities 2007
2007-05-18 12:13:14 --------    d-----w C:\DOCUME~1\Owner\APPLIC~1\uTorrent
2007-05-13 16:06:40 5,213   ----a-w C:\acttmp.dat
2007-05-09 00:36:45 --------    dc----w C:\Program Files\Canon Creative
2007-05-07 17:06:11 --------    d-----w C:\DOCUME~1\Owner\APPLIC~1\RegistryBot
2007-05-06 13:30:19 --------    dc----w C:\Program Files\IBM and Crayola
2007-05-05 13:39:46 --------    dc----w C:\Program Files\Pantomat
2007-05-03 12:19:29 --------    dc----w C:\Program Files\Crossword Weaver
2007-04-30 07:44:52 --------    dc----w C:\Program Files\Common Files\Symantec Shared
2007-04-30 07:44:51 --------    dc----w C:\Program Files\Symantec
2007-04-22 07:39:09 --------    dc----w C:\Program Files\Common Files\InstallShield
2007-04-22 07:38:41 --------    dc----w C:\Program Files\Panda
2007-04-22 07:14:25 335 ----a-w C:\WINDOWS\mozregistry.dat
2007-04-19 09:20:57 --------    dc----w C:\Program Files\Messenger
2007-04-19 00:34:40 --------    d-----w C:\DOCUME~1\Owner\APPLIC~1\HP
2007-04-18 16:12:23 2,854,400   ----a-w C:\WINDOWS\system32\msi.dll
2007-04-18 12:08:20 --------    dc----w C:\Program Files\Google
2007-04-18 00:41:39 --------    d-----w C:\DOCUME~1\Owner\APPLIC~1\TuneUp Software
2007-04-18 00:40:57 --------    dc----w C:\Program Files\tuneup.software_tuneup.utilities_v2007.6.x.universalpatch-GEAR
2007-04-17 14:38:34 --------    d-----w C:\DOCUME~1\Owner\APPLIC~1\Google
2007-04-17 10:40:59 --------    d-----w C:\DOCUME~1\Owner\APPLIC~1\Template
2007-04-17 00:26:25 --------    d-----w C:\DOCUME~1\Owner\APPLIC~1\Poser 7
2007-04-16 11:29:18 --------    dc----w C:\Program Files\xat.com Image Optimizer
2007-04-16 09:09:27 --------    dc----w C:\Program Files\Microsoft Office XP
2007-04-15 17:17:59 1,156   ----a-w C:\WINDOWS\mozver.dat
2007-04-15 17:17:19 --------    dc----w C:\Program Files\SWiSHmax
2007-04-15 16:39:00 --------    dc-h--w C:\Program Files\2005-01 (Jan)
2007-04-15 16:38:39 --------    dc-h--w C:\Program Files\2004-12 (Dec)
2007-04-15 16:38:29 --------    dc-h--w C:\Program Files\101MSDCF
2007-04-15 16:29:12 --------    dc----w C:\Program Files\BitLord
2007-04-15 16:25:58 4,212   ---ha-w C:\WINDOWS\system32\zllictbl.dat
2007-04-15 15:55:01 --------    dc----w C:\Program Files\Common Files\HP
2007-04-15 15:54:59 --------    dc----w C:\Program Files\HP
2007-04-15 15:54:14 --------    dc----w C:\Program Files\Hewlett-Packard
2007-04-15 15:45:36 --------    dc----w C:\Program Files\AOL Toolbar
2007-04-15 15:45:17 --------    d-----w C:\DOCUME~1\Owner\APPLIC~1\MSNInstaller
2007-04-15 15:41:44 --------    dc----w C:\Program Files\Actiontec
2007-04-13 21:19:52 7,680   ----a-w C:\WINDOWS\system32\lsdelete.exe
2007-03-17 13:43:01 292,864 ----a-w C:\WINDOWS\system32\winsrv.dll


(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))

Note empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2004-12-14 01:56]
{53707962-6F74-2D53-2644-206D7942484F}=C:\Program Files\Spybot - Search & Destroy\SDHelper.dll [2005-05-31 01:04]
{93C69D87-A11D-4FFC-BC56-BE7EE0D235BA}=C:\Program Files\ACASystems\ACACapturePro\scap003p.dll [2006-07-10 15:55]
{AA58ED58-01DD-4d91-8333-CF10577473F7}=c:\program files\google\googletoolbar2.dll [2007-01-19 23:55]
{C65C1A68-D5DC-D802-8C0B-8AADA9E872E7}=C:\WINDOWS\system32\hqdg.dll [2007-05-21 07:59]
{efcda56b-205d-4e1c-9a96-1344a08072d7}=C:\WINDOWS\system32\eeljubj.dll [2007-06-11 06:46]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"@"="" []
"Microsoft Works Update Detection"="C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe" [2003-06-07 04:32]
"ERS_Check"="C:\Program Files\Common Files\WinAntiSpyware 2007\uwasers.exe" []
"AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-06-11 08:36]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"swg"="C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2007-04-17 08:38]
"Cpue"="C:\WINDOWS\SKS~1\wucrtupd.exe" []
"Jwncnlas"="C:\Program Files\Common Files\?ystem\w?wexec.exe" []
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2004-11-22 08:18]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\aawservice]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^BigFix.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Alcmtr]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AlcWzrd]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AOL Spyware Protection]
"C:\PROGRA~1\COMMON~1\AOL\AOLSPY~1\AOLSP Scheduler.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CHotkey]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RemoteControl]
"C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SoundMan]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SpyEmergency]
"C:\Program Files\NETGATE\Spy Emergency 2006\SpyEmergency.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunKistEM]
C:\Program Files\Digital Media Reader\shwiconem.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ZoneAlarm Client]
"C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"swg"=C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" /background
"Outlook Express"=C:\Program Files\Outlook Express\msimn.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" -atboottime
"High Definition Audio Property Page Shortcut"=HDAudPropShortcut.exe
HKEY_LOCAL_MACHINE\Software\Microsoft\Windows NT\CurrentVersion\Svchost  - netsvcs
UxTuneUp


Contents of the 'Scheduled Tasks' folder
2007-06-09 02:31:31  C:\WINDOWS\tasks\1-Click Maintenance.job
2007-04-15 15:39:23  C:\WINDOWS\tasks\Symantec NetDetect.job

**************************************************************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, [url]http://www.gmer.net[/url]
Rootkit scan 2007-06-11 14:32:14
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-06-11 14:33:35 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-06-11 14:33

    --- E O F ---

Also, here's the latest hijack this:

Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 4:30:25 PM, on 6/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\SYSTEM32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\internet explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Owner\Desktop\HiJackThis_v2.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = [url]http://mail.yahoo.com/[/url]
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = [url]http://www.gateway.com[/url]
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page = 
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = 
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: ACA Capture - {93C69D87-A11D-4FFC-BC56-BE7EE0D235BA} - C:\Program Files\ACASystems\ACACapturePro\scap003p.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
O2 - BHO: (no name) - {C65C1A68-D5DC-D802-8C0B-8AADA9E872E7} - C:\WINDOWS\system32\hqdg.dll
O2 - BHO: (no name) - {efcda56b-205d-4e1c-9a96-1344a08072d7} - C:\WINDOWS\system32\eeljubj.dll
O3 - Toolbar: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O3 - Toolbar: (no name) - {E0E899AB-F487-11D5-8D29-0050BA6940E3} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
O4 - HKLM\..\Run: [ERS_Check] "C:\Program Files\Common Files\WinAntiSpyware 2007\uwasers.exe" /min
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [Cpue] "C:\WINDOWS\SKS~1\wucrtupd.exe" -vt yazb
O4 - HKCU\..\Run: [Jwncnlas] "C:\Program Files\Common Files\?ystem\w?wexec.exe"
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_0
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O8 - Extra context menu item: &AOL Toolbar search - res://C:\Program Files\AOL Toolbar\toolbar.dll/SEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2\bin\npjpi142.dll
O9 - Extra button: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra 'Tools' menuitem: AOL Toolbar - {4982D40A-C53B-4615-B15B-B5B5E98D167C} - C:\Program Files\AOL Toolbar\toolbar.dll
O9 - Extra button: Launch ACA Capture Pro - {905A31AA-BDD1-44bd-9920-53D34E5953A4} - C:\Program Files\ACASystems\ACACapturePro\SCapPro.exe
O9 - Extra button: (no name) - {9543741D-4E79-4f0d-8E60-A702CDF8B2D2} - C:\Program Files\ACASystems\ACACapturePro\SCapPro.exe
O9 - Extra 'Tools' menuitem: Launch ACA Capture Pro - {9543741D-4E79-4f0d-8E60-A702CDF8B2D2} - C:\Program Files\ACASystems\ACACapturePro\SCapPro.exe
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.gateway.com
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 6436 bytes

tseyigai 0 Newbie Poster · Answer 3 · 2007-06-14T18:59:29+00:00

***Well, forget it. No one is helping me. I'm looking elsewhere...

Seakros 0 Newbie Poster · Answer 4 · 2007-06-14T23:24:45+00:00

You have to be patient... The people who help around here also have lives and other things to take care of.

malware help

Recommended Answers Collapse Answers

All 5 Replies

Recommended Answers