Security Alert: Spyware found

Question

Trinexus 0 Newbie Poster

16 Years Ago

Your computer is infected with last version of PSW.x-Vir trojan. PSW trojans steal your private information such as: password, IP-address, credit card information, registration details, documents, etc. Click this baloon to remove PSW.x-Vir spyware

This pop-up has appeared more then 3,000 times. When i click the baloon it takes me to a webpage were can buy a anty-spyware. I've read a lot of other forums, but none of them help me. Could someone in here help me with my problem? Please

windows-virus

2 Contributors
13 Replies
174 Views
5 Days Discussion Span
Latest Post 16 Years Ago Latest Post by crunchie

crunchie 990 Most Valuable Poster

16 Years Ago

Hi and welcome to Daniweb forums :).

Download HijackThis from here. Download it to your desktop and NOT a temporary folder.

==

Please download ComboFix by sUBs from HERE or HERE

You must download it to and run it from your Desktop
Physically disconnect from the internet.
Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
Double click combofix.exe & follow the prompts.
When finished, it will produce a log. Please save that log to post in your next reply along with a fresh HJT log
Re-enable all the programs that were disabled during the running of ComboFix..

Note:
Do not mouse-click combofix's window while it is running. That may cause it to stall.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

crunchie 990 Most Valuable Poster

16 Years Ago

Keep away from cracks if you don't want this malware :).

Please download SmitfraudFix (by S!Ri)
Extract the content (a folder named SmitfraudFix) to your Desktop.

Open the SmitfraudFix folder and double-click smitfraudfix.cmd
Select option #1 - Search by typing 1 and press "Enter"; a text file will appear, which lists infected files (if present).
Please copy/paste the content of that report into your next reply.

Note : process.exe is detected by some antivirus programs (AntiVir, Dr.Web, Kaspersky) as a "RiskTool"; it is not a virus, but a program used to stop system processes. Antivirus programs cannot distinguish between "good" and "malicious" use of such programs, therefore they may alert the user.
http://www.beyondlogic.org/consulting/proc...processutil.htm

crunchie 990 Most Valuable Poster

16 Years Ago

You should print out these instructions, or copy them to a Notepad file for reading while in Safe Mode, because you will not be able to connect to the Internet to read from this site.

Please reboot your computer in Safe Mode by doing the following :

Restart your computer
After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
Instead of Windows loading as normal, a menu with options should appear;
Select the first option, to run Windows in Safe Mode, then press "Enter".
Choose your usual account.

Once in Safe Mode, open the SmitfraudFix folder again and double-click smitfraudfix.cmd
Select option #2 - Clean by typing 2 and press "Enter" to delete infected files.

You will be prompted : "Registry cleaning - Do you want to clean the registry ?"; answer "Yes" by typing Y and press "Enter" in order to remove the Desktop background and clean registry keys associated with the infection.

The tool will now check if wininet.dll is infected. You may be prompted to replace the infected file (if found); answer "Yes" by typing Y and press "Enter".

The tool may need to restart your computer to finish the cleaning process; if it doesn't, please restart anyway into normal Windows. A text file will appear onscreen, with results from the cleaning process; please copy/paste the content of that report into your next reply along with a new HijackThis log.
The report can also be found at the root of the system drive, usually at C:\rapport.txt

Warning : running option #2 on a non infected computer will remove your Desktop background.

crunchie 990 Most Valuable Poster

16 Years Ago

please copy/paste the content of that report into your next reply along with a new HijackThis log.

This too please.

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

Trinexus 0 Newbie Poster · Answer 1 · 2008-01-14T06:48:42+00:00

ComboFix 08-01-14.1 - Sony 2008-01-13 18:22:36.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.404 [GMT -4:00]
Running from: C:\Documents and Settings\Sony\Desktop\ComboFix(2).exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Program Files\Helper
C:\Program Files\Helper\prolooker.dll
C:\WINDOWS\setup.exe
C:\WINDOWS\system32\msacm32.drv

.
((((((((((((((((((((((((( Files Created from 2007-12-14 to 2008-01-14 )))))))))))))))))))))))))))))))
.

2008-01-13 18:21 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-13 13:31 . 2008-01-13 13:31 <DIR> d-------- C:\VundoFix Backups
2008-01-13 12:39 . 2008-01-13 12:39 <DIR> d-------- C:\Program Files\VirusProtect 3.9
2008-01-13 12:39 . 2008-01-13 12:39 <DIR> d-------- C:\Program Files\Online Add-on
2008-01-13 10:28 . 2008-01-13 10:29 <DIR> d-------- C:\Program Files\TuneUp Utilities 2008
2008-01-13 10:28 . 2008-01-13 10:28 306,432 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-01-13 10:14 . 2008-01-13 10:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-13 09:48 . 2007-05-30 08:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-01-13 09:32 . 2007-12-20 10:41 29,440 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-01-13 09:31 . 2008-01-13 09:32 <DIR> d-------- C:\Program Files\TuneUp Utilities 2007
2008-01-13 09:31 . 2008-01-13 10:27 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-01-13 09:31 . 2008-01-13 09:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-01-12 22:29 . 2008-01-13 09:18 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-01-12 22:11 . 2008-01-12 22:11 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-01-12 22:11 . 2008-01-12 22:11 1,409 --a------ C:\WINDOWS\QTFont.for
2008-01-11 21:12 . 2008-01-11 21:12 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Adobe Systems
2008-01-11 19:55 . 2008-01-11 19:55 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared
2008-01-10 16:45 . 2008-01-11 18:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-01-10 08:22 . 2008-01-10 08:22 <DIR> d-------- C:\Program Files\Messenger Plus! Live
2008-01-01 23:18 . 1999-02-10 10:19 45,568 --a------ C:\WINDOWS\UniFish3.exe
2008-01-01 23:17 . 2008-01-01 23:17 <DIR> d-------- C:\Program Files\Hasbro Interactive
2008-01-01 22:38 . 2008-01-01 22:38 <DIR> d-------- C:\Program Files\90PercentAttitude
2008-01-01 22:38 . 2008-01-01 22:38 2,577,850 --a------ C:\WINDOWS\system32\Roller Coaster Mania.scr
2007-12-26 08:10 . 2007-12-26 08:10 244 --ah----- C:\sqmnoopt01.sqm
2007-12-26 08:10 . 2007-12-26 08:10 244 --ah----- C:\sqmnoopt00.sqm
2007-12-26 08:10 . 2007-12-26 08:10 232 --ah----- C:\sqmdata01.sqm
2007-12-26 08:10 . 2007-12-26 08:10 232 --ah----- C:\sqmdata00.sqm
2007-12-23 08:53 . 2007-12-23 08:53 98,304 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2007-12-23 08:52 . 2007-12-23 08:57 <DIR> d-------- C:\Program Files\GameShadow
2007-12-23 08:51 . 2005-05-26 15:34 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll
2007-12-23 08:42 . 2007-12-23 08:42 <DIR> d-------- C:\Program Files\Eidos

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-13 19:31 --------- d-----w C:\Program Files\AdVantage
2008-01-13 16:22 --------- d-----w C:\Program Files\Trend Micro
2008-01-13 13:40 --------- d-----w C:\Program Files\BitComet
2008-01-12 20:43 --------- d-----w C:\Documents and Settings\Sony\Application Data\dvdcss
2008-01-12 20:17 --------- d-----w C:\Program Files\StepMania
2008-01-11 23:56 --------- d-----w C:\Program Files\Common Files\Adobe
2008-01-11 22:28 --------- d-----w C:\Documents and Settings\Sony\Application Data\LimeWire
2008-01-07 03:11 --------- d-----w C:\Program Files\LimeWire
2007-12-26 05:00 --------- d-----w C:\Program Files\Sony
2007-12-26 05:00 --------- d-----w C:\Documents and Settings\Sony\Application Data\Sony
2007-12-23 12:42 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-14 01:06 --------- d-----w C:\Program Files\Windows Live
2007-12-14 00:54 --------- d-----w C:\Program Files\Windows Live Toolbar
2007-12-14 00:53 --------- d-----w C:\Program Files\Windows Live Favorites
2007-12-14 00:49 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2007-12-14 00:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-12-12 07:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-12-10 14:02 2,452 ----a-w C:\Asingment6.bat
2007-12-09 18:02 --------- d-----w C:\Program Files\Trillian
2007-12-09 17:50 --------- d-----w C:\Program Files\The Weather Channel FW
2007-12-09 17:49 --------- d-----w C:\Program Files\AskPBar
2007-12-09 15:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7
2007-12-07 12:04 --------- d-----w C:\Program Files\DAEMON Tools
2007-12-07 10:32 --------- d-----w C:\Documents and Settings\Sony\Application Data\AVG7
2007-12-07 10:28 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-11-27 15:41 --------- d-----w C:\Program Files\DivX
2007-11-27 12:55 --------- d-----w C:\Program Files\Gravity
2007-11-26 17:41 --------- d-----w C:\Documents and Settings\Sony\Application Data\U3
2007-11-22 23:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL OCP
2007-11-22 23:34 --------- d-----w C:\Program Files\AIM6
2007-11-22 23:34 --------- d-----w C:\Documents and Settings\Sony\Application Data\acccore
2007-11-22 23:32 --------- d-----w C:\Program Files\Viewpoint
2007-11-22 23:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2007-11-22 23:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL Downloads
2007-11-15 00:24 --------- d-----w C:\Documents and Settings\Sony\Application Data\Ahead
2007-07-25 18:40 229,376 ----a-w C:\Documents and Settings\Sony\cwshredder.dll
2007-07-23 00:24 5,760,054 ----a-w C:\Program Files\Sonywall.bmp
2007-07-22 21:14 4,971 ----a-w C:\Program Files\INSTALL.LOG
2007-07-22 21:14 198,174 ----a-w C:\Program Files\uninstal.log
2005-12-22 14:21 99,328 ----a-w C:\Program Files\WBInstall64.exe
2005-12-22 14:21 95,232 ----a-w C:\Program Files\wbui.dll
2005-12-22 14:21 94,208 ----a-w C:\Program Files\WBInstall32.exe
2005-12-22 14:21 93 ----a-w C:\Program Files\sig.bin
2005-12-22 14:21 92,894 ----a-w C:\Program Files\wb.ico
2005-12-22 14:21 774 ----a-w C:\Program Files\wbmnu.bmp
2005-12-22 14:21 707,072 ----a-w C:\Program Files\wblind64.dll
2005-12-22 14:21 70,656 ----a-w C:\Program Files\x64.exe
2005-12-22 14:21 7,168 ----a-w C:\Program Files\Clock.dll
2005-12-22 14:21 67,854 ----a-w C:\Program Files\wbmdi.bmp
2005-12-22 14:21 67,854 ----a-w C:\Program Files\wb.bmp
2005-12-22 14:21 638,976 ----a-w C:\Program Files\WBConfig32.exe
2005-12-22 14:21 626,688 ----a-w C:\Program Files\WBConfig.exe
2005-12-22 14:21 609,792 ----a-w C:\Program Files\WindowBlinds5.exe
2005-12-22 14:21 6,262 ----a-w C:\Program Files\xplogon.bmp
2005-12-22 14:21 6,144 ----a-w C:\Program Files\txtscroll.dll
2005-12-22 14:21 59,904 ----a-w C:\Program Files\tray64.dll
2005-12-22 14:21 58 ----a-w C:\Program Files\null.bmp
2005-12-22 14:21 512,090 ----a-w C:\Program Files\wblind32.dll
2005-12-22 14:21 512,090 ----a-w C:\Program Files\wblind.dll
2005-12-22 14:21 494 ----a-w C:\Program Files\order.html
2005-12-22 14:21 467,048 ----a-w C:\Program Files\_XPDisabled.bmp
2005-12-22 14:21 467,048 ----a-w C:\Program Files\_Disabled.bmp
2005-12-22 14:21 44,032 ----a-w C:\Program Files\wbload64.dll
2005-12-22 14:21 428,032 ----a-w C:\Program Files\Activate.exe
2005-12-22 14:21 426,021 ----a-w C:\Program Files\wb.chm
2005-12-22 14:21 4,710 ----a-w C:\Program Files\od.ico
2005-12-22 14:21 4,544 ----a-w C:\Program Files\eula.txt
2005-12-22 14:21 4,110 ----a-w C:\Program Files\readme.txt
2005-12-22 14:21 36,864 ----a-w C:\Program Files\smart.dll
2005-12-22 14:21 36,864 ----a-w C:\Program Files\rollup.wbp
2005-12-22 14:21 36,864 ----a-w C:\Program Files\32Set.exe
2005-12-22 14:21 32,768 ----a-w C:\Program Files\tray.dll
2005-12-22 14:21 32,768 ----a-w C:\Program Files\skincst.exe
2005-12-22 14:21 309 ----a-w C:\Program Files\core.dll
2005-12-22 14:21 3,586 ----a-w C:\Program Files\bms.bmp
2005-12-22 14:21 289,792 ----a-w C:\Program Files\ui64.dll
2005-12-22 14:21 28,740 ----a-w C:\Program Files\wbhelp.dll
2005-12-22 14:21 28,160 ----a-w C:\Program Files\anim.dll
2005-12-22 14:21 24,576 ----a-w C:\Program Files\url.wbp
2005-12-22 14:21 24,576 ----a-w C:\Program Files\quickl.wbp
2005-12-22 14:21 24,576 ----a-w C:\Program Files\aot.wbp
2005-12-22 14:21 232,448 ----a-w C:\Program Files\wbload.exe
2005-12-22 14:21 2,070 ----a-w C:\Program Files\bms5.bmp
2005-12-22 14:21 189,409 ----a-w C:\Program Files\wise_post.exe
2005-12-22 14:21 176,128 ----a-w C:\Program Files\WbSrv.dll
2005-12-22 14:21 167,936 ----a-w C:\Program Files\wbdb.dll
2005-12-22 14:21 151,552 ----a-w C:\Program Files\Screen.exe
2005-12-22 14:21 140,800 ----a-w C:\Program Files\unzip32.dll
2005-12-22 14:21 124,416 ----a-w C:\Program Files\wbhelp64.dll
2005-12-22 14:21 11,078 ----a-w C:\Program Files\wbback.bmp
2005-12-22 14:21 106 ----a-w C:\Program Files\xpui.uis
2005-12-22 14:21 102 ----a-w C:\Program Files\wbtd.bmp
2005-12-22 14:21 100,352 ----a-w C:\Program Files\Skins.mdb
2005-12-22 14:21 1,629 ----a-w C:\Program Files\order.now
2005-12-22 14:21 1,629 ----a-w C:\Program Files\Announce.txt
2005-12-22 14:21 0 ----a-w C:\Program Files\wbperapp.ini
2005-12-19 14:27 209,448 ----a-w C:\Program Files\Cracked.rar
2005-12-04 19:22 9,507 ----a-w C:\Program Files\lang.rar
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22}]
2005-10-14 13:21 102400 --a------ C:\Program Files\AOL\AOL Search Enhancement\AOLSearch.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BA0BACB5-FC95-451E-94D2-4959AB0949D2}]
2008-01-13 12:54 12800 --a------ C:\Program Files\Online Add-on\isfmdl.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{DE9C389F-3316-41A7-809B-AA305ED9D922}
{F4D76F09-7896-458A-890F-E1F05C46069F}
{BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0}
{F2BADA0D-FD61-45EF-A994-64A073FD6613}

[HKEY_CLASSES_ROOT\clsid\{f2bada0d-fd61-45ef-a994-64a073fd6613}]

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{F2BADA0D-FD61-45EF-A994-64A073FD6613}"= C:\Program Files\Online Add-on\ictmdl.dll [2008-01-12 22:24 75264]

[HKEY_CLASSES_ROOT\clsid\{f2bada0d-fd61-45ef-a994-64a073fd6613}]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-03-15 08:00 15360]
"msnmsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 11:34 5724184]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2007-12-06 08:06 167368]
"AdVantage"="C:\Program Files\AdVantage\AdVantage.exe" [2007-06-28 15:19 880080]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-07-22 12:27 185896]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\point32.exe" [2005-03-23 19:26 217088]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2008-01-13 10:14 6731312]

C:\Documents and Settings\Sony\Start Menu\Programs\Startup\
Adobe Gamma.lnk - C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 19:16:50]
OneNote 2007 Screen Clipper and Launcher.lnk - C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE [2006-10-26 20:24:54]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"InstallVisualStyle"= C:\WINDOWS\Resources\Themes\Royale\Royale.msstyles
"InstallTheme"= C:\WINDOWS\Resources\Themes\Royale.theme

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"= 0 (0x0)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{91316323-2ad5-4794-9589-52a2eaa60a68}"= C:\WINDOWS\system32\shlahsd.dll [2008-01-10 03:09 13312]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{03A80B1D-5C6A-42c2-9DFB-81B6005D8023}"= C:\Program Files\Trend Micro\Tmas\sshook.dll [2007-01-29 23:08 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\VESWinlogon]
VESWinlogon.dll 2006-06-20 19:11 73728 C:\WINDOWS\system32\VESWinlogon.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
c:\PROGRA~1\wbsrv.dll 2005-12-22 10:21 176128 c:\PROGRA~1\WbSrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wbsys.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"AIM"=C:\Program Files\AIM\aim.exe -cnetwait.odl
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" /background
"Aim6"="C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp

R2 MSSQL$VAIO_VEDB;MSSQL$VAIO_VEDB;C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe [2002-12-17 20:26]
R2 UxTuneUp;TuneUp Theme Extension;C:\WINDOWS\System32\svchost.exe [2006-03-15 08:00]
R3 ti21sony;ti21sony;C:\WINDOWS\system32\drivers\ti21sony.sys [2006-02-21 22:32]
S3 Image Converter video recording monitor for VAIO Entertainment;Image Converter video recording monitor for VAIO Entertainment;C:\Program Files\Sony\Image Converter 2\IcVzMon.exe [2005-07-14 23:10]
S3 SQLAgent$VAIO_VEDB;SQLAgent$VAIO_VEDB;C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlagent.EXE [2002-12-17 20:23]
S3 TuneUp.Defrag;TuneUp Drive Defrag Service;C:\WINDOWS\System32\TuneUpDefragService.exe [2008-01-13 10:28]

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
UxTuneUp

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{414cea90-3196-11dc-804e-0018de8dcf32}]
\Shell\AutoRun\command - H:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6705644a-7518-11dc-80ca-0018de8dcf32}]
\Shell\AutoRun\command - H:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6705644b-7518-11dc-80ca-0018de8dcf32}]
\Shell\AutoRun\command - I:\ntde1ect.com
\Shell\explore\Command - I:\ntde1ect.com
\Shell\open\Command - I:\ntde1ect.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{943a2880-88e5-11dc-80da-0018de8dcf32}]
\Shell\AutoRun\command - H:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9cd67b88-8bd1-11dc-80dd-0018de8dcf32}]
\Shell\AutoRun\command - H:\LaunchU3.exe -a

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{c168f54e-3894-11dc-806a-0018de8dcf32}]
\Shell\AutoRun\command - H:\ntde1ect.com
\Shell\explore\Command - H:\ntde1ect.com
\Shell\open\Command - H:\ntde1ect.com

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{e0afe196-84ec-11dc-80d8-0018de8dcf32}]
\Shell\AutoRun\command - ntde1ect.com
\Shell\explore\Command - ntde1ect.com
\Shell\open\Command - ntde1ect.com

.
Contents of the 'Scheduled Tasks' folder
"2008-01-13 14:29:08 C:\WINDOWS\Tasks\1-Click Maintenance.job"
- C:\Program Files\TuneUp Utilities 2008\OneClick.exe
"2008-01-13 21:34:00 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job"
- C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
"2008-01-13 13:32:16 C:\WINDOWS\Tasks\Mantenimiento con 1 clic.job"
- C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe
.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-01-14 18:29:04
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\Explorer.EXE [6.00.2900.3156]
-> c:\PROGRA~1\tray.dll
-> C:\WINDOWS\system32\shlahsd.dll
.
Completion time: 2008-01-14 18:32:51 - machine was rebooted
ComboFix-quarantined-files.txt 2008-01-14 22:32:49
.
2008-01-10 07:02:20 --- E O F ---

Trinexus 0 Newbie Poster · Answer 2 · 2008-01-14T19:45:40+00:00

SmitFraudFix v2.274

Scan done at 9:44:14.68, Tue 01/15/2008
Run from C:\Documents and Settings\Sony\Desktop\Smitfraudfix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in normal mode

»»»»»»»»»»»»»»»»»»»»»»»» Process

C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Common Files\Sony Shared\WMPlugIn\SonicStageMonitoring.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\AdVantage\AdVantage.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\WinRAR\WinRAR.exe
C:\WINDOWS\system32\cmd.exe

»»»»»»»»»»»»»»»»»»»»»»»» hosts

»»»»»»»»»»»»»»»»»»»»»»»» C:\

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\Web

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32

»»»»»»»»»»»»»»»»»»»»»»»» C:\WINDOWS\system32\LogFiles

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Sony

»»»»»»»»»»»»»»»»»»»»»»»» C:\Documents and Settings\Sony\Application Data

»»»»»»»»»»»»»»»»»»»»»»»» Start Menu

»»»»»»»»»»»»»»»»»»»»»»»» C:\DOCUME~1\Sony\FAVORI~1

»»»»»»»»»»»»»»»»»»»»»»»» Desktop

»»»»»»»»»»»»»»»»»»»»»»»» C:\Program Files

C:\Program Files\Online Add-on\ FOUND !
C:\Program Files\VirusProtect 3.9\ FOUND !

»»»»»»»»»»»»»»»»»»»»»»»» Corrupted keys

»»»»»»»»»»»»»»»»»»»»»»»» Desktop Components

[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Desktop\Components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix
!!!Attention, following keys are not inevitably infected!!!

IEDFix.exe by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» Sharedtaskscheduler
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{91316323-2ad5-4794-9589-52a2eaa60a68}"="aposiopetic"

[HKEY_CLASSES_ROOT\CLSID\{91316323-2ad5-4794-9589-52a2eaa60a68}\InProcServer32]
@="C:\WINDOWS\system32\shlahsd.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{91316323-2ad5-4794-9589-52a2eaa60a68}\InProcServer32]
@="C:\WINDOWS\system32\shlahsd.dll"

»»»»»»»»»»»»»»»»»»»»»»»» AppInit_DLLs
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"="wbsys.dll"

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Rustock

»»»»»»»»»»»»»»»»»»»»»»»» DNS

Description: Intel(R) PRO/Wireless 3945ABG Network Connection - Packet Scheduler Miniport
DNS Server Search Order: 192.168.0.1

HKLM\SYSTEM\CCS\Services\Tcpip\..\{153DABF4-97EA-4E3E-BB0B-AE26CC235D7C}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{153DABF4-97EA-4E3E-BB0B-AE26CC235D7C}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{153DABF4-97EA-4E3E-BB0B-AE26CC235D7C}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1

»»»»»»»»»»»»»»»»»»»»»»»» Scanning for wininet.dll infection

»»»»»»»»»»»»»»»»»»»»»»»» End

Trinexus 0 Newbie Poster · Answer 3 · 2008-01-15T02:17:20+00:00

SmitFraudFix v2.274

Scan done at 16:06:09.35, Mon 01/14/2008
Run from C:\Documents and Settings\Sony\Desktop\Smitfraudfix\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{91316323-2ad5-4794-9589-52a2eaa60a68}"="aposiopetic"

[HKEY_CLASSES_ROOT\CLSID\{91316323-2ad5-4794-9589-52a2eaa60a68}\InProcServer32]
@="C:\WINDOWS\system32\shlahsd.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{91316323-2ad5-4794-9589-52a2eaa60a68}\InProcServer32]
@="C:\WINDOWS\system32\shlahsd.dll"

»»»»»»»»»»»»»»»»»»»»»»»» Killing process

»»»»»»»»»»»»»»»»»»»»»»»» hosts

127.0.0.1 localhost

»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.

»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri

C:\WINDOWS\system32\shlahsd.dll -> Hoax.Win32.Renos.gen.o
C:\WINDOWS\system32\shlahsd.dll -> Deleted

»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\Program Files\Online Add-on\ Deleted
C:\Program Files\VirusProtect 3.9\ Deleted

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix.exe by S!Ri

»»»»»»»»»»»»»»»»»»»»»»»» DNS

HKLM\SYSTEM\CCS\Services\Tcpip\..\{153DABF4-97EA-4E3E-BB0B-AE26CC235D7C}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CCS\Services\Tcpip\..\{2418B341-25B3-4DDD-B63E-A5865C70FF58}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{153DABF4-97EA-4E3E-BB0B-AE26CC235D7C}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\..\{2418B341-25B3-4DDD-B63E-A5865C70FF58}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\..\{153DABF4-97EA-4E3E-BB0B-AE26CC235D7C}: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS1\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1
HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.0.1

»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files

»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""

»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

»»»»»»»»»»»»»»»»»»»»»»»» End

Trinexus 0 Newbie Poster · Answer 4 · 2008-01-16T07:29:55+00:00

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 9:29:35 PM, on 1/15/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\eHome\ehRecvr.exe
C:\WINDOWS\eHome\ehSched.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\Program Files\Microsoft SQL Server\MSSQL$VAIO_VEDB\Binn\sqlservr.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Common Files\Sony Shared\WMPlugIn\SonicStageMonitoring.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe
C:\WINDOWS\system32\dllhost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Microsoft IntelliPoint\point32.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\AdVantage\AdVantage.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Stardock\ObjectDock\ObjectDock.exe
C:\Program Files\Windows Live\Messenger\usnsvc.exe
C:\Program Files\LimeWire\LimeWire.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Sony\Desktop\HiJackThis.exe

R3 - URLSearchHook: (no name) - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - (no file)
R3 - URLSearchHook: AOLSearchHook Class - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AOL\AOL Search Enhancement\AOLSearch.dll
R3 - URLSearchHook: (no name) - {0A94B116-4504-4e26-AB05-E61E474AA38B} - C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Ask Search Assistant BHO - {0A94B111-4504-4e26-AB05-E61E474AA38B} - C:\Program Files\AskPBar\SrchAstt\1.bin\A9SRCHAS.DLL
O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O2 - BHO: AOL Search Enhancement - {54EB34EA-E6BE-4CFD-9F4F-C4A0C2EAFA22} - C:\Program Files\AOL\AOL Search Enhancement\AOLSearch.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~4\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_07\bin\ssv.dll
O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: (no name) - {BA0BACB5-FC95-451E-94D2-4959AB0949D2} - (no file)
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: Ask Toolbar BHO - {F4D76F01-7896-458a-890F-E1F05C46069F} - C:\Program Files\AskPBar\bar\1.bin\ASKPBAR.DLL
O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O3 - Toolbar: Ask Toolbar - {F4D76F09-7896-458a-890F-E1F05C46069F} - C:\Program Files\AskPBar\bar\1.bin\ASKPBAR.DLL
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe"
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe"
O4 - HKCU\..\Run: [AdVantage] "C:\Program Files\AdVantage\AdVantage.exe"
O4 - Startup: Adobe Gamma.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Startup: OneNote 2007 Screen Clipper and Launcher.lnk = C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE
O8 - Extra context menu item: &AOL Toolbar Search - c:\program files\aol\aol toolbar 3.0\resources\en-US\local\search.html
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\Office12\EXCEL.EXE/3000
O8 - Extra context menu item: Transfer by Image Converter 2 Plus - C:\Program Files\Sony\Image Converter 2\menu.htm
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~4\Office12\ONBttnIE.dll
O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 3.0\aoltb.dll
O9 - Extra button: BitComet Search - {461CC20B-FB6E-4f16-8FE8-C29359DB100E} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.7.4.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\Office12\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM\aim.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.sony.com/vaiopeople
O15 - Trusted Zone: http://*.trymedia.com (HKLM)
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~4\Office12\GR99D3~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Image Converter video recording monitor for VAIO Entertainment - Sony Corporation - C:\Program Files\Sony\Image Converter 2\IcVzMon.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: SonicStageMonitoring - Sony Corporation - C:\Program Files\Common Files\Sony Shared\WMPlugIn\SonicStageMonitoring.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: TuneUp Drive Defrag Service (TuneUp.Defrag) - TuneUp Software GmbH - C:\WINDOWS\System32\TuneUpDefragService.exe
O23 - Service: VAIO Entertainment TV Device Arbitration Service - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCs\VzHardwareResourceManager\VzHardwareResourceManager.exe
O23 - Service: VAIO Event Service - Sony Corporation - C:\Program Files\Sony\VAIO Event Service\VESMgr.exe
O23 - Service: VAIO Media Integrated Server (VAIOMediaPlatform-IntegratedServer-AppServer) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\VMISrv.exe
O23 - Service: VAIO Media Integrated Server (HTTP) (VAIOMediaPlatform-IntegratedServer-HTTP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\SV_Httpd.exe
O23 - Service: VAIO Media Integrated Server (UPnP) (VAIOMediaPlatform-IntegratedServer-UPnP) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\UPnPFramework.exe
O23 - Service: VAIO Media Gateway Server (VAIOMediaPlatform-Mobile-Gateway) - Sony Corporation - C:\Program Files\Sony\VAIO Media Integrated Server\Platform\VmGateway.exe
O23 - Service: VAIO Entertainment UPnP Client Adapter (Vcsw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VCSW\VCSW.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O23 - Service: VAIO Entertainment Database Service (VzCdbSvc) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzCdbSvc.exe
O23 - Service: VAIO Entertainment File Import Service (VzFw) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\VAIO Entertainment Platform\VzCdb\VzFw.exe

--
End of file - 11523 bytes

crunchie 990 Most Valuable Poster Team Colleague Featured Poster · Answer 5 · 2008-01-16T14:42:34+00:00

A. Please RUN HijackThis

Click the SCAN button to produce a log.
Place a check mark beside each one of the following items:
R3 - URLSearchHook: (no name) - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - (no file)
O2 - BHO: (no name) - {BA0BACB5-FC95-451E-94D2-4959AB0949D2} - (no file)
O15 - Trusted Zone: http://*.trymedia.com (HKLM)
Now with all the items selected, and all windows closed except for HJT, delete them by clicking the FIX checked button. Close the HijackThis window.

B. 1. Please open Notepad

Click Start , then Run
Type notepad .exe in the Run Box.

2. Now copy/paste the entire content of the codebox below into the Notepad window:

Folder::
C:\VundoFix Backups
C:\Program Files\Online Add-on
C:\Program Files\VirusProtect 3.9

Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.

3. Save the above as CFScript.txt

4. Physically disconnect from the internet.

5. Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.

6. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

[IMG]http://i5.photobucket.com/albums/y153/crunchie1/CFScript.gif[/IMG]

7. After reboot, (in case it asks to reboot), please re-enable all the programs that were disabled during the running of ComboFix then post the following reports/logs into your next reply:

Combofix.txt
A new HijackThis log.

CF disconnects your machine from the internet. The connection is automatically restored before CF completes its run. If CF runs into difficulty and terminates prematurely, the connection can be manually restored by restarting your machine.

Trinexus 0 Newbie Poster · Answer 6 · 2008-01-16T16:41:21+00:00

ComboFix 08-01-14.1 - Sony 2008-01-16 6:34:30.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.305 [GMT -4:00]
Running from: C:\Documents and Settings\Sony\Desktop\ComboFix(2).exe
Command switches used :: C:\Documents and Settings\Sony\Desktop\CFScript.txt
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\VundoFix Backups

.
((((((((((((((((((((((((( Files Created from 2007-12-16 to 2008-01-16 )))))))))))))))))))))))))))))))
.

2008-01-15 09:44 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-01-15 09:44 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-01-15 09:44 . 2007-12-20 23:11 81,920 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-01-15 09:44 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-01-15 09:44 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-01-15 09:44 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-01-15 09:44 . 2008-01-14 16:06 748 --a------ C:\WINDOWS\system32\tmp.reg
2008-01-13 18:21 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
2008-01-13 10:28 . 2008-01-13 10:29 <DIR> d-------- C:\Program Files\TuneUp Utilities 2008
2008-01-13 10:28 . 2008-01-13 10:28 306,432 --a------ C:\WINDOWS\system32\TuneUpDefragService.exe
2008-01-13 10:14 . 2008-01-13 10:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
2008-01-13 09:48 . 2007-05-30 08:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-01-13 09:32 . 2007-12-20 10:41 29,440 --a------ C:\WINDOWS\system32\uxtuneup.dll
2008-01-13 09:31 . 2008-01-13 09:32 <DIR> d-------- C:\Program Files\TuneUp Utilities 2007
2008-01-13 09:31 . 2008-01-13 10:27 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-01-13 09:31 . 2008-01-13 09:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\TuneUp Software
2008-01-12 22:29 . 2008-01-13 09:18 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-01-12 22:11 . 2008-01-12 22:11 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-01-12 22:11 . 2008-01-12 22:11 1,409 --a------ C:\WINDOWS\QTFont.for
2008-01-11 21:12 . 2008-01-11 21:12 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Adobe Systems
2008-01-11 19:55 . 2008-01-11 19:55 <DIR> d-------- C:\Program Files\Common Files\Adobe Systems Shared
2008-01-10 16:45 . 2008-01-11 18:14 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Messenger Plus!
2008-01-10 08:22 . 2008-01-10 08:22 <DIR> d-------- C:\Program Files\Messenger Plus! Live
2008-01-01 23:18 . 1999-02-10 10:19 45,568 --a------ C:\WINDOWS\UniFish3.exe
2008-01-01 23:17 . 2008-01-01 23:17 <DIR> d-------- C:\Program Files\Hasbro Interactive
2008-01-01 22:38 . 2008-01-01 22:38 <DIR> d-------- C:\Program Files\90PercentAttitude
2008-01-01 22:38 . 2008-01-01 22:38 2,577,850 --a------ C:\WINDOWS\system32\Roller Coaster Mania.scr
2007-12-26 08:10 . 2007-12-26 08:10 244 --ah----- C:\sqmnoopt01.sqm
2007-12-26 08:10 . 2007-12-26 08:10 244 --ah----- C:\sqmnoopt00.sqm
2007-12-26 08:10 . 2007-12-26 08:10 232 --ah----- C:\sqmdata01.sqm
2007-12-26 08:10 . 2007-12-26 08:10 232 --ah----- C:\sqmdata00.sqm
2007-12-23 08:53 . 2007-12-23 08:53 98,304 --a------ C:\WINDOWS\system32\CmdLineExt.dll
2007-12-23 08:52 . 2007-12-23 08:57 <DIR> d-------- C:\Program Files\GameShadow
2007-12-23 08:51 . 2005-05-26 15:34 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll
2007-12-23 08:42 . 2007-12-23 08:42 <DIR> d-------- C:\Program Files\Eidos

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-01-16 04:03 --------- d-----w C:\Program Files\AdVantage
2008-01-15 19:32 --------- d-----w C:\Program Files\StepMania
2008-01-14 18:11 --------- d-----w C:\Documents and Settings\Sony\Application Data\LimeWire
2008-01-13 16:22 --------- d-----w C:\Program Files\Trend Micro
2008-01-13 13:40 --------- d-----w C:\Program Files\BitComet
2008-01-12 20:43 --------- d-----w C:\Documents and Settings\Sony\Application Data\dvdcss
2008-01-11 23:56 --------- d-----w C:\Program Files\Common Files\Adobe
2008-01-07 03:11 --------- d-----w C:\Program Files\LimeWire
2007-12-26 05:00 --------- d-----w C:\Program Files\Sony
2007-12-26 05:00 --------- d-----w C:\Documents and Settings\Sony\Application Data\Sony
2007-12-23 12:42 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-12-14 01:06 --------- d-----w C:\Program Files\Windows Live
2007-12-14 00:54 --------- d-----w C:\Program Files\Windows Live Toolbar
2007-12-14 00:53 --------- d-----w C:\Program Files\Windows Live Favorites
2007-12-14 00:49 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
2007-12-14 00:43 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
2007-12-12 07:02 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2007-12-10 14:02 2,452 ----a-w C:\Asingment6.bat
2007-12-09 18:02 --------- d-----w C:\Program Files\Trillian
2007-12-09 17:50 --------- d-----w C:\Program Files\The Weather Channel FW
2007-12-09 17:49 --------- d-----w C:\Program Files\AskPBar
2007-12-09 15:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\avg7
2007-12-07 12:04 --------- d-----w C:\Program Files\DAEMON Tools
2007-12-07 10:32 --------- d-----w C:\Documents and Settings\Sony\Application Data\AVG7
2007-12-07 10:28 685,816 ----a-w C:\WINDOWS\system32\drivers\sptd.sys
2007-11-27 15:41 --------- d-----w C:\Program Files\DivX
2007-11-27 12:55 --------- d-----w C:\Program Files\Gravity
2007-11-26 17:41 --------- d-----w C:\Documents and Settings\Sony\Application Data\U3
2007-11-22 23:35 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL OCP
2007-11-22 23:34 --------- d-----w C:\Program Files\AIM6
2007-11-22 23:34 --------- d-----w C:\Documents and Settings\Sony\Application Data\acccore
2007-11-22 23:32 --------- d-----w C:\Program Files\Viewpoint
2007-11-22 23:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\Viewpoint
2007-11-22 23:32 --------- d-----w C:\Documents and Settings\All Users\Application Data\AOL Downloads
2007-11-07 09:26 721,920 ----a-w C:\WINDOWS\system32\lsasrv.dll
2007-10-29 22:35 1,287,680 ----a-w C:\WINDOWS\system32\quartz.dll
2007-10-27 21:39 228,864 ----a-w C:\WINDOWS\system32\wmasf.dll
2007-10-20 00:56 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-10-20 00:56 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-10-18 15:31 51,224 ----a-w C:\WINDOWS\system32\sirenacm.dll
2007-07-25 18:40 229,376 ----a-w C:\Documents and Settings\Sony\cwshredder.dll
2007-07-23 00:24 5,760,054 ----a-w C:\Program Files\Sonywall.bmp
2007-07-22 21:14 4,971 ----a-w C:\Program Files\INSTALL.LOG
2007-07-22 21:14 198,174 ----a-w C:\Program Files\uninstal.log
2005-12-22 14:21 99,328 ----a-w C:\Program Files\WBInstall64.exe
2005-12-22 14:21 95,232 ----a-w C:\Program Files\wbui.dll
2005-12-22 14:21 94,208 ----a-w C:\Program Files\WBInstall32.exe
2005-12-22 14:21 93 ----a-w C:\Program Files\sig.bin
2005-12-22 14:21 92,894 ----a-w C:\Program Files\wb.ico
2005-12-22 14:21 774 ----a-w C:\Program Files\wbmnu.bmp
2005-12-22 14:21 707,072 ----a-w C:\Program Files\wblind64.dll
2005-12-22 14:21 70,656 ----a-w C:\Program Files\x64.exe
2005-12-22 14:21 7,168 ----a-w C:\Program Files\Clock.dll
2005-12-22 14:21 67,854 ----a-w C:\Program Files\wbmdi.bmp
2005-12-22 14:21 67,854 ----a-w C:\Program Files\wb.bmp
2005-12-22 14:21 638,976 ----a-w C:\Program Files\WBConfig32.exe
2005-12-22 14:21 626,688 ----a-w C:\Program Files\WBConfig.exe
2005-12-22 14:21 609,792 ----a-w C:\Program Files\WindowBlinds5.exe
2005-12-22 14:21 6,262 ----a-w C:\Program Files\xplogon.bmp
2005-12-22 14:21 6,144 ----a-w C:\Program Files\txtscroll.dll
2005-12-22 14:21 59,904 ----a-w C:\Program Files\tray64.dll
2005-12-22 14:21 58 ----a-w C:\Program Files\null.bmp
2005-12-22 14:21 512,090 ----a-w C:\Program Files\wblind32.dll
2005-12-22 14:21 512,090 ----a-w C:\Program Files\wblind.dll
2005-12-22 14:21 494 ----a-w C:\Program Files\order.html
2005-12-22 14:21 467,048 ----a-w C:\Program Files\_XPDisabled.bmp
2005-12-22 14:21 467,048 ----a-w C:\Program Files\_Disabled.bmp
2005-12-22 14:21 44,032 ----a-w C:\Program Files\wbload64.dll
2005-12-22 14:21 428,032 ----a-w C:\Program Files\Activate.exe
2005-12-22 14:21 426,021 ----a-w C:\Program Files\wb.chm
2005-12-22 14:21 4,710 ----a-w C:\Program Files\od.ico
2005-12-22 14:21 4,544 ----a-w C:\Program Files\eula.txt
2005-12-22 14:21 4,110 ----a-w C:\Program Files\readme.txt
2005-12-22 14:21 36,864 ----a-w C:\Program Files\smart.dll
2005-12-22 14:21 36,864 ----a-w C:\Program Files\rollup.wbp
2005-12-22 14:21 36,864 ----a-w C:\Program Files\32Set.exe
2005-12-22 14:21 32,768 ----a-w C:\Program Files\tray.dll
2005-12-22 14:21 32,768 ----a-w C:\Program Files\skincst.exe
2005-12-22 14:21 309 ----a-w C:\Program Files\core.dll
2005-12-22 14:21 3,586 ----a-w C:\Program Files\bms.bmp
2005-12-22 14:21 289,792 ----a-w C:\Program Files\ui64.dll
2005-12-22 14:21 28,740 ----a-w C:\Program Files\wbhelp.dll
2005-12-22 14:21 28,160 ----a-w C:\Program Files\anim.dll
2005-12-22 14:21 24,576 ----a-w C:\Program Files\url.wbp
2005-12-22 14:21 24,576 ----a-w C:\Program Files\quickl.wbp
2005-12-22 14:21 24,576 ----a-w C:\Program Files\aot.wbp
2005-12-22 14:21 232,448 ----a-w C:\Program Files\wbload.exe
2005-12-22 14:21 2,070 ----a-w C:\Program Files\bms5.bmp
2005-12-22 14:21 189,409 ----a-w C:\Program Files\wise_post.exe
2005-12-22 14:21 176,128 ----a-w C:\Program Files\WbSrv.dll
2005-12-22 14:21 167,936 ----a-w C:\Program Files\wbdb.dll
2005-12-22 14:21 151,552 ----a-w C:\Program Files\Screen.exe
2005-12-22 14:21 140,800 ----a-w C:\Program Files\unzip32.dll
2005-12-22 14:21 124,416 ----a-w C:\Program Files\wbhelp64.dll
2005-12-22 14:21 11,078 ----a-w C:\Program Files\wbback.bmp
2005-12-22 14:21 106 ----a-w C:\Program Files\xpui.uis
2005-12-22 14:21 102 ----a-w C:\Program Files\wbtd.bmp
2005-12-22 14:21 100,352 ----a-w C:\Program Files\Skins.mdb
2005-12-22 14:21 1,629 ----a-w C:\Program Files\order.now
2005-12-22 14:21 1,629 ----a-w C:\Program Files\Announce.txt
.

((((((((((((((((((((((((((((( snapshot@2008-01-14_18.32.34.45 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-01-13 22:22:16 245,760 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
+ 2008-01-16 10:34:13 245,760 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
- 2008-01-13 22:22:16 12,288 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
+ 2008-01-16 10:34:13 12,288 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
- 2008-01-13 22:22:16 7,811,072 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\ntuser.dat
+ 2008-01-16 10:34:14 7,843,840 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\ntuser.dat
- 2008-01-13 22:22:16 585,728 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
+ 2008-01-16 10:34:14 585,728 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
- 2008-01-13 22:22:17 245,760 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\ntuser.dat
+ 2008-01-16 10:34:14 245,760 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\ntuser.dat
- 2008-01-13 22:22:17 12,288 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-16 10:34:14 12,288 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
+ 2008-01-14 20:13:35 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_248.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4