Guestolo,
Have followed your instructions to the letter. Much appreciated.
Seem to be winning now i think? A couple of things to mention. Firstly, i only deleted
the items that exactly matched what you specified so although there were some
that looked similar i took no action with regards to these. There were a few files
i could not find (both from top list and from list of files in Hijackthis). Apart from that all went well.
IMPORTANT NOTE:
---------------
I ran ewido last night and was extremly tired so stopped it when it was 58%
through and had found 30 infections. Although i ran another complete scan this morning i can
only include this morning's log as i accidentally overwrote the other one(sorry hope this doesnt
cause problems). Also when i rebooted into normal mode, a command prompt came up and seem to be trying
to run something in following path c:\windows\system32\sysu.exe(not sure if that exactly right path but definetly
that exe it was trying to run). Anything that i should be worried about?
Your ongoing help is very much appreciated (seems to be working wonders so far)
and i look forward to hearing from you imminently with regards to the next steps to be taken.
Thanks
LOGS AS REQUESTED
-----------------
1. PANDA ACTIVESCAN LOG
--------------------
Incident Status Location
Potentially unwanted tool:application/adwaresheriff Not disinfected C:\Documents and Settings\Andy\Desktop\Adware Reviews.url
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Andy\Desktop\smitRem\Process.exe
Potentially unwanted tool:Application/Processor Not disinfected C:\Documents and Settings\Andy\Desktop\Spyware Fix\smitRem.exe[Process.exe]
Adware:adware/dollarrevenue Not disinfected C:\drsmartload1.exe
Spyware:Spyware/BetterInet Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\CE30EC82-2E49-4B84-90A9-F50CF3\87F78D62-364C-4E2C-BE2E-7EEDF2
Adware:adware/secure32 Not disinfected C:\WINDOWS\country.exe
Adware:Adware/AzeSearch Not disinfected C:\WINDOWS\Downloaded Program Files\azesearch.inf
Adware:adware/startpage.na Not disinfected C:\WINDOWS\dpe.dll
Adware:adware/ipinsight Not disinfected C:\WINDOWS\farmmext.ini
Spyware:Spyware/BetterInet Not disinfected C:\WINDOWS\inf\ceres.inf
Adware:adware/transponder Not disinfected C:\WINDOWS\inf\dlmax.inf
Adware:Adware/IPInsight Not disinfected C:\WINDOWS\inf\farmmext.inf
Adware:adware/fastvideoplayer Not disinfected C:\WINDOWS\inf\fastvideoplayer.inf
Adware:adware/cws.searchmeup Not disinfected C:\WINDOWS\kl.exe
Possible Virus. Not disinfected C:\WINDOWS\loadadv728.exe
Adware:adware/adwaresheriff Not disinfected C:\WINDOWS\security.html
Adware:adware/azesearch Not disinfected C:\WINDOWS\system32\azebar.xml
Adware:adware/cydoor Not disinfected C:\WINDOWS\system32\cd_clint.dll
Adware:adware/wupd Not disinfected C:\WINDOWS\system32\ide21201.vxd
Virus:Trj/Downloader.HYC Disinfected C:\WINDOWS\system32\loader.exe
Adware:adware/cashdeluxe Not disinfected C:\WINDOWS\system32\mswinup32.dll
Adware:adware/tubby Not disinfected C:\WINDOWS\system32\mtc.dll
Spyware:spyware/dynadesk Not disinfected C:\WINDOWS\system32\redirect.dll
Adware:adware/admess Not disinfected C:\WINDOWS\system32\tcpservice2.exe
Adware:adware/cws Not disinfected C:\WINDOWS\tool2.exe
Spyware:Cookie/Tickle Not disinfected D:\Documents and Settings\Milis\Cookies\milis@tickle[2].txt
Virus:Trj/Clicker.MW Disinfected D:\Documents and Settings\Milis\My Documents\Software\IPOD Software\iPod.Access.for.Windows.v2.5.zip[crack-inf.exe]
Potentially unwanted tool:Application/KillApp.B Not disinfected D:\Program Files\cladDVD 1.65\c4.exe
2. NEW HIJACKTHIS LOG
------------------
Logfile of HijackThis v1.99.1
Scan saved at 14:38:43, on 13/03/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\Program Files\ewido anti-malware\ewidoctrl.exe
C:\WINDOWS\System32\inetsrv\inetinfo.exe
C:\WINDOWS\system32\drivers\KodakCCS.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\system32\pctspk.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\system32\slserv.exe
C:\WINDOWS\System32\snmp.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
D:\Program Files\MessengerPlus! 3\MsgPlus.exe
C:\WINDOWS\System32\tlntsvr.exe
C:\Program Files\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\ZoneLabs\vsmon.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_A10IC2.EXE
C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=566...w.google.co.uk/R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =
http://go.microsoft.com/fwlink/?LinkId=566...B_PVER}&ar=homeO2 - BHO: ST - {9394EDE7-C8B5-483E-8773-474BF36AF6E4} - C:\Program Files\MSN Apps\ST\01.03.0000.1005\en-xu\stmain.dll
O2 - BHO: MSNToolBandBHO - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\MSN Apps\MSN Toolbar\01.02.4000.1001\en-gb\msntb.dll
O2 - BHO: NAV Helper - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O2 - BHO: IEPlugin Class - {CF7C3CF0-4B15-11D1-ABED-709549C10000} - D:\Program Files\Advanced System Optimizer\IEHelper.dll
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [PcSync] PCsync.exe
O4 - HKLM\..\Run: [Zone Labs Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [MessengerPlus3] "D:\Program Files\MessengerPlus! 3\MsgPlus.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [AVG7_EMC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O4 - HKLM\..\Run: [Gator] C:\WINDOWS\system32\gmt.exe
O4 - HKLM\..\Run: [Dynamic Desktop Media] C:\WINDOWS\system32\sysu.exe
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [CWS hijacker] C:\WINDOWS\dpe.dll
O4 - HKLM\..\RunServices: [CTHelper] cthelper.exe
O4 - HKLM\..\RunServices: [PcSync] PCsync.exe
O4 - HKCU\..\Run: [Systweak Wallpaper Changer] D:\Program Files\Advanced System Optimizer\wallpaper.exe -minimize
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [EPSON Stylus C40 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_A10IC2.EXE /P23 "EPSON Stylus C40 Series" /O6 "USB001" /M "Stylus C40"
O4 - HKCU\..\RunServices: [CTHelper] cthelper.exe
O4 - HKCU\..\RunServices: [PcSync] PCsync.exe
O4 - Startup: Wallpaper Changer.lnk = D:\Program Files\Advanced System Optimizer\wallpaper.exe
O4 - Global Startup: EPSON Status Monitor 3 Environment Check 2.lnk = C:\WINDOWS\system32\spool\drivers\w32x86\3\E_SRCV02.EXE
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0A46CB52-CFA0-4E78-A181-948D5E361BE3} (EpsonObj Class) -
http://esupport.epson-europe.com/ePC/activex/EpsonSetup.cabO16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) -
http://go.microsoft.com/fwlink/?linkid=39204O16 - DPF: {85D1F3B2-2A21-11D7-97B9-0010DC2A6243} (SecureLogin class) -
http://secure2.comned.com/signuptemplates/...login-devel.cabO16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) -
http://acs.pandasoftware.com/activescan/as5free/asinst.cabO18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINDOWS\system32\drivers\KodakCCS.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: PCTEL Speaker Phone (Pctspk) - PCtel, Inc. - C:\WINDOWS\system32\pctspk.exe
O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
O23 - Service: SmartLinkService (SLService) - Smart Link - C:\WINDOWS\SYSTEM32\slserv.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe
3. WHOLE REPORT FROM EWIDO(SEE IMPORTANT NOTE AT TOP)
----------------------------------
---------------------------------------------------------
ewido anti-malware - Scan report
---------------------------------------------------------
+ Created on: 10:57:18, 13/03/2006
+ Report-Checksum: 819A8572
+ Scan result:
C:\WINDOWS\system32\azesearch4.ocx -> Adware.AzSearch : Cleaned with backup
C:\WINDOWS\system32\iasada.dll -> Adware.AzSearch : Cleaned with backup
C:\WINDOWS\system32\intxt.exe -> Adware.CashDeluxe : Cleaned with backup
C:\WINDOWS\system32\mswinf32.dll -> Not-A-Virus.Hoax.Win32.VB.j : Cleaned with backup
C:\WINDOWS\system32\srsiagn.exe -> Adware.Apropos : Cleaned with backup
C:\WINDOWS\system32\temp.exe -> Adware.WinAD : Cleaned with backup
D:\APPS\Documents and Settings\Milis\Cookies\milis@com[2].txt -> TrackingCookie.Com : Cleaned with backup
D:\Documents and Settings\Milis\Cookies\milis@adtech[2].txt -> TrackingCookie.Adtech : Cleaned with backup
D:\Documents and Settings\Milis\Cookies\milis@advertising[2].txt -> TrackingCookie.Advertising : Cleaned with backup
D:\Documents and Settings\Milis\Cookies\
[email protected][1].txt -> TrackingCookie.Falkag : Cleaned with backup
D:\Documents and Settings\Milis\Cookies\
[email protected][1].txt -> TrackingCookie.Falkag : Cleaned with backup
D:\Documents and Settings\Milis\Cookies\milis@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned with backup
D:\Documents and Settings\Milis\Cookies\milis@com[2].txt -> TrackingCookie.Com : Cleaned with backup
D:\Documents and Settings\Milis\Cookies\milis@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned with backup
D:\Documents and Settings\Milis\Cookies\milis@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned with backup
D:\Documents and Settings\Milis\Cookies\milis@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned with backup
D:\Documents and Settings\Milis\Cookies\
[email protected][2].txt -> TrackingCookie.Advertising : Cleaned with backup
D:\Documents and Settings\Milis\Cookies\milis@tribalfusion[1].txt -> TrackingCookie.Tribalfusion : Cleaned with backup
D:\Documents and Settings\Milis\My Documents\Software\Advanced_system_optimizer_2.01.4_crack_by_rev.zip/crack.exe -> Downloader.Small.cgl : Cleaned with backup
D:\Program Files\Advanced System Optimizer\Loader.exe -> Not-A-Virus.VirTool.Win32.Patcher.a : Cleaned with backup
::Report End
4. WHOLE LOG MADE FROM SMITREM
---------------------------------------
smitRem © log file
version 2.8
by noahdfear
Microsoft Windows XP [Version 5.1.2600]
The current date is: 13/03/2006
The current time is: 0:32:50.15
Running from
C:\Documents and Settings\Andy\Desktop\smitRem
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Pre-run SharedTask Export
(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright© 2006 BleepingComputer.com
Registry Pseudo-Format Mode (Not a valid reg file):
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
checking for ShudderLTD key
ShudderLTD key not present!
checking for PSGuard.com key
PSGuard.com key not present!
checking for WinHound.com key
WinHound.com key not present!
spyaxe uninstaller NOT present
Winhound uninstaller NOT present
SpywareStrike uninstaller NOT present
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Existing Pre-run Files
~~~ Program Files ~~~
~~~ Shortcuts ~~~
~~~ Favorites ~~~
~~~ system32 folder ~~~
logfiles
~~~ Icons in System32 ~~~
~~~ Windows directory ~~~
secure32.html
~~~ Drive root ~~~
~~~ Miscellaneous Files/folders ~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Command Line Process Viewer/Killer/Suspender for Windows NT/2000/XP V2.03
Copyright© 2002-2003
[email protected]Killing PID 760 'explorer.exe'
Starting registry repairs
Registry repairs complete
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
SharedTask Export after registry fix
(GetSTS.exe) SharedTaskScheduler exporter by Lawrence Abrams (Grinler)
Copyright© 2006 BleepingComputer.com
Registry Pseudo-Format Mode (Not a valid reg file):
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{438755C2-A8BA-11D1-B96B-00A0C90312E1}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8C7461EF-2B13-11d2-BE35-3078302C2030}\InProcServer32]
@="%SystemRoot%\System32\browseui.dll"
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Deleting files
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Remaining Post-run Files
~~~ Program Files ~~~
~~~ Shortcuts ~~~
~~~ Favorites ~~~
~~~ system32 folder ~~~
~~~ Icons in System32 ~~~
~~~ Windows directory ~~~
~~~ Drive root ~~~
~~~ Miscellaneous Files/folders ~~~
~~~ Wininet.dll ~~~
CLEAN!
http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/smile.gif\' class=\'bbc_emoticon\' alt=\'
\' />
am i ok to turn on windows defender real time protection yet or shall i leave till we have finished completly?
