« previous next »
Pages: [1]

Author Topic: Help spyware trying to sneak in  (Read 627 times)

Offline harkoliar

  • Newbie
  • *
  • Posts: 5
  • Karma: +0/-0
    • View Profile
Help spyware trying to sneak in
« on: May 26, 2007, 07:10:59 AM »
everytime i open my computer my antivirus picks this bugger up.

 

I am totally at a lost on what to do. I have ran Spybot, Adaware, and SuperAntiSpyware programs. I also ran a full antivirus scan. None of these detected anything related to this antivirus. (cleaned out lots of cookies though  http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/tongue.gif\' class=\'bbc_emoticon\' alt=\':P\' /> ).

Anyway, upon looking at the alert, it seems to be coming from a website that tries to download its virus every single time. But there must be a trigger that tries to actually let the website know to target my computer. I am compeltely stumped and googling it didnt help much except that this is a trojan virus.

Also, I did Hijackthis program and posting my log here to anyone who can understand. Could it be a false detection error?

log

 
Quote
Logfile of HijackThis v1.99.1
Scan saved at 10:07:24 PM, on 5/26/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
F:\WINNT\System32\smss.exe
F:\WINNT\system32\winlogon.exe
F:\WINNT\system32\services.exe
F:\WINNT\system32\lsass.exe
F:\WINNT\system32\svchost.exe
F:\WINNT\System32\svchost.exe
F:\WINNT\system32\LEXBCES.EXE
F:\WINNT\system32\spoolsv.exe
F:\WINNT\system32\LEXPPS.EXE
F:\Program Files\Belkin\Bluetooth Software\bin\btwdins.exe
F:\WINNT\system32\drivers\CDAC11BA.EXE
F:\WINNT\System32\DRIVERS\dcfssvc.exe
F:\WINNT\Explorer.EXE
F:\Program Files\Ahead\InCD\InCDsrv.exe
F:\Program Files\Eset\nod32krn.exe
F:\WINNT\system32\nvsvc32.exe
F:\WINNT\System32\svchost.exe
F:\Documents and Settings\Rody\Desktop\aiepk.exe
F:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
F:\WINNT\system32\rundll32.exe
F:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
F:\Program Files\WinFast\WFTVFM\WFWIZ.exe
F:\Program Files\Eset\nod32kui.exe
F:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
F:\Program Files\iTunes\iTunesHelper.exe
F:\Program Files\QuickTime\qttask.exe
F:\Program Files\Common Files\Real\Update_OB\realsched.exe
F:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
F:\WINNT\system32\LVCOMSX.EXE
F:\Program Files\Logitech\Video\LogiTray.exe
F:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
F:\Program Files\MSN Messenger\MsnMsgr.Exe
F:\Program Files\Skype\Phone\Skype.exe
F:\Program Files\TuneUp Utilities 2006\MemOptimizer.exe
F:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
F:\Program Files\iPod\bin\iPodService.exe
F:\Program Files\Logitech\Video\FxSvr2.exe
F:\WINNT\system32\ZoneLabs\vsmon.exe
F:\Program Files\Belkin\Bluetooth Software\BTTray.exe
F:\Program Files\GetRight\getright.exe
F:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe
F:\Program Files\MagicDisc\MagicDisc.exe
F:\Program Files\Metacafe\MetacafeAgent.exe
F:\Program Files\GetRight\getright.exe
F:\WINNT\System32\svchost.exe
F:\Program Files\Maxthon\Maxthon.exe
F:\Program Files\Windows Media Player\wmplayer.exe
F:\Program Files\Hijackthis\HijackThis.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar =  http://red.clientapps.yahoo.com/customize/...rch/search.html
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page =  http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page =  http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL =  http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL =  http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar =  http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page =  http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page =  http://www.yahoo.com/
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) =  http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - F:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - F:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - F:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Mega Manager IE Click Monitor - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - c:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll
O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - F:\Program Files\DAP\DAPIEBar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - F:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [aiepk] F:\Documents and Settings\Rody\Desktop\aiepk.exe
O4 - HKLM\..\Run: [Zone Labs Client] F:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Lexmark X1100 Series] "F:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [WinFast Schedule] F:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [nod32kui] "F:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [iTunesHelper] "F:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "F:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [LVCOMSX] F:\WINNT\system32\LVCOMSX.EXE
O4 - HKLM\..\Run: [LogitechVideoRepair] F:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] F:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [Yahoo! Pager] "F:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [MsnMsgr] "F:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "F:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [TuneUp MemOptimizer] "F:\Program Files\TuneUp Utilities 2006\MemOptimizer.exe" autostart
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "F:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [SUPERAntiSpyware] F:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: MagicDisc.lnk = F:\Program Files\MagicDisc\MagicDisc.exe
O4 - Startup: MetaCafe.lnk = F:\Program Files\Metacafe\MetacafeAgent.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = F:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = F:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: GetRight - Tray Icon.lnk = F:\Program Files\GetRight\getright.exe
O4 - Global Startup: Metacafe.lnk = F:\Program Files\Metacafe\MetacafeAgent.exe
O4 - Global Startup: Smart Wizard Wireless Settings.lnk = ?
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Clean Traces - F:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - F:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Yahoo! Search - file:///F:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Download &all with DAP - F:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - F:\Program Files\Belkin\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///F:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///F:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///F:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - F:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - F:\PROGRA~1\DAP\DAP.EXE
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - F:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - F:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - F:\Documents and Settings\Rody\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.moove.com
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) -  http://www.lizardtech.com/download/files/w...ntrol_en_US.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - F:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) -  http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) -  http://groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) -  http://v5.windowsupdate.microsoft.com/v5co...b?1105766151272
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) -  http://chat.yahoo.com/cab/yuplapp.cab
O16 - DPF: {B3872502-F9FD-4E96-93FF-0D37298F0689} (SOESysInfo Control) -  http://everquest2.station.sony.com/systemscan/soesysinfo.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{EA7B2DA4-2F0D-4571-BF47-5F1984AB5BCE}: NameServer = 192.168.0.1
O18 - Protocol: asp - {8D32BA61-D15B-11D4-894B-000000000000} - F:\WINNT\system32\hsppp.dll
O18 - Protocol: ezpp - {810403FA-E82E-11D5-8AAB-0010A404A3DE} - F:\WINNT\system32\EZTOOL~1.DLL
O18 - Protocol: hsp - {8D32BA61-D15B-11D4-894B-000000000000} - F:\WINNT\system32\hsppp.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "F:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: x-asp - {8D32BA61-D15B-11D4-894B-000000000000} - F:\WINNT\system32\hsppp.dll
O18 - Protocol: x-hsp - {8D32BA61-D15B-11D4-894B-000000000000} - F:\WINNT\system32\hsppp.dll
O20 - AppInit_DLLs: F:\WINNT\system32\perfc000.dat
O20 - Winlogon Notify: !SASWinLogon - F:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - F:\WINNT\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - F:\WINNT\system32\WPDShServiceObj.dll
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - F:\Program Files\Belkin\Bluetooth Software\bin\btwdins.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - F:\WINNT\system32\drivers\CDAC11BA.EXE
O23 - Service: dcfssvc (Dcfssvc) - Eastman Kodak Company - F:\WINNT\System32\DRIVERS\dcfssvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - F:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPodService - Apple Computer, Inc. - F:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - F:\WINNT\system32\LEXBCES.EXE
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - F:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINNT\system32\nvsvc32.exe
O23 - Service: ptssvc - Unknown owner - F:\Program Files\KODAK\KODAK Picture Transfer Software\PTSsvc.exe (file missing)
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - F:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - F:\WINNT\system32\ZoneLabs\vsmon.exe
help?
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
Help spyware trying to sneak in
« Reply #1 on: May 26, 2007, 10:00:30 AM »
Download this file - Combofix.exe and save it ONLY to your desktop
Double click combofix.exe & follow the prompts.
When finished, it shall produce a log for you.
Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Post the log from Combofix as well as a fresh hijackthis log please
Don't wrap the logs in quotes please
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline harkoliar

  • Newbie
  • *
  • Posts: 5
  • Karma: +0/-0
    • View Profile
Help spyware trying to sneak in
« Reply #2 on: May 27, 2007, 02:03:48 AM »
ok thanks for the heads up. For some reason, the problem has gone away for today. My antivirus is not going crazy everytime I start up my computer. I didnt do anything except run the combofix and hijackthis you mentioned.

And here is the log file.

HIJACKTHIS latest scan
-------
Logfile of HijackThis v1.99.1
Scan saved at 4:55:21 PM, on 5/27/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
F:\WINNT\System32\smss.exe
F:\WINNT\system32\winlogon.exe
F:\WINNT\system32\services.exe
F:\WINNT\system32\lsass.exe
F:\WINNT\system32\svchost.exe
F:\WINNT\System32\svchost.exe
F:\WINNT\system32\LEXBCES.EXE
F:\WINNT\system32\spoolsv.exe
F:\WINNT\system32\LEXPPS.EXE
F:\Program Files\Belkin\Bluetooth Software\bin\btwdins.exe
F:\WINNT\system32\drivers\CDAC11BA.EXE
F:\WINNT\System32\DRIVERS\dcfssvc.exe
F:\Program Files\Ahead\InCD\InCDsrv.exe
F:\Program Files\Eset\nod32krn.exe
F:\WINNT\system32\nvsvc32.exe
F:\WINNT\System32\svchost.exe
F:\WINNT\system32\ZoneLabs\vsmon.exe
F:\WINNT\Explorer.EXE
F:\Documents and Settings\Rody\Desktop\aiepk.exe
F:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
F:\WINNT\system32\rundll32.exe
F:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
F:\Program Files\WinFast\WFTVFM\WFWIZ.exe
F:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
F:\Program Files\Eset\nod32kui.exe
F:\Program Files\iTunes\iTunesHelper.exe
F:\Program Files\QuickTime\qttask.exe
F:\Program Files\Common Files\Real\Update_OB\realsched.exe
F:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
F:\Program Files\iPod\bin\iPodService.exe
F:\Program Files\Logitech\Video\LogiTray.exe
F:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
F:\Program Files\MSN Messenger\MsnMsgr.Exe
F:\Program Files\Skype\Phone\Skype.exe
F:\Program Files\TuneUp Utilities 2006\MemOptimizer.exe
F:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
F:\WINNT\system32\wuauclt.exe
F:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
F:\WINNT\system32\LVComsX.exe
F:\Program Files\Logitech\Video\FxSvr2.exe
F:\Program Files\Belkin\Bluetooth Software\BTTray.exe
F:\Program Files\GetRight\getright.exe
F:\Program Files\Metacafe\MetacafeAgent.exe
F:\Program Files\GetRight\getright.exe
F:\Program Files\NETGEAR\WG121 Configuration Utility\wlancfg8.exe
F:\Program Files\MagicDisc\MagicDisc.exe
F:\WINNT\System32\svchost.exe
F:\Program Files\Maxthon\Maxthon.exe
F:\Program Files\Mozilla Thunderbird\thunderbird.exe
F:\Program Files\Hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaul...rch/search.html
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/defaul...//www.yahoo.com
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - F:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll
O2 - BHO: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - F:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - F:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - F:\Program Files\Yahoo!\Common\yiesrvc.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - F:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: Mega Manager IE Click Monitor - {bf00e119-21a3-4fd1-b178-3b8537e75c92} - c:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll
O3 - Toolbar: DAP Bar - {62999427-33FC-4baf-9C9C-BCE6BD127F08} - F:\Program Files\DAP\DAPIEBar.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - F:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll
O3 - Toolbar: Megaupload Toolbar - {4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C} - F:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [aiepk] F:\Documents and Settings\Rody\Desktop\aiepk.exe
O4 - HKLM\..\Run: [Zone Labs Client] F:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [Lexmark X1100 Series] "F:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
O4 - HKLM\..\Run: [WinFast Schedule] F:\Program Files\WinFast\WFTVFM\WFWIZ.exe
O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
O4 - HKLM\..\Run: [nod32kui] "F:\Program Files\Eset\nod32kui.exe" /WAITSERVICE
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [iTunesHelper] "F:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [QuickTime Task] "F:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "F:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
O4 - HKLM\..\Run: [SunJavaUpdateSched] "F:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [LogitechVideoRepair] F:\Program Files\Logitech\Video\ISStart.exe
O4 - HKLM\..\Run: [LogitechVideoTray] F:\Program Files\Logitech\Video\LogiTray.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE F:\WINNT\system32\NvCpl.dll,NvStartup
O4 - HKCU\..\Run: [Yahoo! Pager] "F:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
O4 - HKCU\..\Run: [MsnMsgr] "F:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "F:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [TuneUp MemOptimizer] "F:\Program Files\TuneUp Utilities 2006\MemOptimizer.exe" autostart
O4 - HKCU\..\Run: [LogitechSoftwareUpdate] "F:\Program Files\Logitech\Video\ManifestEngine.exe" boot
O4 - HKCU\..\Run: [SUPERAntiSpyware] F:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - Startup: MagicDisc.lnk = F:\Program Files\MagicDisc\MagicDisc.exe
O4 - Startup: MetaCafe.lnk = F:\Program Files\Metacafe\MetacafeAgent.exe
O4 - Startup: PowerReg Scheduler V3.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = F:\Program Files\Adobe\Reader 8.0\Reader\reader_sl.exe
O4 - Global Startup: Adobe Reader Synchronizer.lnk = F:\Program Files\Adobe\Reader 8.0\Reader\AdobeCollabSync.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: GetRight - Tray Icon.lnk = F:\Program Files\GetRight\getright.exe
O4 - Global Startup: Metacafe.lnk = F:\Program Files\Metacafe\MetacafeAgent.exe
O4 - Global Startup: Smart Wizard Wireless Settings.lnk = ?
O8 - Extra context menu item: &Clean Traces - F:\Program Files\DAP\Privacy Package\dapcleanerie.htm
O8 - Extra context menu item: &Download with &DAP - F:\Program Files\DAP\dapextie.htm
O8 - Extra context menu item: &Yahoo! Search - file:///F:\Program Files\Yahoo!\Common/ycsrch.htm
O8 - Extra context menu item: Download &all with DAP - F:\Program Files\DAP\dapextie2.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://F:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O8 - Extra context menu item: Send To &Bluetooth - F:\Program Files\Belkin\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Yahoo! &Dictionary - file:///F:\Program Files\Yahoo!\Common/ycdict.htm
O8 - Extra context menu item: Yahoo! &Maps - file:///F:\Program Files\Yahoo!\Common/ycmap.htm
O8 - Extra context menu item: Yahoo! &SMS - file:///F:\Program Files\Yahoo!\Common/ycsms.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - F:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - F:\Program Files\Yahoo!\Common\yiesrvc.dll
O9 - Extra button: Run DAP - {669695BC-A811-4A9D-8CDF-BA8C795F261C} - F:\PROGRA~1\DAP\DAP.EXE
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - F:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - F:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - F:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - F:\Documents and Settings\Rody\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - F:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.moove.com
O16 - DPF: {0E8D0700-75DF-11D3-8B4A-0008C7450C4A} (DjVuCtl Class) - http://www.lizardtech.com/download/files/w...ntrol_en_US.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - F:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_1_0_0_44.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://groups.msn.com/controls/PhotoUC/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://v5.windowsupdate.microsoft.com/v5co...b?1105766151272
O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) - http://chat.yahoo.com/cab/yuplapp.cab
O16 - DPF: {B3872502-F9FD-4E96-93FF-0D37298F0689} (SOESysInfo Control) - http://everquest2.station.sony.com/systemscan/soesysinfo.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{EA7B2DA4-2F0D-4571-BF47-5F1984AB5BCE}: NameServer = 192.168.0.1
O18 - Protocol: asp - {8D32BA61-D15B-11D4-894B-000000000000} - F:\WINNT\system32\hsppp.dll
O18 - Protocol: ezpp - {810403FA-E82E-11D5-8AAB-0010A404A3DE} - F:\WINNT\system32\EZTOOL~1.DLL
O18 - Protocol: hsp - {8D32BA61-D15B-11D4-894B-000000000000} - F:\WINNT\system32\hsppp.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "F:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O18 - Protocol: x-asp - {8D32BA61-D15B-11D4-894B-000000000000} - F:\WINNT\system32\hsppp.dll
O18 - Protocol: x-hsp - {8D32BA61-D15B-11D4-894B-000000000000} - F:\WINNT\system32\hsppp.dll
O20 - Winlogon Notify: !SASWinLogon - F:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - F:\WINNT\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - F:\WINNT\system32\WPDShServiceObj.dll
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - F:\Program Files\Belkin\Bluetooth Software\bin\btwdins.exe
O23 - Service: C-DillaCdaC11BA - Macrovision - F:\WINNT\system32\drivers\CDAC11BA.EXE
O23 - Service: dcfssvc (Dcfssvc) - Eastman Kodak Company - F:\WINNT\System32\DRIVERS\dcfssvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - F:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: InCD Helper (InCDsrv) - Ahead Software AG - F:\Program Files\Ahead\InCD\InCDsrv.exe
O23 - Service: iPodService - Apple Computer, Inc. - F:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - F:\WINNT\system32\LEXBCES.EXE
O23 - Service: NOD32 Kernel Service (NOD32krn) - Eset  - F:\Program Files\Eset\nod32krn.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - F:\WINNT\system32\nvsvc32.exe
O23 - Service: ptssvc - Unknown owner - F:\Program Files\KODAK\KODAK Picture Transfer Software\PTSsvc.exe (file missing)
O23 - Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) - TuneUp Software GmbH - F:\Program Files\TuneUp Utilities 2006\WinStylerThemeSvc.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs Inc. - F:\WINNT\system32\ZoneLabs\vsmon.exe

----------

Combofix scan

"Rody" - 2007-05-27 16:35:39    Service Pack 2  
ComboFix 07-05.26.3.V - Running from: "F:\Documents and Settings\Rody\Desktop\"


(((((((((((((((((((((((((((((((   Files Created from 2007-04-27 to 2007-05-27  ))))))))))))))))))))))))))))))))))


2007-05-27 15:31 49,152 --a------ F:\WINNT\nircmd.exe
2007-05-26 17:46 <DIR> d-------- F:\Program Files\SUPERAntiSpyware
2007-05-26 17:46 <DIR> d-------- F:\DOCUME~1\Rody\APPLIC~1\SUPERAntiSpyware.com
2007-05-26 17:46 <DIR> d-------- F:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com
2007-05-16 16:34 <DIR> d-------- F:\Program Files\Black Isle
2007-05-15 17:07 176,235 --a------ F:\WINNT\system32\Primomonnt.dll
2007-05-15 17:07 <DIR> d-------- F:\WINNT\PrimoPDF
2007-05-15 17:07 <DIR> d-------- F:\Program Files\activePDF
2007-05-12 16:56 <DIR> d-------- F:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-05-08 02:01 <DIR> d-------- F:\Program Files\Belkin
2007-05-07 21:41 <DIR> d-------- F:\Program Files\Atari
2007-05-07 19:12 <DIR> d-------- F:\Program Files\Railroad Tycoon 3
2007-05-07 18:56 4,096 --a------ F:\WINNT\d3dx.dat
2007-05-07 18:47 <DIR> d-------- F:\Documents and Settings\Rody\WINDOWS
2007-05-07 18:47 <DIR> d-------- F:\DOCUME~1\Rody\WINDOWS
2007-04-29 12:32 <DIR> d-------- F:\Program Files\GameSpy Arcade
2007-04-27 18:41 92,288 --a------ F:\WINNT\system32\drivers\mcdbus.sys
2007-04-27 18:41 <DIR> d-------- F:\Program Files\MagicDisc


((((((((((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-05-27 06:35:09 -------- d-----w F:\DOCUME~1\Rody\APPLIC~1\Skype
2007-05-27 05:36:51 -------- d-----w F:\Program Files\Lexmark X1100 Series
2007-05-26 22:29:32 -------- d-----w F:\DOCUME~1\Rody\APPLIC~1\MetaCafe
2007-05-26 12:35:41 -------- d-----w F:\Program Files\Maxthon
2007-05-26 07:45:49 -------- d-----w F:\Program Files\Common Files\Wise Installation Wizard
2007-05-25 08:50:26 -------- d-----w F:\Program Files\GetRight
2007-05-16 06:57:10 -------- d--h--w F:\Program Files\InstallShield Installation Information
2007-05-15 01:25:57 -------- d-----w F:\Program Files\Yahoo SiteBuilder
2007-05-11 07:55:45 -------- d-----w F:\DOCUME~1\Rody\APPLIC~1\MegauploadToolbar
2007-05-07 11:44:49 98,304 ----a-w F:\WINNT\system32\CmdLineExt.dll
2007-05-07 10:20:44 43,520 -c--a-w F:\WINNT\system32\CmdLineExt03.dll
2007-04-27 08:16:00 -------- d-----w F:\Program Files\MagicISO
2007-04-18 16:12:23 2,854,400 ----a-w F:\WINNT\system32\msi.dll
2007-04-09 11:31:54 -------- d-----w F:\Program Files\Windows Media Connect 2
2007-04-08 05:03:28 -------- d-----w F:\Program Files\Common Files\Symantec Shared
2007-04-08 04:52:02 -------- d-----w F:\Program Files\ePrompter
2007-04-07 06:40:41 -------- d-----w F:\Program Files\DiscWizard for Windows
2007-04-04 02:51:19 -------- d-----w F:\DOCUME~1\Rody\APPLIC~1\Folder Guard
2007-04-04 02:23:39 -------- d-----w F:\DOCUME~1\Rody\APPLIC~1\IMVU
2007-04-04 02:23:34 -------- d-----w F:\Program Files\IMVU
2007-04-03 16:43:37 -------- d-----w F:\DOCUME~1\Rody\APPLIC~1\Megaupload
2007-04-03 16:42:37 -------- d-----w F:\Program Files\MegauploadToolbar
2007-04-03 12:40:44 -------- d-----w F:\Program Files\Logitech
2007-04-03 12:39:11 270,336 ----a-w F:\WINNT\system32\imon.dll
2007-04-03 12:39:10 502,368 ----a-w F:\WINNT\system32\drivers\amon.sys
2007-04-03 12:12:34 -------- d-----w F:\Program Files\NETGEAR
2007-04-01 01:32:27 -------- d-----w F:\Program Files\WS_FTP
2007-04-01 01:32:27 -------- d-----w F:\Program Files\StarCraft
2007-04-01 01:32:27 -------- d-----w F:\Program Files\PHStat2
2007-04-01 01:32:27 -------- d-----w F:\Program Files\Eraser
2007-04-01 01:31:32 -------- d-----w F:\Program Files\Mozilla Thunderbird
2007-04-01 01:31:27 -------- d-----w F:\DOCUME~1\Rody\APPLIC~1\uTorrent
2007-03-31 11:12:33 -------- d-----w F:\DOCUME~1\Rody\APPLIC~1\LucasArts
2007-03-31 10:08:24 646,392 ----a-w F:\WINNT\system32\drivers\sptd.sys
2007-03-31 08:50:45 -------- d-----w F:\DOCUME~1\Rody\APPLIC~1\dvdcss
2007-03-17 13:43:01 292,864 ----a-w F:\WINNT\system32\winsrv.dll
2007-03-08 15:36:28 577,536 ----a-w F:\WINNT\system32\user32.dll
2007-03-08 15:36:28 40,960 ----a-w F:\WINNT\system32\mf3216.dll
2007-03-08 15:36:28 281,600 ----a-w F:\WINNT\system32\gdi32.dll
2007-03-08 13:47:48 1,843,584 ----a-w F:\WINNT\system32\win32k.sys


((((((((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))
 
 
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{02478D38-C3F9-4EFB-9B51-7695ECA05670}=F:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll [2006-10-26 09:28]
{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}=F:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL [2006-10-31 16:55]
{53707962-6F74-2D53-2644-206D7942484F}=F:\PROGRA~1\SPYBOT~1\SDHelper.dll [2004-05-12 01:03]
{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}=F:\Program Files\Yahoo!\Common\yiesrvc.dll [2006-10-31 14:29]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=F:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43]
{bf00e119-21a3-4fd1-b178-3b8537e75c92}=c:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll [2007-04-03 15:18]
F:\ComboFix\temp00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
{02478D38-C3F9-4EFB-9B51-7695ECA05670}=F:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll [2006-10-26 09:28]
{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}=F:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL [2006-10-31 16:55]
{53707962-6F74-2D53-2644-206D7942484F}=F:\PROGRA~1\SPYBOT~1\SDHelper.dll [2004-05-12 01:03]
{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}=F:\Program Files\Yahoo!\Common\yiesrvc.dll [2006-10-31 14:29]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=F:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43]
{bf00e119-21a3-4fd1-b178-3b8537e75c92}=c:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll [2007-04-03 15:18]
"Synchronization Manager"="mobsync.exe" [2004-08-04 17:56 F:\WINNT\system32\mobsync.exe]
"aiepk"="F:\Documents and Settings\Rody\Desktop\aiepk.exe" [2004-04-02 19:33]
"Zone Labs Client"="F:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe" [2004-02-17 17:01]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 17:56 F:\WINNT\system32\bthprops.cpl]
"Lexmark X1100 Series"="F:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" [2003-08-20 00:43]
"WinFast Schedule"="F:\Program Files\WinFast\WFTVFM\WFWIZ.exe" [2004-11-22 08:16]
"UserFaultCheck"="%systemroot%\system32\dumprep 0 -u" []
"nod32kui"="F:\Program Files\Eset\nod32kui.exe" [2007-04-03 22:39]
"nwiz"="nwiz.exe" [2006-06-01 17:22 F:\WINNT\system32\nwiz.exe]
"iTunesHelper"="F:\Program Files\iTunes\iTunesHelper.exe" [2006-06-14 16:24]
"QuickTime Task"="F:\Program Files\QuickTime\qttask.exe" [2006-07-24 00:03]
"TkBellExe"="F:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-08-21 23:48]
"SunJavaUpdateSched"="F:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"LogitechVideoRepair"="F:\Program Files\Logitech\Video\ISStart.exe" [2005-06-08 15:24]
"LogitechVideoTray"="F:\Program Files\Logitech\Video\LogiTray.exe" [2005-06-08 15:14]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="F:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2006-11-30 20:49]
"MsnMsgr"="F:\Program Files\MSN Messenger\MsnMsgr.exe" [2006-01-24 10:37]
"Skype"="F:\Program Files\Skype\Phone\Skype.exe" [2006-10-13 16:20]
"TuneUp MemOptimizer"="F:\Program Files\TuneUp Utilities 2006\MemOptimizer.exe" [2005-09-21 22:34]
"LogitechSoftwareUpdate"="F:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-06-08 14:44]
"SUPERAntiSpyware"="F:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-05-23 10:12]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=F:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop
"tscuninstall"=%systemroot%\system32\tscupgrd.exe

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
F:\Documents and Settings\Rody\Desktop\photoshop\couple final formal.jpg

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"="F:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 13:55]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
F:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, msnsspc.dll, digest.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=F:\WINNT\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="F:\Program Files\QuickTime\qttask.exe" -atboottime
"Anvshell"=anvshell.exe
"DownloadAccelerator"=F:\PROGRA~1\DAP\DAP.EXE /STARTUP
"InCD"=F:\Program Files\Ahead\InCD\InCD.exe
"LiveNote"=livenote.exe
"LogitechVideoRepair"=F:\Program Files\Logitech\Video\ISStart.exe
"IMJPMIG8.1"="F:\WINNT\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
"NvMediaCenter"=RUNDLL32.EXE F:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
"nwiz"=nwiz.exe /install
"RemoteControl"="F:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
"LogitechVideoTray"=F:\Program Files\Logitech\Video\LogiTray.exe
"NeroFilterCheck"=F:\WINNT\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs BthServ


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ac269cb4-d83f-11db-ad4d-00095bd10204}]
AutoRun\command- F:\WINNT\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Boot.exe e
Open\command- Boot.exe e
 

Contents of the 'Scheduled Tasks' folder
2007-05-11 07:16:34  F:\WINNT\tasks\1-Click Maintenance.job

********************************************************************

catchme 0.3.681 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-05-27 16:42:07
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0


********************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\BTHPORT\Parameters\Services\{00001000-0000-1000-8000-00805f9b34fb}]


[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\BTHPORT\Parameters\Services\{00001105-0000-1000-8000-00805f9b34fb}]


[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\BTHPORT\Parameters\Services\{00001115-0000-1000-8000-00805f9b34fb}]


Completion time: 2007-05-27 16:43:02
F:\ComboFix-quarantined-files.txt ... 2007-05-27 16:42
F:\ComboFix2.txt ... 2007-05-27 15:42

 --- E O F ---
------

I do hope this would help. Thanks in advance http://images.thetechguide.com/forum/public/style_emoticons/<#EMO_DIR#>/wink.gif\' class=\'bbc_emoticon\' alt=\';)\' />
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
Help spyware trying to sneak in
« Reply #3 on: May 27, 2007, 09:35:26 AM »
Looks as if you ran Combofix more than once
Can you post me the contents of these 2 files please
F:\ComboFix-quarantined-files.txt
F:\ComboFix2.txt
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Offline harkoliar

  • Newbie
  • *
  • Posts: 5
  • Karma: +0/-0
    • View Profile
Help spyware trying to sneak in
« Reply #4 on: May 28, 2007, 05:07:05 AM »
[quote name=\'guestolo\' post=\'331491\' date=\'May 28 2007, 12:35 AM\']Looks as if you ran Combofix more than once
Can you post me the contents of these 2 files please
F:\ComboFix-quarantined-files.txt
F:\ComboFix2.txt [/quote]

ok here it is

combofix.txt

"Rody" - 2007-05-27 16:35:39    Service Pack 2  
ComboFix 07-05.26.3.V - Running from: "F:\Documents and Settings\Rody\Desktop\"


(((((((((((((((((((((((((((((((   Files Created from 2007-04-27 to 2007-05-27  ))))))))))))))))))))))))))))))))))


2007-05-27 15:31 49,152 --a------ F:\WINNT\nircmd.exe
2007-05-26 17:46 <DIR> d-------- F:\Program Files\SUPERAntiSpyware
2007-05-26 17:46 <DIR> d-------- F:\DOCUME~1\Rody\APPLIC~1\SUPERAntiSpyware.com
2007-05-26 17:46 <DIR> d-------- F:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com
2007-05-16 16:34 <DIR> d-------- F:\Program Files\Black Isle
2007-05-15 17:07 176,235 --a------ F:\WINNT\system32\Primomonnt.dll
2007-05-15 17:07 <DIR> d-------- F:\WINNT\PrimoPDF
2007-05-15 17:07 <DIR> d-------- F:\Program Files\activePDF
2007-05-12 16:56 <DIR> d-------- F:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-05-08 02:01 <DIR> d-------- F:\Program Files\Belkin
2007-05-07 21:41 <DIR> d-------- F:\Program Files\Atari
2007-05-07 19:12 <DIR> d-------- F:\Program Files\Railroad Tycoon 3
2007-05-07 18:56 4,096 --a------ F:\WINNT\d3dx.dat
2007-05-07 18:47 <DIR> d-------- F:\Documents and Settings\Rody\WINDOWS
2007-05-07 18:47 <DIR> d-------- F:\DOCUME~1\Rody\WINDOWS
2007-04-29 12:32 <DIR> d-------- F:\Program Files\GameSpy Arcade
2007-04-27 18:41 92,288 --a------ F:\WINNT\system32\drivers\mcdbus.sys
2007-04-27 18:41 <DIR> d-------- F:\Program Files\MagicDisc


((((((((((((((((((((((((((((((((((((((((((((((((   Find3M Report   )))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-05-27 06:35:09 -------- d-----w F:\DOCUME~1\Rody\APPLIC~1\Skype
2007-05-27 05:36:51 -------- d-----w F:\Program Files\Lexmark X1100 Series
2007-05-26 22:29:32 -------- d-----w F:\DOCUME~1\Rody\APPLIC~1\MetaCafe
2007-05-26 12:35:41 -------- d-----w F:\Program Files\Maxthon
2007-05-26 07:45:49 -------- d-----w F:\Program Files\Common Files\Wise Installation Wizard
2007-05-25 08:50:26 -------- d-----w F:\Program Files\GetRight
2007-05-16 06:57:10 -------- d--h--w F:\Program Files\InstallShield Installation Information
2007-05-15 01:25:57 -------- d-----w F:\Program Files\Yahoo SiteBuilder
2007-05-11 07:55:45 -------- d-----w F:\DOCUME~1\Rody\APPLIC~1\MegauploadToolbar
2007-05-07 11:44:49 98,304 ----a-w F:\WINNT\system32\CmdLineExt.dll
2007-05-07 10:20:44 43,520 -c--a-w F:\WINNT\system32\CmdLineExt03.dll
2007-04-27 08:16:00 -------- d-----w F:\Program Files\MagicISO
2007-04-18 16:12:23 2,854,400 ----a-w F:\WINNT\system32\msi.dll
2007-04-09 11:31:54 -------- d-----w F:\Program Files\Windows Media Connect 2
2007-04-08 05:03:28 -------- d-----w F:\Program Files\Common Files\Symantec Shared
2007-04-08 04:52:02 -------- d-----w F:\Program Files\ePrompter
2007-04-07 06:40:41 -------- d-----w F:\Program Files\DiscWizard for Windows
2007-04-04 02:51:19 -------- d-----w F:\DOCUME~1\Rody\APPLIC~1\Folder Guard
2007-04-04 02:23:39 -------- d-----w F:\DOCUME~1\Rody\APPLIC~1\IMVU
2007-04-04 02:23:34 -------- d-----w F:\Program Files\IMVU
2007-04-03 16:43:37 -------- d-----w F:\DOCUME~1\Rody\APPLIC~1\Megaupload
2007-04-03 16:42:37 -------- d-----w F:\Program Files\MegauploadToolbar
2007-04-03 12:40:44 -------- d-----w F:\Program Files\Logitech
2007-04-03 12:39:11 270,336 ----a-w F:\WINNT\system32\imon.dll
2007-04-03 12:39:10 502,368 ----a-w F:\WINNT\system32\drivers\amon.sys
2007-04-03 12:12:34 -------- d-----w F:\Program Files\NETGEAR
2007-04-01 01:32:27 -------- d-----w F:\Program Files\WS_FTP
2007-04-01 01:32:27 -------- d-----w F:\Program Files\StarCraft
2007-04-01 01:32:27 -------- d-----w F:\Program Files\PHStat2
2007-04-01 01:32:27 -------- d-----w F:\Program Files\Eraser
2007-04-01 01:31:32 -------- d-----w F:\Program Files\Mozilla Thunderbird
2007-04-01 01:31:27 -------- d-----w F:\DOCUME~1\Rody\APPLIC~1\uTorrent
2007-03-31 11:12:33 -------- d-----w F:\DOCUME~1\Rody\APPLIC~1\LucasArts
2007-03-31 10:08:24 646,392 ----a-w F:\WINNT\system32\drivers\sptd.sys
2007-03-31 08:50:45 -------- d-----w F:\DOCUME~1\Rody\APPLIC~1\dvdcss
2007-03-17 13:43:01 292,864 ----a-w F:\WINNT\system32\winsrv.dll
2007-03-08 15:36:28 577,536 ----a-w F:\WINNT\system32\user32.dll
2007-03-08 15:36:28 40,960 ----a-w F:\WINNT\system32\mf3216.dll
2007-03-08 15:36:28 281,600 ----a-w F:\WINNT\system32\gdi32.dll
2007-03-08 13:47:48 1,843,584 ----a-w F:\WINNT\system32\win32k.sys


((((((((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))
 
 
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{02478D38-C3F9-4EFB-9B51-7695ECA05670}=F:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll [2006-10-26 09:28]
{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}=F:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL [2006-10-31 16:55]
{53707962-6F74-2D53-2644-206D7942484F}=F:\PROGRA~1\SPYBOT~1\SDHelper.dll [2004-05-12 01:03]
{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}=F:\Program Files\Yahoo!\Common\yiesrvc.dll [2006-10-31 14:29]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=F:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43]
{bf00e119-21a3-4fd1-b178-3b8537e75c92}=c:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll [2007-04-03 15:18]
F:\ComboFix\temp00

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
{02478D38-C3F9-4EFB-9B51-7695ECA05670}=F:\Program Files\Yahoo!\Companion\Installs\cpn4\yt.dll [2006-10-26 09:28]
{4E7BD74F-2B8D-469E-CCB0-B130EEDBE97C}=F:\PROGRA~1\MEGAUP~1\MEGAUP~1.DLL [2006-10-31 16:55]
{53707962-6F74-2D53-2644-206D7942484F}=F:\PROGRA~1\SPYBOT~1\SDHelper.dll [2004-05-12 01:03]
{5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897}=F:\Program Files\Yahoo!\Common\yiesrvc.dll [2006-10-31 14:29]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=F:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43]
{bf00e119-21a3-4fd1-b178-3b8537e75c92}=c:\Program Files\Megaupload\Mega Manager\MegaIEMn.dll [2007-04-03 15:18]
"Synchronization Manager"="mobsync.exe" [2004-08-04 17:56 F:\WINNT\system32\mobsync.exe]
"aiepk"="F:\Documents and Settings\Rody\Desktop\aiepk.exe" [2004-04-02 19:33]
"Zone Labs Client"="F:\PROGRA~1\ZONELA~1\ZONEAL~1\zlclient.exe" [2004-02-17 17:01]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 17:56 F:\WINNT\system32\bthprops.cpl]
"Lexmark X1100 Series"="F:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" [2003-08-20 00:43]
"WinFast Schedule"="F:\Program Files\WinFast\WFTVFM\WFWIZ.exe" [2004-11-22 08:16]
"UserFaultCheck"="%systemroot%\system32\dumprep 0 -u" []
"nod32kui"="F:\Program Files\Eset\nod32kui.exe" [2007-04-03 22:39]
"nwiz"="nwiz.exe" [2006-06-01 17:22 F:\WINNT\system32\nwiz.exe]
"iTunesHelper"="F:\Program Files\iTunes\iTunesHelper.exe" [2006-06-14 16:24]
"QuickTime Task"="F:\Program Files\QuickTime\qttask.exe" [2006-07-24 00:03]
"TkBellExe"="F:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-08-21 23:48]
"SunJavaUpdateSched"="F:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"LogitechVideoRepair"="F:\Program Files\Logitech\Video\ISStart.exe" [2005-06-08 15:24]
"LogitechVideoTray"="F:\Program Files\Logitech\Video\LogiTray.exe" [2005-06-08 15:14]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yahoo! Pager"="F:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2006-11-30 20:49]
"MsnMsgr"="F:\Program Files\MSN Messenger\MsnMsgr.exe" [2006-01-24 10:37]
"Skype"="F:\Program Files\Skype\Phone\Skype.exe" [2006-10-13 16:20]
"TuneUp MemOptimizer"="F:\Program Files\TuneUp Utilities 2006\MemOptimizer.exe" [2005-09-21 22:34]
"LogitechSoftwareUpdate"="F:\Program Files\Logitech\Video\ManifestEngine.exe" [2005-06-08 14:44]
"SUPERAntiSpyware"="F:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-05-23 10:12]

[HKEY_USERS\.default\software\microsoft\windows\currentversion\runonce]
"^SetupICWDesktop"=F:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop
"tscuninstall"=%systemroot%\system32\tscupgrd.exe

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
F:\Documents and Settings\Rody\Desktop\photoshop\couple final formal.jpg

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"="F:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 13:55]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
F:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
SecurityProviders msapsspc.dll, schannel.dll, msnsspc.dll, digest.dll

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"ctfmon.exe"=F:\WINNT\system32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"QuickTime Task"="F:\Program Files\QuickTime\qttask.exe" -atboottime
"Anvshell"=anvshell.exe
"DownloadAccelerator"=F:\PROGRA~1\DAP\DAP.EXE /STARTUP
"InCD"=F:\Program Files\Ahead\InCD\InCD.exe
"LiveNote"=livenote.exe
"LogitechVideoRepair"=F:\Program Files\Logitech\Video\ISStart.exe
"IMJPMIG8.1"="F:\WINNT\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
"NvMediaCenter"=RUNDLL32.EXE F:\WINNT\system32\NvMcTray.dll,NvTaskbarInit
"nwiz"=nwiz.exe /install
"RemoteControl"="F:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe"
"LogitechVideoTray"=F:\Program Files\Logitech\Video\LogiTray.exe
"NeroFilterCheck"=F:\WINNT\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs BthServ


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{ac269cb4-d83f-11db-ad4d-00095bd10204}]
AutoRun\command- F:\WINNT\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Boot.exe e
Open\command- Boot.exe e
 

Contents of the 'Scheduled Tasks' folder
2007-05-11 07:16:34  F:\WINNT\tasks\1-Click Maintenance.job

********************************************************************

catchme 0.3.681 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-05-27 16:42:07
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0


********************************************************************

[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\BTHPORT\Parameters\Services\{00001000-0000-1000-8000-00805f9b34fb}]


[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\BTHPORT\Parameters\Services\{00001105-0000-1000-8000-00805f9b34fb}]


[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\BTHPORT\Parameters\Services\{00001115-0000-1000-8000-00805f9b34fb}]


Completion time: 2007-05-27 16:43:02
F:\ComboFix-quarantined-files.txt ... 2007-05-27 16:42
F:\ComboFix2.txt ... 2007-05-27 15:42

 --- E O F ---
Logged

Offline harkoliar

  • Newbie
  • *
  • Posts: 5
  • Karma: +0/-0
    • View Profile
Help spyware trying to sneak in
« Reply #5 on: May 28, 2007, 05:09:46 AM »
combofix quaranteened

Code: [Select]
2007-05-27 08:46  698 --a------ F:\Qoobox\Quarantine\Registry_backups\hklm_windowsNT_windows.reg.cf
2007-05-27 08:47  6144 --a------ F:\Qoobox\Quarantine\F\WINNT\system32\perfc000.dat.vir


Folder PATH listing
Volume serial number is 344F-9A2E
F:\QOOBOX
\---Quarantine
+---F
|   \---WINNT
|   \---system32
|   perfc000.dat.vir
|  
\---Registry_backups
hklm_windowsNT_windows.reg.cf
Logged

Offline harkoliar

  • Newbie
  • *
  • Posts: 5
  • Karma: +0/-0
    • View Profile
Help spyware trying to sneak in
« Reply #6 on: May 28, 2007, 05:18:58 AM »
[quote name=\'harkoliar\' post=\'332055\' date=\'May 28 2007, 08:09 PM\']combofix quaranteened

Code: [Select]
2007-05-27 08:46  698 --a------ F:\Qoobox\Quarantine\Registry_backups\hklm_windowsNT_windows.reg.cf
2007-05-27 08:47  6144 --a------ F:\Qoobox\Quarantine\F\WINNT\system32\perfc000.dat.vir


Folder PATH listing
Volume serial number is 344F-9A2E
F:\QOOBOX
\---Quarantine
+---F
|   \---WINNT
|   \---system32
|   perfc000.dat.vir
|  
\---Registry_backups
hklm_windowsNT_windows.reg.cf[/quote]


oh yes, i would really like to thank you for giving your time scanning thru this logs. I know its time consuming. Also, just letting you know that its wierd but the virus is not popping up anymore. I dont know what happened though. I didnt do anything in my system except running those programs you mentioned.
Logged

Offline guestolo

  • Site Donator
  • Administrator
  • Hero Member
  • *****
  • Posts: 16034
  • Karma: +1/-0
    • View Profile
    • http://
Help spyware trying to sneak in
« Reply #7 on: May 31, 2007, 10:00:25 PM »
Very sorry for not getting back to you sooner
Quote
its wierd but the virus is not popping up anymore. I dont know what happened though. I didnt do anything in my system except running those programs you mentioned.

Combofix took care of a registry setting and a file causing troubles
Noted by the combofix quarantine log

Are you still running ok?
Logged

Do you want to post your own logs from FRST?

Follow the instructions posted http://www.thetechguide.com/forum/index.php/topic/22942-please-read-how-to-post-logs-from-frst/\'>Click Here

Pages: [1]
« previous next »