Logs after guide! Check please

Status
Not open for further replies.
N

nothingasis

In Runtime
Messages
198
Location
CA
SmitFraudFix v2.381

Scan done at 19:19:47.15, Fri 12/05/2008
Run from H:\Virus\SmitfraudFix
OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
The filesystem type is NTFS
Fix run in safe mode

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{C5BF49A2-94F3-42BD-F434-3604812C897D}"="mcb7uehuj3n8weuhejsw"

[HKEY_CLASSES_ROOT\CLSID\{C5BF49A2-94F3-42BD-F434-3604812C897D}\InProcServer32]
@="C:\WINDOWS\system32\jsne87fidgf.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{C5BF49A2-94F3-42BD-F434-3604812C897D}\InProcServer32]
@="C:\WINDOWS\system32\jsne87fidgf.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{C5AF42A3-94F3-42BD-F434-3604832C897D}"="lke3iemrl490kgfgdsfd"

[HKEY_CLASSES_ROOT\CLSID\{C5AF42A3-94F3-42BD-F434-3604832C897D}\InProcServer32]
@="C:\WINDOWS\system32\hsef73uhef.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{C5AF42A3-94F3-42BD-F434-3604832C897D}\InProcServer32]
@="C:\WINDOWS\system32\hsef73uhef.dll"


»»»»»»»»»»»»»»»»»»»»»»»» Killing process


»»»»»»»»»»»»»»»»»»»»»»»» hosts



»»»»»»»»»»»»»»»»»»»»»»»» VACFix

VACFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

S!Ri's WS2Fix: LSP not Found.


»»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

GenericRenosFix by S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

C:\WINDOWS\system32\msansspc.dll Deleted
C:\Documents and Settings\Owner\Application Data\Install.dat Deleted

»»»»»»»»»»»»»»»»»»»»»»»» IEDFix

IEDFix
Credits: Malware Analysis & Diagnostic
Code: S!Ri



»»»»»»»»»»»»»»»»»»»»»»»» 404Fix

404Fix
Credits: Malware Analysis & Diagnostic
Code: S!Ri


»»»»»»»»»»»»»»»»»»»»»»»» RK


»»»»»»»»»»»»»»»»»»»»»»»» DNS



»»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


»»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
!!!Attention, following keys are not inevitably infected!!!

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
"System"=""


»»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

Registry Cleaning done.

»»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
!!!Attention, following keys are not inevitably infected!!!

SrchSTS.exe by S!Ri
Search SharedTaskScheduler's .dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{C5BF49A2-94F3-42BD-F434-3604812C897D}"="mcb7uehuj3n8weuhejsw"

[HKEY_CLASSES_ROOT\CLSID\{C5BF49A2-94F3-42BD-F434-3604812C897D}\InProcServer32]
@="C:\WINDOWS\system32\jsne87fidgf.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{C5BF49A2-94F3-42BD-F434-3604812C897D}\InProcServer32]
@="C:\WINDOWS\system32\jsne87fidgf.dll"


[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\SharedTaskScheduler]
"{C5AF42A3-94F3-42BD-F434-3604832C897D}"="lke3iemrl490kgfgdsfd"

[HKEY_CLASSES_ROOT\CLSID\{C5AF42A3-94F3-42BD-F434-3604832C897D}\InProcServer32]
@="C:\WINDOWS\system32\hsef73uhef.dll"

[HKEY_LOCAL_MACHINE\Software\Classes\CLSID\{C5AF42A3-94F3-42BD-F434-3604832C897D}\InProcServer32]
@="C:\WINDOWS\system32\hsef73uhef.dll"



»»»»»»»»»»»»»»»»»»»»»»»» End



















ComboFix 08-12-05.02 - Owner 2008-12-06 1:32:16.1 - NTFSx86
Running from: h:\virus\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

c:\documents and settings\Owner\Application Data\ASKS~1
c:\documents and settings\Owner\Application Data\CROSOF~1.NET
c:\documents and settings\Owner\Application Data\DOBE~1
c:\documents and settings\Owner\Application Data\ECURIT~1
c:\documents and settings\Owner\Application Data\MBOLS~1
c:\documents and settings\Owner\Application Data\PPATCH~1
c:\documents and settings\Owner\Application Data\PPPATC~1
c:\documents and settings\Owner\Application Data\SEMBLY~1
c:\documents and settings\Owner\Application Data\SMANTE~1
c:\documents and settings\Owner\Application Data\SSTEM~1
c:\documents and settings\Owner\Application Data\STEM~1
c:\documents and settings\Owner\Application Data\STEM32~1
c:\documents and settings\Owner\Application Data\WNSXS~1
c:\documents and settings\Owner\Application Data\YMBOLS~1
c:\documents and settings\Owner\Application Data\YSTEM~1
C:\lswmv.ini
c:\program files\Common Files\asks~1
c:\program files\Common Files\fnts~1
c:\program files\Common Files\icroso~1
c:\program files\Common Files\mbols~1
c:\program files\Common Files\ppatch~1
c:\program files\Common Files\sembly~1
c:\program files\Common Files\smbols~1
c:\program files\Common Files\uninstall information
c:\program files\Common Files\wnsxs~1
c:\program files\Common Files\ymante~1
c:\program files\Common Files\ystem~1
c:\program files\crosof~1.net
c:\program files\curity~1
c:\program files\fnts~1
c:\program files\fnts~2
c:\program files\icroso~1
c:\program files\ppatch~1
c:\program files\ppatch~2
c:\program files\sks~1
c:\program files\sstem~1
c:\program files\sstem3~1
c:\program files\stem32~1
c:\program files\wnsxs~1
c:\program files\ystem3~1
c:\windows\appatc~1
c:\windows\crosof~1
c:\windows\crosof~1.net
c:\windows\curity~1
c:\windows\fnts~1
c:\windows\fnts~2
c:\windows\icroso~1.net
c:\windows\racle~1
c:\windows\smante~1
c:\windows\sstem3~1
c:\windows\system\oeminfo.ini
c:\windows\system32\bqrhge.dll
c:\windows\system32\curity~1
c:\windows\system32\doaaycnm.ini
c:\windows\system32\dobe~1
c:\windows\system32\drivers\ati2joxx.sys
c:\windows\system32\ebicglje.ini
c:\windows\system32\fnts~1
c:\windows\system32\fnts~2
c:\windows\system32\gqrwardo.ini
c:\windows\system32\mbols~1
c:\windows\system32\mcroso~1
c:\windows\system32\mcroso~1.net
c:\windows\system32\pjcuix.dll
c:\windows\system32\ppatch~1
c:\windows\system32\ppatch~2
c:\windows\system32\pppatc~1
c:\windows\system32\pppatc~1\?ppPatch\
c:\windows\system32\pppatc~1\?racle\
c:\windows\system32\pppatc~2
c:\windows\system32\qkitixgr.dll
c:\windows\system32\racle~1
c:\windows\system32\smbols~1
c:\windows\system32\sstem~1
c:\windows\system32\stem~1
c:\windows\system32\vckhnbkr.dll
c:\windows\system32\wnsxs~1
c:\windows\system32\wtsisvit32.exe
c:\windows\system32\wtsit.exe
c:\windows\system32\ymante~1
c:\windows\system32\ystem3~1
c:\windows\tsks~1
c:\windows\wiaserviv.log
c:\windows\wnsxs~1
c:\windows\ymante~1
c:\windows\ystem3~1

.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.

-------\Legacy_ati2joxx
-------\Legacy_FCI
-------\Legacy_icf
-------\Legacy_MOTO
-------\Legacy_SVCPROC
-------\Service_ati2joxx
-------\Service_moto


((((((((((((((((((((((((( Files Created from 2008-11-06 to 2008-12-06 )))))))))))))))))))))))))))))))
.

2008-12-06 01:29 . 2008-12-06 01:30 <DIR> d-------- C:\32788R22FWJFW
2008-12-05 20:27 . 2008-12-05 20:27 <DIR> d-------- c:\documents and settings\Owner\Application Data\Malwarebytes
2008-12-05 20:25 . 2008-12-05 20:27 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-05 20:25 . 2008-12-05 20:25 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-12-05 20:25 . 2008-12-03 19:52 38,496 --a------ c:\windows\SYSTEM32\drivers\mbamswissarmy.sys
2008-12-05 20:25 . 2008-12-03 19:52 15,504 --a------ c:\windows\SYSTEM32\drivers\mbam.sys
2008-12-05 19:49 . 2008-12-05 19:49 <DIR> d-------- C:\VundoFix Backups
2008-12-05 19:22 . 2008-12-05 19:22 1,334 --a------ c:\windows\SYSTEM32\tmp.reg
2008-12-05 19:01 . 2008-12-05 19:01 <DIR> d-------- c:\program files\CCleaner
2008-12-05 18:52 . 2008-12-05 18:53 <DIR> d-------- c:\program files\CleanUp!
2008-12-05 18:45 . 2008-12-05 18:45 <DIR> d-------- c:\program files\MSConfig CleanUp
2008-12-04 20:02 . 2008-12-04 20:02 <DIR> d-------- c:\program files\Trend Micro
2008-12-04 19:21 . 2008-12-04 19:21 54,156 --ah----- c:\windows\QTFont.qfn
2008-12-04 19:21 . 2008-12-04 19:21 1,409 --a------ c:\windows\QTFont.for
2008-12-04 19:10 . 2004-08-03 22:58 14,848 --a------ c:\windows\SYSTEM32\drivers\kbdhid.sys
2008-12-04 19:10 . 2004-08-03 22:58 14,848 --a------ c:\windows\SYSTEM32\dllcache\kbdhid.sys
2008-11-27 12:29 . 2008-11-27 12:29 52,736 --a------ C:\ldpmwlum.exe
2008-11-27 12:28 . 2008-11-27 12:28 52,224 --a------ c:\windows\SYSTEM32\vivvhkuw.dll
2008-11-27 12:28 . 2008-11-27 12:28 9,728 --a------ c:\windows\instsp0.exe
2008-11-23 11:41 . 2008-11-24 17:47 <DIR> d-------- c:\windows\SYSTEM32\config\systemprofile\Application Data\gadcom

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-12-06 02:49 --------- d-----w c:\program files\Google
2008-12-06 02:37 --------- d-----w c:\program files\Viewpoint
2008-12-06 02:37 --------- d-----w c:\documents and settings\All Users\Application Data\Viewpoint
2008-12-06 02:36 --------- d-----w c:\program files\InterActual
2008-12-06 02:32 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-12-05 03:59 --------- d-----w c:\program files\Common Files\AOL
2008-12-05 03:59 --------- d-----w c:\documents and settings\All Users\Application Data\AOL
2008-12-05 03:22 --------- d-----w c:\program files\Yahoo!
2008-12-03 17:56 --------- d-----w c:\documents and settings\Owner\Application Data\U3
2008-10-24 20:55 1,024 -c--a-w c:\documents and settings\Owner\UserInfo.dat
2008-10-21 20:59 --------- d-----w c:\documents and settings\Owner\Application Data\Image Zone Express
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-03 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"ALUAlert"="c:\program files\Symantec\LiveUpdate\ALUNotify.exe" [2003-08-13 54472]

c:\documents and settings\Default User\Start Menu\Programs\Startup\
AutoPlay.exe [2001-09-17 36864]

c:\documents and settings\Administrator\Start Menu\Programs\Startup\
AutoPlay.exe [2001-09-17 36864]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=bbllvf.dll rmazcv.dll uphota.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.DVSD"= miroDV2avi.DLL
"VIDC.PIM1"= pclepim1.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
--a--c--- 2004-08-03 23:56 15360 c:\windows\SYSTEM32\ctfmon.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
--------- 2001-08-08 00:25 143360 c:\windows\SYSTEM32\igfxtray.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"gusvc"=3 (0x3)
"Viewpoint Manager Service"=2 (0x2)

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\hp center\\137903\\Program\\BackWeb-137903.exe"=
"c:\\Program Files\\Messenger\\msmsgs.exe"=
"c:\\WINDOWS\\system32"=
"c:\\Program Files\\Real\\RealPlayer\\realplay.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Program Files\\LimeWire\\LimeWire.exe"=


[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Contents of the 'Scheduled Tasks' folder

2008-12-06 c:\windows\Tasks\RUTASK.job
- c:\windows\ru.exe []

2008-12-06 c:\windows\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2003-08-13 17:38]
.
- - - - ORPHANS REMOVED - - - -

SSODL-SpySheriff-{E3BCFF6C-8DF5-07A9-7D77-AA48481A763A} - (no file)


.
------- Supplementary Scan -------
.
uInternet Connection Wizard,ShellNext = iexplore
uInternet Settings,ProxyOverride = localhost

O16 -: Microsoft XML Parser for Java - file://c:\windows\Java\classes\xmldso.cab
c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-06 01:39:26
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(544)
c:\windows\System32\NavLogon.dll
.
------------------------ Other Running Processes ------------------------
.
c:\windows\SYSTEM32\nvsvc32.exe
.
**************************************************************************
.
Completion time: 2008-12-06 1:56:23 - machine was rebooted
ComboFix-quarantined-files.txt 2008-12-06 09:56:13

Pre-Run: 31,543,517,184 bytes free
Post-Run: 31,464,460,288 bytes free

220 --- E O F --- 2008-10-30 07:18:00















Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:47:06, on 12/6/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\ctfmon.exe
C:\WINDOWS\explorer.exe
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe /boot
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\RunOnce: [Trojan Remover] "C:\Program Files\Trojan Remover\RMVTRJAN.EXE" /restart
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'Default user')
O4 - S-1-5-18 Startup: AutoPlay.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: AutoPlay.exe (User 'Default user')
O4 - .DEFAULT User Startup: AutoPlay.exe (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe (file missing)
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1166866379875
O16 - DPF: {6F750203-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://targetphoto.kodakgallery.com/downloads/BUM/BUM_WIN_IE_2/axofupld.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

--
End of file - 4423 bytes
 
100% better

Remove these entries

O4 - S-1-5-18 Startup: AutoPlay.exe (User 'SYSTEM')

O4 - .DEFAULT Startup: AutoPlay.exe (User 'Default user')

O4 - .DEFAULT User Startup: AutoPlay.exe (User 'Default user')

O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\Program Files\AIM95\aim.exe (file missing)

post a new log

Do you see any difference?
 
Thanks a whole bunch! here is an updated hjt














Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:20:24, on 12/6/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16735)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\PROGRA~1\AVG\AVG8\avgrsx.exe
C:\PROGRA~1\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\PROGRA~1\AVG\AVG8\avgtray.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wuauclt.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = localhost
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O4 - HKLM\..\Run: [TrojanScanner] C:\Program Files\Trojan Remover\Trjscan.exe /boot
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'Default user')
O4 - S-1-5-18 Startup: AutoPlay.exe (User 'SYSTEM')
O4 - .DEFAULT Startup: AutoPlay.exe (User 'Default user')
O4 - .DEFAULT User Startup: AutoPlay.exe (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://photos.walmart.com/WalmartActivia.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1166866379875
O16 - DPF: {6F750203-1362-4815-A476-88533DE61D0C} (Kodak Gallery Easy Upload Manager Class) - http://targetphoto.kodakgallery.com/downloads/BUM/BUM_WIN_IE_2/axofupld.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O23 - Service: AVG Free8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgemc.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: NVIDIA Driver Helper Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

--
End of file - 4241 bytes
 
Status
Not open for further replies.

Similar threads

XWrench3
hijack this scan
Replies
6
Views
2K
XWrench3
XWrench3
G
Computer slow and work in background
Replies
0
Views
2K
grecycle99
G
N
Laptop slowing down in function (internet and general apps)
Replies
1
Views
3K
Trotter
Trotter
M
computer suddenly slowed down.
Replies
0
Views
3K
mike3dp
M
J
Freezing up
Replies
5
Views
3K
jetsmell
J
Back
Top Bottom