trojans + desktop problems :( ... i need some help please!

Comments

• Shaba

  May 2006 edited May 2006

  Hi lcmatt
  
  Let's start with this:
  
  Follow these instructions to remove Vundo ->
  http://www.short-media.com/forum/showthread.php?t=39544
  
  Uninstall via add/remove program (control panel):
  
  AltnetPointsManager
  (Kazaa) <--- optional, but I highly recommend you to uninstall it
  Media Access
  SpyKiller
  
  Fix with HjT (open HijackThis, click do a system scan only, checkmark these and press fix checked):
  
  R3 - URLSearchHook: (no name) - {00D6A7E7-4A97-456f-848A-3B75BF7554D7} - (no file)
  O2 - BHO: (no name) - {0494D0D1-F8E0-41ad-92A3-14154ECE70AC} - (no file)
  O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
  O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
  O3 - Toolbar: (no name) - {0494D0D9-F8E0-41ad-92A3-14154ECE70AC} - (no file)
  O4 - HKLM\..\Run: [AltnetPointsManager] c:\program files\altnet\points manager\points manager.exe -s
  O4 - HKLM\..\Run: [Media Access] C:\Program Files\Media Access\MediaAccK.exe
  O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
  O4 - HKCU\..\Run: [SpyKiller] C:\Program Files\SpyKiller\spykiller.exe /startup
  O16 - DPF: {15AD6789-CDB4-47E1-A9DA-992EE8E6BAD6} - http://static.windupdates.com/cab/CDT/ie/bridge-c18.cab
  O16 - DPF: {1D6711C8-7154-40BB-8380-3DEA45B69CBF} -
  O20 - AppInit_DLLs: pushow72.dll
  
  Please download ATF Cleaner by Atribune and save
  it to desktop. Don't use it yet.
  
  Please download ewido anti malware it is a free version of the program -> http://www.ewido.net/en/download/
  
  1. Install ewido security suite
  2. When installing, under "Additional Options" uncheck..
  * Install background guard
  * Install scan via context menu
  3. Launch ewido, there should be an icon on your desktop, double-click it.
  4. The program will now open to the main screen.
  5. When you run ewido for the first time, you may get a warning "Database could not be found!". Click OK. We will fix this in a moment.
  6. You will need to update ewido to the latest definition files.
  * On the left hand side of the main screen click update.
  * Then click on Start Update.
  7. The update will start and a progress bar will show the updates being installed.
  (the status bar at the bottom will display ("Update successful")
  
  If you are having problems with the updater, you can use this link to manually update ewido.
  ewido manual updates -> http://www.ewido.net/en/download/updates/
  
  Once the updates are installed do the following:
  
  Reboot your computer in SafeMode by doing the following:
  
  1. Restart your computer
  2. After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
  3. Instead of Windows loading as normal, a menu should appear
  4. Select the first option, to run Windows in Safe Mode.
  
  Delete these, if found:
  
  c:\program files\altnet
  C:\Program Files\Media Access
  C:\Program Files\Kazaa <---- optional
  C:\Program Files\SpyKiller
  C:\Documents and Settings\Family\Desktop\released
  freshazimiz.zip
  pushow72.dll (search with Find-function)
  
  Double-click ATF-Cleaner.exe to run the program.
  Under Main choose: Select All
  Click the Empty Selected button.
  
  If you use Firefox browser
  
  Click Firefox at the top and choose: Select All
  Click the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click No at the prompt.
  
  If you use Opera browser
  
  Click Opera at the top and choose: Select All
  Click the Empty Selected button.
  NOTE: If you would like to keep your saved passwords, please click No at the prompt.
  
  Click Exit to close ATF-Cleaner.
  
  Then launch ewido:
  
  * Click on scanner
  * Click on Complete System Scan and the scan will begin.
  * You will be prompted to clean the first infection.
  * Select "Perform action on all infections", then proceed.
  * Once the scan has completed, there will be a button located on the bottom of the screen named Save report
  * Click Save report.
  * Save the report .txt file to your desktop or a location where you can find it easily.
  
  Close ewido security suite.
  
  Reboot back to normal mode
  
  Send a fresh HjT log, ewido report and contents of C:\vundofix.txt

  0
• lcmatt

  May 2006 edited May 2006

  well, my desktop icons and bar has reappeared thanks.
  and here are my logs....
  
  
  Logfile of HijackThis v1.99.1
  Scan saved at 4:37:36 AM, on 5/11/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  C:\Program Files\ewido anti-malware\ewidoctrl.exe
  C:\Program Files\ewido anti-malware\ewidoguard.exe
  C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
  C:\Program Files\Norton AntiVirus\navapsvc.exe
  C:\Program Files\Norton Internet Security\NISUM.EXE
  C:\Program Files\Common Files\Symantec Shared\ccApp.exe
  C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
  C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
  C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
  C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
  C:\WINDOWS\System32\igfxtray.exe
  C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Norton Internet Security\ccPxySvc.exe
  C:\WINDOWS\System32\hkcmd.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
  C:\Program Files\Symantec\LiveUpdate\ALUNOTIFY.EXE
  C:\Program Files\MSN Messenger\MsnMsgr.Exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\WINDOWS\system32\wscntfy.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\WINDOWS\system32\DllHost.exe
  C:\Program Files\Messenger\msmsgs.exe
  C:\Program Files\Hijackthis\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
  R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
  O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: (no name) - {54e35660-1570-4068-89c0-5271d4548791} - C:\WINDOWS\system32\trcbvedn.dll
  O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
  O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
  O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
  O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
  O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
  O4 - HKLM\..\Run: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -minimize
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_05\bin\jusched.exe
  O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
  O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
  O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
  O4 - HKLM\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNOTIFY.EXE
  O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
  O4 - HKLM\..\Run: [Trickler] "c:\documents and settings\sue mattingly\local settings\temp\fsg_4203.exe"
  O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [BestPopUpKiller] C:\Program Files\BestPopUpKiller\BestPopupKiller.exe /startup
  O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
  O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
  O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
  O4 - Startup: PowerReg Scheduler.exe
  O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
  O8 - Extra context menu item: &AOL Toolbar Search - res://c:\program files\aol\aol toolbar 2.0\aoltbhtml.dll/search.html
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
  O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
  O9 - Extra button: ICQ 4.0 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
  O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
  O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab28578.cab
  O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
  O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
  O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab28578.cab
  O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
  O17 - HKLM\System\CCS\Services\Tcpip\..\{92766D97-A28C-4A95-BB45-439A1AFA9E0F}: NameServer = 166.102.165.13 166.102.165.11
  O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
  O23 - Service: Symantec Proxy Service (ccPxySvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPxySvc.exe
  O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
  O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
  O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
  O23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISUM.EXE
  O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  
  
  

  ---

  ewido anti-malware - Scan report

  ---

  
  + Created on: 4:28:47 AM, 5/11/2006
  + Report-Checksum: EBCC1E83
  
  + Scan result:
  
  HKLM\SOFTWARE\Altnet -> Adware.Altnet : Cleaned with backup
  HKLM\SOFTWARE\Classes\MediaAccX.Installer -> Adware.WinAd : Cleaned with backup
  HKLM\SOFTWARE\Classes\MediaAccX.Installer\CLSID -> Adware.WinAd : Cleaned with backup
  HKLM\SOFTWARE\Classes\TopSearch.TSLink -> Adware.Altnet : Cleaned with backup
  HKLM\SOFTWARE\Classes\TopSearch.TSLink\CLSID -> Adware.Altnet : Cleaned with backup
  HKLM\SOFTWARE\Classes\TopSearch.TSLink\CurVer -> Adware.Altnet : Cleaned with backup
  HKLM\SOFTWARE\Classes\TopSearch.TSLink.1 -> Adware.Altnet : Cleaned with backup
  HKLM\SOFTWARE\Gator.com -> Adware.Gator : Cleaned with backup
  HKLM\SOFTWARE\Gator.com\Gator -> Adware.Gator : Cleaned with backup
  HKLM\SOFTWARE\Gator.com\Gator\dyn -> Adware.Gator : Cleaned with backup
  HKLM\SOFTWARE\Gator.com\Gator\dyn\GCH -> Adware.Gator : Cleaned with backup
  HKLM\SOFTWARE\Gator.com\Gator\dyn\GCH\_gi -> Adware.Gator : Cleaned with backup
  HKLM\SOFTWARE\Gator.com\Gator\stat -> Adware.Gator : Cleaned with backup
  HKLM\SOFTWARE\Gator.com\GInternet -> Adware.Gator : Cleaned with backup
  HKLM\SOFTWARE\Gator.com\GInternet\Proxy -> Adware.Gator : Cleaned with backup
  HKLM\SOFTWARE\Gator.com\Trickler -> Adware.Gator : Cleaned with backup
  HKLM\SOFTWARE\Gator.com\Trickler\Files -> Adware.Gator : Cleaned with backup
  HKLM\SOFTWARE\Gator.com\Trickler\Files\Bundle -> Adware.Gator : Cleaned with backup
  HKLM\SOFTWARE\Gator.com\Trickler\Files\Bundle\chk -> Adware.Gator : Cleaned with backup
  HKLM\SOFTWARE\Gator.com\Trickler\Files\Bundle\dl -> Adware.Gator : Cleaned with backup
  HKLM\SOFTWARE\Gator.com\Trickler\Files\OemResDll -> Adware.Gator : Cleaned with backup
  HKLM\SOFTWARE\Gator.com\Trickler\Files\OemResDll\chk -> Adware.Gator : Cleaned with backup
  HKLM\SOFTWARE\Gator.com\Trickler\Files\OemResDll\dl -> Adware.Gator : Cleaned with backup
  HKLM\SOFTWARE\Gator.com\Trickler\Files\SilentSetup -> Adware.Gator : Cleaned with backup
  HKLM\SOFTWARE\Gator.com\Trickler\Files\SilentSetup\chk -> Adware.Gator : Cleaned with backup
  HKLM\SOFTWARE\Gator.com\Trickler\Files\SilentSetup\dl -> Adware.Gator : Cleaned with backup
  HKLM\SOFTWARE\PerfectNav -> Adware.KeenValue : Cleaned with backup
  HKLM\SOFTWARE\PerfectNav\BHO -> Adware.KeenValue : Cleaned with backup
  HKLM\SOFTWARE\PerfectNav\BHO\HomePage -> Adware.KeenValue : Cleaned with backup
  HKLM\SOFTWARE\PerfectNav\BHO\RedirectURLS -> Adware.KeenValue : Cleaned with backup
  HKU\S-1-5-21-1085031214-1958367476-682003330-1004\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6DD0BC06-4719-4BA3-BEBC-FBAE6A448152} -> Adware.Virtumonde : Cleaned with backup
  :mozilla.6:C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\olnsmpb8.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
  :mozilla.7:C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\olnsmpb8.default\cookies.txt -> TrackingCookie.Statcounter : Cleaned with backup
  :mozilla.12:C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\olnsmpb8.default\cookies.txt -> TrackingCookie.Atdmt : Cleaned with backup
  :mozilla.17:C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\olnsmpb8.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
  :mozilla.18:C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\olnsmpb8.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
  :mozilla.21:C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\olnsmpb8.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
  :mozilla.22:C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\olnsmpb8.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
  :mozilla.23:C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\olnsmpb8.default\cookies.txt -> TrackingCookie.Advertising : Cleaned with backup
  :mozilla.24:C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\olnsmpb8.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
  :mozilla.25:C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\olnsmpb8.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
  :mozilla.26:C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\olnsmpb8.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
  :mozilla.29:C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\olnsmpb8.default\cookies.txt -> TrackingCookie.Doubleclick : Cleaned with backup
  :mozilla.34:C:\Documents and Settings\Family\Application Data\Mozilla\Firefox\Profiles\olnsmpb8.default\cookies.txt -> TrackingCookie.Hitbox : Cleaned with backup
  C:\Documents and Settings\Family\Cookies\family@aavalue[1].txt -> TrackingCookie.Aavalue : Cleaned with backup
  C:\Documents and Settings\Family\Cookies\family@ad.yieldmanager[2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup
  C:\Documents and Settings\Family\Cookies\family@cornerstone.122.2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup
  C:\Documents and Settings\Family\Cookies\family@cpvfeed[2].txt -> TrackingCookie.Cpvfeed : Cleaned with backup
  C:\Documents and Settings\Family\Cookies\family@h.starware[2].txt -> TrackingCookie.Starware : Cleaned with backup
  C:\Documents and Settings\Family\Cookies\family@lovefreegames.aavalue[1].txt -> TrackingCookie.Aavalue : Cleaned with backup
  C:\Documents and Settings\Family\Cookies\family@revenue[1].txt -> TrackingCookie.Revenue : Cleaned with backup
  C:\Documents and Settings\Family\Cookies\family@stats1.reliablestats[1].txt -> TrackingCookie.Reliablestats : Cleaned with backup
  C:\Documents and Settings\Family\Cookies\family@www.myaffiliateprogram[2].txt -> TrackingCookie.Myaffiliateprogram : Cleaned with backup
  C:\Documents and Settings\Family\Local Settings\Temporary Internet Files\Content.IE5\7T6FNHIS\WinFixer2006FreeInstall[1].exe -> Not-A-Virus.Downloader.Win32.WinFixer.b : Cleaned with backup
  C:\Documents and Settings\Sue Mattingly\Desktop\setup.exe -> Hijacker.Agent.hi : Cleaned with backup
  C:\Documents and Settings\Sue Mattingly\My Documents\Downloads\by MoshAsh..cracking the ap calculus test 07.zip/setup.exe -> Hijacker.Agent.hi : Cleaned with backup
  C:\WINDOWS\system32\pushow13.dll -> Adware.AdvertMen : Cleaned with backup
  C:\WINDOWS\system32\pushow25.dll -> Adware.AdvertMen : Cleaned with backup
  
  
  ::Report End
  
  
  
  
  VundoFix V4.2.74
  
  Checking Java version...
  
  Java version is 1.4.2.5
  
  Scan started at 3:03:22 AM 5/11/2006
  
  Listing files found while scanning....
  
  C:\WINDOWS\system32\vtutt.dll
  C:\WINDOWS\system32\ttutv.ini
  C:\WINDOWS\system32\ttutv.bak1
  C:\WINDOWS\system32\ttutv.bak2
  C:\WINDOWS\system32\ttutv.ini2
  C:\WINDOWS\system32\ttutv.tmp
  
  C:\WINDOWS\system32\ttutv.bak1
  C:\WINDOWS\system32\ttutv.bak2
  C:\WINDOWS\system32\ttutv.tmp
  C:\WINDOWS\system32\ttutv.ini
  C:\WINDOWS\system32\ttutv.ini2
  C:\WINDOWS\system32\vtutt.dll
  C:\WINDOWS\system32\ttutv.ini2
  C:\WINDOWS\system32\ttutv.bak2
  C:\WINDOWS\system32\ttutv.tmp
  C:\WINDOWS\system32\ttutv.ini
  C:\WINDOWS\system32\ttutv.ini2
  C:\WINDOWS\system32\vtutt.dll
  Attempting to delete C:\WINDOWS\system32\vtutt.dll
  C:\WINDOWS\system32\vtutt.dll Has been deleted!
  
  Attempting to delete C:\WINDOWS\system32\ttutv.ini
  C:\WINDOWS\system32\ttutv.ini Has been deleted!
  
  Attempting to delete C:\WINDOWS\system32\ttutv.bak1
  C:\WINDOWS\system32\ttutv.bak1 Has been deleted!
  
  Attempting to delete C:\WINDOWS\system32\ttutv.bak2
  C:\WINDOWS\system32\ttutv.bak2 Has been deleted!
  
  Attempting to delete C:\WINDOWS\system32\ttutv.ini2
  C:\WINDOWS\system32\ttutv.ini2 Has been deleted!
  
  Attempting to delete C:\WINDOWS\system32\ttutv.tmp
  C:\WINDOWS\system32\ttutv.tmp Has been deleted!
  
  Performing Repairs to the registry.
  Done!

  0
• Shaba

  May 2006 edited May 2006

  Yes, that's looking much better
  
  Still couple of things to do:
  
  Fix with HjT (open HijackThis, click do a system scan only, checkmark these and press fix checked):
  
  O2 - BHO: (no name) - {54e35660-1570-4068-89c0-5271d4548791} - C:\WINDOWS\system32\trcbvedn.dll
  O4 - HKLM\..\Run: [Trickler] "c:\documents and settings\sue mattingly\local settings\temp\fsg_4203.exe"
  
  Delete these:
  
  C:\WINDOWS\system32\trcbvedn.dll
  C:\documents and settings\sue mattingly\local settings\temp\fsg_4203.exe
  
  Java update:
  
  Click Start -> Control Panel and doubleclick Java-icon (coffee cup).
  Go to "Update" - tab . Update your Java by clicking "Update Now" and then reboot.
  If you are unable to perform an automatic update, please download Java from this address:
  
  
  http://www.java.com/en/download/manual.jsp
  
  
  After reboot, go back to Control Panel and Java.
  In Temporary Internet Files, click Delete Files-button.
  Make sure that all these three options are checkmarked:
  
  
  Downloaded Applets
  Downloaded Applications
  Other Files
  
  
  Click OK in "Delete Temporary Internet Files" window.
  
  After that, you can uninstall older version of Java via Add/remove programs in Control Panel
  
  It should look like this:
  

  Java 2 Runtime Environment, SE v1.4.2_05

  
  Reboot and send a fresh HjT log.

  0
• lcmatt

  May 2006 edited May 2006

  so, i've completed all the steps you listed..
  except in the temp folder, fsg_4203.exe wasn't there..
  and i also have a question..
  when i rebooted in safe mode, i had trouble with the F8 key, so i got into it by running msconfig.exe...... now every time i restart the computer a message box pops up that says :
  
  You have used the System Configuration Utility to make changes to the way Windows starts.
  
  The System Configuration Utility is currently in Diagnostic or Selective Startup mode, causing this message to be displayed and the utility to run everytime Windows starts.
  
  Choose the Normal Startup mode on the General tab to start Windows normally and undo the changes you made using the System Configuration Utility.
  
  with a check box below it with the message :
  Don't show this message or launch the System Configuration Utility when Windows starts.
  
  
  i'm just not sure what i should do about that..
  
  but here's my log
  
  Logfile of HijackThis v1.99.1
  Scan saved at 4:18:42 PM, on 5/11/2006
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  C:\WINDOWS\Explorer.EXE
  C:\Program Files\ewido anti-malware\ewidoctrl.exe
  C:\Program Files\ewido anti-malware\ewidoguard.exe
  C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
  C:\Program Files\Norton AntiVirus\navapsvc.exe
  C:\Program Files\Common Files\Symantec Shared\ccApp.exe
  C:\Program Files\Norton Internet Security\NISUM.EXE
  C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
  C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
  C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
  C:\WINDOWS\System32\igfxtray.exe
  C:\WINDOWS\System32\hkcmd.exe
  C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
  C:\Program Files\Symantec\LiveUpdate\ALUNOTIFY.EXE
  C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  C:\Program Files\MSN Messenger\MsnMsgr.Exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Norton Internet Security\ccPxySvc.exe
  C:\WINDOWS\system32\wscntfy.exe
  C:\WINDOWS\system32\mspaint.exe
  C:\Program Files\Mozilla Firefox\firefox.exe
  C:\WINDOWS\system32\DllHost.exe
  C:\Program Files\Messenger\msmsgs.exe
  C:\Program Files\Hijackthis\HijackThis.exe
  
  R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
  R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com/
  R3 - URLSearchHook: AOLTBSearch Class - {EA756889-2338-43DB-8F07-D1CA6FB9C90D} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
  O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 5.0\Reader\ActiveX\AcroIEHelper.ocx
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
  O2 - BHO: PCTools Site Guard - {5C8B2A36-3DB1-42A4-A3CB-D426709BBFEB} - C:\PROGRA~1\SPYWAR~1\tools\iesdsg.dll
  O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
  O2 - BHO: AOL Toolbar Launcher - {7C554162-8CB7-45A4-B8F4-8EA1C75885F9} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
  O2 - BHO: CNavExtBho Class - {BDF3E430-B101-42AD-A544-FADC6B084872} - C:\Program Files\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
  O3 - Toolbar: AOL Toolbar - {DE9C389F-3316-41A7-809B-AA305ED9D922} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
  O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
  O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
  O4 - HKLM\..\Run: [ccRegVfy] "C:\Program Files\Common Files\Symantec Shared\ccRegVfy.exe"
  O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe
  O4 - HKLM\..\Run: [ICQ Lite] C:\Program Files\ICQLite\ICQLite.exe -minimize
  O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\SoundMAX\SMax4PNP.exe
  O4 - HKLM\..\Run: [SoundMAX] "C:\Program Files\Analog Devices\SoundMAX\Smax4.exe" /tray
  O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\System32\igfxtray.exe
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\System32\hkcmd.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [ViewMgr] C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
  O4 - HKLM\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNOTIFY.EXE
  O4 - HKLM\..\Run: [Symantec NetDriver Monitor] C:\PROGRA~1\SYMNET~1\SNDMon.exe
  O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
  O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
  O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [BestPopUpKiller] C:\Program Files\BestPopUpKiller\BestPopupKiller.exe /startup
  O4 - HKCU\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
  O4 - HKCU\..\Run: [AIM] C:\PROGRA~1\AIM\aim.exe -cnetwait.odl
  O4 - HKCU\..\Run: [googletalk] "C:\Program Files\Google\Google Talk\googletalk.exe" /autostart
  O4 - Startup: PowerReg Scheduler.exe
  O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
  O8 - Extra context menu item: &AOL Toolbar Search - res://c:\program files\aol\aol toolbar 2.0\aoltbhtml.dll/search.html
  O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
  O9 - Extra button: AOL Toolbar - {3369AF0D-62E9-4bda-8103-B4C75499B578} - C:\Program Files\AOL\AOL Toolbar 2.0\aoltb.dll
  O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - %windir%\bdoscandel.exe (file missing)
  O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
  O9 - Extra button: AIM - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\PROGRA~1\AIM\aim.exe
  O9 - Extra button: ICQ 4.0 - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
  O9 - Extra 'Tools' menuitem: ICQ Lite - {B863453A-26C3-4e1f-A54D-A2CD196348E9} - C:\Program Files\ICQLite\ICQLite.exe
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
  O16 - DPF: {00B71CFB-6864-4346-A978-C0A14556272C} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab28578.cab
  O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
  O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab
  O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
  O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
  O16 - DPF: {8E0D4DE5-3180-4024-A327-4DFAD1796A8D} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsClient.cab28578.cab
  O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
  O17 - HKLM\System\CCS\Services\Tcpip\..\{92766D97-A28C-4A95-BB45-439A1AFA9E0F}: NameServer = 166.102.165.13 166.102.165.11
  O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
  O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
  O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
  O23 - Service: Symantec Password Validation Service (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
  O23 - Service: Symantec Proxy Service (ccPxySvc) - Symantec Corporation - C:\Program Files\Norton Internet Security\ccPxySvc.exe
  O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe
  O23 - Service: ewido security suite guard - ewido networks - C:\Program Files\ewido anti-malware\ewidoguard.exe
  O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
  O23 - Service: Norton Internet Security Accounts Manager (NISUM) - Symantec Corporation - C:\Program Files\Norton Internet Security\NISUM.EXE
  O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
  O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
  O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
  
  
  
  thanks again for all your help. i'd be lost by myself

  0
• Shaba

  May 2006 edited May 2006

  That's normal.
  
  It will encounter whenever you have used msconfig.
  
  Just checkmark "Don't show this message" and it won't bother you anymore
  
  Log is clean.

  0