Virtumondo. C -- Help...

Comments

• chiaz

  November 2005 edited November 2005

  Hi teacherlooking, I am reviewing your log now. I will be back shortly so please wait patiently.

  0
• chiaz

  November 2005 edited November 2005

  Since HijackThis does not scan the entire system and only certain areas are scanned to help diagnose the presence of undetected malware in some of the telltale places it hides. It is extremely important that you run a full system scan tool like Ad-aware SE and Spybot S&D. I would like to START with those steps and finish the cleanup of remnants or undetected items with HJT.
  
  Download Ad-aware version SE Personal 1.06 from one of these locations:
  http://www.download.com/3000-2144-10045910.html
  http://www.majorgeeks.com/download506.html
  Install by double-clicking on the downloaded file.
  
  1. Launch Ad-Aware SE and run the WebUpdate feature. (Click on the Globe icon > Click connect > Click OK > Click Finish.)
  2. Set up the Configurations as follows:
  -- Click the Gear wheel at the top of the Ad-Aware window
  -- Click General > Safety & Settings: Check (Green) all three.
  -- Click Tweak > Cleaning Engine > UNcheck "Always try to unload modules before deletion".
  3. Click "Proceed"
  4. Click "Scan Now"
  5. Deselect "Search for negligible risk entries" as negligible risk entries (MRU's) are not considered to be a threat.
  6. Select "Search for low-risk threats"
  7. Run the scanner using the Full Scan (Perform full system scan) mode.
  8. When the scan has completed, select Next.
  9. In the Scanning Results window, select the "Scan Summary" tab.
  10. Check the box next to each "target family" you wish to remove.
  11. Click next > Click OK.
  12. Shutdown/restart
  
  
  Download Spybot S&D 1.4 here:
  http://safer-networking.org/en/news/2005-05-31.html
  or
  http://www.majorgeeks.com/download2471.html
  
  Install by double-clicking on the downloaded file.
  Run Spybot S&D from desktop icon or Start menu.
  Press "Search for updates" button to get list of updates available.
  Press "Download updates" button.
  Close all IE windows and close & restart Spybot S&D.
  Press "Check for problems" button.
  Have SpyBot remove all it marks in RED by pressing "Fix selected problems".
  Close Spybot S&D, reboot your system.
  
  
  
  
  Please download the trial version of Spy Sweeper from Here
  (Spy Sweeper is occasionally useful in removing Vundo infections)
  
  Install it using the Standard Install option. (You will be asked for your e-mail address, it is safe to give it. If you receive alerts from your firewall, allow all activities for Spy Sweeper)
  
  You will be prompted to check for updated definitions, please do so.
  (This may take several minutes)
  
  Click on Options > Sweep Options and check Sweep all Folders on Selected drives. Check Local Disc C. Under What to Sweep, check every box.
  
  Click on Sweep and allow it to fully scan your system.
  
  When the sweep has finished, click Remove. Click Select All and then Next
  
  From 'Results', select the Session Log tab. Click Save to File and save the log somewhere convenient.
  
  Exit Spy Sweeper.
  
  Restart your computer. Please rescan with HijackThis and post the new HijackThis log here, along with the SpySweeper log you have saved.

  0
• teacherlooking

  November 2005 edited November 2005

  Thanks... I'll install and run the software now... and be back shortly.

  0
• teacherlooking

  November 2005 edited November 2005

  Hi...
  
  Below are the log-files for SpySweeper and hijackthis:
  

  ---

  Spysweeper

  ---

  
  ********
  12:53 AM: | Start of Session, Friday, November 18, 2005 |
  12:53 AM: Spy Sweeper started
  12:53 AM: Sweep initiated using definitions version 573
  12:53 AM: Starting Memory Sweep
  12:55 AM: Found Adware: virtumonde
  12:55 AM: Detected running threat: C:\WINDOWS\SYSTEM32\efebc.dll (ID = 77)
  12:58 AM: Memory Sweep Complete, Elapsed Time: 00:04:42
  12:58 AM: Starting Registry Sweep
  12:58 AM: Found Adware: altnet
  12:58 AM: HKCR\clsid\{3f4d4f88-0198-4921-b630-957f3eb814e0}\ (1 subtraces) (ID = 103460)
  12:58 AM: Found Adware: blazefind
  12:58 AM: HKCR\interface\{8c505a6b-124b-4768-8fd3-1a066c839848}\ (8 subtraces) (ID = 104460)
  12:58 AM: HKLM\software\classes\interface\{8c505a6b-124b-4768-8fd3-1a066c839848}\ (8 subtraces) (ID = 104492)
  12:58 AM: Found Adware: blazefind_adman
  12:58 AM: HKLM\software\microsoft\windows\currentversion\moduleusage\c:/windows/downloaded program files/admanctlx.dll\ (2 subtraces) (ID = 104581)
  12:58 AM: HKLM\software\microsoft\windows\currentversion\shareddlls\ || c:\windows\downloaded program files\admanctlx.dll (ID = 104583)
  12:58 AM: Found Adware: blazefind_adstat
  12:58 AM: HKCR\adstatservx.installer\ (3 subtraces) (ID = 104585)
  12:58 AM: HKLM\software\classes\adstatservx.installer\ (3 subtraces) (ID = 104586)
  12:59 AM: Found Adware: searchrelevancy
  12:59 AM: HKCR\interface\{300fa067-9b94-45cf-a30b-cb5221eeb0c3}\ (8 subtraces) (ID = 141290)
  12:59 AM: HKLM\software\classes\interface\{300fa067-9b94-45cf-a30b-cb5221eeb0c3}\ (8 subtraces) (ID = 141293)
  12:59 AM: HKLM\software\classes\typelib\{65a6bb6d-78d0-4e0a-824d-2de1e0d154af}\ (9 subtraces) (ID = 141295)
  12:59 AM: HKLM\software\classes\updater.bho\ (5 subtraces) (ID = 141297)
  12:59 AM: HKCR\typelib\{65a6bb6d-78d0-4e0a-824d-2de1e0d154af}\ (9 subtraces) (ID = 141302)
  12:59 AM: HKCR\updater.bho\ (5 subtraces) (ID = 141303)
  12:59 AM: Found Adware: rx toolbar
  12:59 AM: HKLM\software\rxresults\ (4 subtraces) (ID = 729611)
  12:59 AM: Found Adware: instafinder
  12:59 AM: HKU\S-1-5-21-2106144596-3885586431-2047718683-1007\software\instafink\ (21 subtraces) (ID = 128666)
  12:59 AM: Found Adware: directrevenue-thebestoffersnetwork
  12:59 AM: HKU\S-1-5-21-2106144596-3885586431-2047718683-1007\software\tbon\ (33 subtraces) (ID = 826461)
  12:59 AM: Registry Sweep Complete, Elapsed Time:00:01:11
  12:59 AM: Starting Cookie Sweep
  12:59 AM: Found Spy Cookie: adultfriendfinder cookie
  12:59 AM: [email]think@adultfriendfinder[1].txt[/email] (ID = 2165)
  12:59 AM: Found Spy Cookie: reliablestats cookie
  12:59 AM: [email]think@stats1.reliablestats[2].txt[/email] (ID = 3254)
  12:59 AM: Cookie Sweep Complete, Elapsed Time: 00:00:01
  1:00 AM: Starting File Sweep
  1:23 AM: Found Adware: java byteverify
  1:23 AM: dummy.class-3cf36b1e-420478d6.class (ID = 64821)
  1:23 AM: dummy.class-dbb525f-533605ae.class (ID = 64821)
  1:23 AM: Warning: Invalid file - not a PKZip file
  1:24 AM: Warning: Invalid file - not a PKZip file
  1:24 AM: Warning: Invalid file - not a PKZip file
  1:24 AM: Warning: Invalid file - not a PKZip file
  1:24 AM: Warning: Invalid file - not a PKZip file
  1:24 AM: Warning: Invalid file - not a PKZip file
  1:24 AM: Warning: Invalid file - not a PKZip file
  1:24 AM: Warning: Invalid file - not a PKZip file
  1:24 AM: Warning: Invalid file - not a PKZip file
  1:24 AM: Warning: Invalid file - not a PKZip file
  1:25 AM: File Sweep Complete, Elapsed Time: 00:25:06
  1:25 AM: Full Sweep has completed. Elapsed time 00:31:11
  1:25 AM: Traces Found: 148
  1:26 AM: Removal process initiated
  1:30 AM: Quarantining All Traces: virtumonde
  1:30 AM: virtumonde is in use. It will be removed on reboot.
  1:30 AM: C:\WINDOWS\SYSTEM32\efebc.dll is in use. It will be removed on reboot.
  1:30 AM: Quarantining All Traces: blazefind
  1:30 AM: Quarantining All Traces: altnet
  1:30 AM: Quarantining All Traces: blazefind_adman
  1:30 AM: Quarantining All Traces: blazefind_adstat
  1:30 AM: Quarantining All Traces: directrevenue-thebestoffersnetwork
  1:30 AM: Quarantining All Traces: instafinder
  1:30 AM: Quarantining All Traces: java byteverify
  1:30 AM: Quarantining All Traces: rx toolbar
  1:30 AM: Quarantining All Traces: searchrelevancy
  1:30 AM: Quarantining All Traces: adultfriendfinder cookie
  1:30 AM: Quarantining All Traces: reliablestats cookie
  1:31 AM: Removal process completed. Elapsed time 00:05:09
  ********
  12:51 AM: | Start of Session, Friday, November 18, 2005 |
  12:51 AM: Spy Sweeper started
  12:52 AM: Your spyware definitions have been updated.
  12:53 AM: | End of Session, Friday, November 18, 2005 |
  
  
  

  ---

  hijackthis

  ---

  
  Logfile of HijackThis v1.99.1
  Scan saved at 1:38:25 AM, on 11/18/2005
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\hkcmd.exe
  C:\WINDOWS\BCMSMMSG.exe
  C:\Program Files\Dell\AccessDirect\dadapp.exe
  C:\WINDOWS\System32\DSentry.exe
  C:\WINDOWS\system32\dla\tfswctrl.exe
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
  C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\WINDOWS\vsnpstd2.exe
  C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
  C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\ScreenPrint32 v3\ScreenPrint32.exe
  C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
  C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
  C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
  C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
  C:\Program Files\Dell Support\DSAgnt.exe
  C:\Program Files\Adobe\Acrobat 7.0\Acrobat\acrobat_sl.exe
  C:\Program Files\FinePixViewer\QuickDCF.exe
  C:\Program Files\WinZip\WZQKPICK.EXE
  C:\Program Files\Palm\HOTSYNC.EXE
  C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
  C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
  C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\Program Files\HijackThis\HijackThis.exe
  
  F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe
  O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
  O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
  O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
  O2 - BHO: MSEvents Object - {B313D637-F405-4052-AC37-E2119AB3C8F8} - C:\WINDOWS\system32\efebc.dll (file missing)
  O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
  O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
  O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll
  O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
  O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
  O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [DadApp] C:\Program Files\Dell\AccessDirect\dadapp.exe
  O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
  O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
  O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
  O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [SNPSTD2] C:\WINDOWS\vsnpstd2.exe
  O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
  O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
  O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
  O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
  O4 - HKLM\..\Run: [ScreenPrint32] C:\Program Files\ScreenPrint32 v3\ScreenPrint32.exe -startup
  O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
  O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
  O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
  O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
  O4 - HKCU\..\Run: [tbon] C:\Program Files\TBONBin\tbon.exe /r
  O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
  O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = %SystemRoot%\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe
  O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
  O4 - Global Startup: Exif Launcher.lnk = ?
  O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
  O8 - Extra context menu item: &Search - http://km.bar.need2find.com/KM/menusearch.html?p=KM
  O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
  O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
  O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
  O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
  O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
  O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
  O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
  O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
  O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
  O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
  O16 - DPF: {2C520C08-1ADA-4CEC-AFFD-D0D1BD268D60} (PDUpdate Control) - http://www.pdbox.co.kr/filebox/ctrl_down/PDUpdate.cab
  O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
  O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/autocomplete.cab
  O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326
  O16 - DPF: {ED1EEBEE-F0AA-474B-9829-61C482E72644} (PDBox28 Control) - http://www.pdbox.co.kr/filebox/ctrl_down/PDBox25.cab
  O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
  O20 - Winlogon Notify: efebc - C:\WINDOWS\system32\efebc.dll (file missing)
  O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
  O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
  O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
  
  
  Thanks again

  0
• chiaz

  November 2005 edited November 2005

  You have not ran Ad-aware and Spybot S&D.
  Please follow instructions from my previous reply.

  0
• teacherlooking

  November 2005 edited November 2005

  oh... sorry, I misunderstood... ran Ad-aware, but not Spybot. I will be working for 8-9 hours... so will not be able to do anything until after.
  
  thanks

  0
• teacherlooking

  November 2005 edited November 2005

  ok... I have run both Ad-aware and SpyBot... Below are the new SpySweeper and hijackthis logs... sorry about the confusion earlier
  
  

  ---

  SpySweeper

  ---

  
  ********
  11:01 PM: | Start of Session, Friday, November 18, 2005 |
  11:01 PM: Spy Sweeper started
  11:01 PM: Sweep initiated using definitions version 573
  11:01 PM: Starting Memory Sweep
  11:05 PM: Memory Sweep Complete, Elapsed Time: 00:04:00
  11:05 PM: Starting Registry Sweep
  11:05 PM: Registry Sweep Complete, Elapsed Time:00:00:54
  11:05 PM: Starting Cookie Sweep
  11:06 PM: Found Spy Cookie: belnk cookie
  11:06 PM: [email]think@belnk[1].txt[/email] (ID = 2292)
  11:06 PM: [email]think@dist.belnk[2].txt[/email] (ID = 2293)
  11:06 PM: Found Spy Cookie: nextag cookie
  11:06 PM: [email]think@nextag[1].txt[/email] (ID = 5014)
  11:06 PM: Found Spy Cookie: surveys cookie
  11:06 PM: [email]think@surveys[1].txt[/email] (ID = 3473)
  11:06 PM: Cookie Sweep Complete, Elapsed Time: 00:00:03
  11:06 PM: Starting File Sweep
  11:29 PM: File Sweep Complete, Elapsed Time: 00:23:52
  11:30 PM: Full Sweep has completed. Elapsed time 00:28:59
  11:30 PM: Traces Found: 4
  11:30 PM: Removal process initiated
  11:31 PM: Quarantining All Traces: belnk cookie
  11:31 PM: Quarantining All Traces: nextag cookie
  11:31 PM: Quarantining All Traces: surveys cookie
  11:31 PM: Removal process completed. Elapsed time 00:00:18
  ********
  12:53 AM: | Start of Session, Friday, November 18, 2005 |
  12:53 AM: Spy Sweeper started
  12:53 AM: Sweep initiated using definitions version 573
  12:53 AM: Starting Memory Sweep
  12:55 AM: Found Adware: virtumonde
  12:55 AM: Detected running threat: C:\WINDOWS\SYSTEM32\efebc.dll (ID = 77)
  12:58 AM: Memory Sweep Complete, Elapsed Time: 00:04:42
  12:58 AM: Starting Registry Sweep
  12:58 AM: Found Adware: altnet
  12:58 AM: HKCR\clsid\{3f4d4f88-0198-4921-b630-957f3eb814e0}\ (1 subtraces) (ID = 103460)
  12:58 AM: Found Adware: blazefind
  12:58 AM: HKCR\interface\{8c505a6b-124b-4768-8fd3-1a066c839848}\ (8 subtraces) (ID = 104460)
  12:58 AM: HKLM\software\classes\interface\{8c505a6b-124b-4768-8fd3-1a066c839848}\ (8 subtraces) (ID = 104492)
  12:58 AM: Found Adware: blazefind_adman
  12:58 AM: HKLM\software\microsoft\windows\currentversion\moduleusage\c:/windows/downloaded program files/admanctlx.dll\ (2 subtraces) (ID = 104581)
  12:58 AM: HKLM\software\microsoft\windows\currentversion\shareddlls\ || c:\windows\downloaded program files\admanctlx.dll (ID = 104583)
  12:58 AM: Found Adware: blazefind_adstat
  12:58 AM: HKCR\adstatservx.installer\ (3 subtraces) (ID = 104585)
  12:58 AM: HKLM\software\classes\adstatservx.installer\ (3 subtraces) (ID = 104586)
  12:59 AM: Found Adware: searchrelevancy
  12:59 AM: HKCR\interface\{300fa067-9b94-45cf-a30b-cb5221eeb0c3}\ (8 subtraces) (ID = 141290)
  12:59 AM: HKLM\software\classes\interface\{300fa067-9b94-45cf-a30b-cb5221eeb0c3}\ (8 subtraces) (ID = 141293)
  12:59 AM: HKLM\software\classes\typelib\{65a6bb6d-78d0-4e0a-824d-2de1e0d154af}\ (9 subtraces) (ID = 141295)
  12:59 AM: HKLM\software\classes\updater.bho\ (5 subtraces) (ID = 141297)
  12:59 AM: HKCR\typelib\{65a6bb6d-78d0-4e0a-824d-2de1e0d154af}\ (9 subtraces) (ID = 141302)
  12:59 AM: HKCR\updater.bho\ (5 subtraces) (ID = 141303)
  12:59 AM: Found Adware: rx toolbar
  12:59 AM: HKLM\software\rxresults\ (4 subtraces) (ID = 729611)
  12:59 AM: Found Adware: instafinder
  12:59 AM: HKU\S-1-5-21-2106144596-3885586431-2047718683-1007\software\instafink\ (21 subtraces) (ID = 128666)
  12:59 AM: Found Adware: directrevenue-thebestoffersnetwork
  12:59 AM: HKU\S-1-5-21-2106144596-3885586431-2047718683-1007\software\tbon\ (33 subtraces) (ID = 826461)
  12:59 AM: Registry Sweep Complete, Elapsed Time:00:01:11
  12:59 AM: Starting Cookie Sweep
  12:59 AM: Found Spy Cookie: adultfriendfinder cookie
  12:59 AM: [email]think@adultfriendfinder[1].txt[/email] (ID = 2165)
  12:59 AM: Found Spy Cookie: reliablestats cookie
  12:59 AM: [email]think@stats1.reliablestats[2].txt[/email] (ID = 3254)
  12:59 AM: Cookie Sweep Complete, Elapsed Time: 00:00:01
  1:00 AM: Starting File Sweep
  1:23 AM: Found Adware: java byteverify
  1:23 AM: dummy.class-3cf36b1e-420478d6.class (ID = 64821)
  1:23 AM: dummy.class-dbb525f-533605ae.class (ID = 64821)
  1:23 AM: Warning: Invalid file - not a PKZip file
  1:24 AM: Warning: Invalid file - not a PKZip file
  1:24 AM: Warning: Invalid file - not a PKZip file
  1:24 AM: Warning: Invalid file - not a PKZip file
  1:24 AM: Warning: Invalid file - not a PKZip file
  1:24 AM: Warning: Invalid file - not a PKZip file
  1:24 AM: Warning: Invalid file - not a PKZip file
  1:24 AM: Warning: Invalid file - not a PKZip file
  1:24 AM: Warning: Invalid file - not a PKZip file
  1:24 AM: Warning: Invalid file - not a PKZip file
  1:25 AM: File Sweep Complete, Elapsed Time: 00:25:06
  1:25 AM: Full Sweep has completed. Elapsed time 00:31:11
  1:25 AM: Traces Found: 148
  1:26 AM: Removal process initiated
  1:30 AM: Quarantining All Traces: virtumonde
  1:30 AM: virtumonde is in use. It will be removed on reboot.
  1:30 AM: C:\WINDOWS\SYSTEM32\efebc.dll is in use. It will be removed on reboot.
  1:30 AM: Quarantining All Traces: blazefind
  1:30 AM: Quarantining All Traces: altnet
  1:30 AM: Quarantining All Traces: blazefind_adman
  1:30 AM: Quarantining All Traces: blazefind_adstat
  1:30 AM: Quarantining All Traces: directrevenue-thebestoffersnetwork
  1:30 AM: Quarantining All Traces: instafinder
  1:30 AM: Quarantining All Traces: java byteverify
  1:30 AM: Quarantining All Traces: rx toolbar
  1:30 AM: Quarantining All Traces: searchrelevancy
  1:30 AM: Quarantining All Traces: adultfriendfinder cookie
  1:30 AM: Quarantining All Traces: reliablestats cookie
  1:31 AM: Removal process completed. Elapsed time 00:05:09
  12:04 PM: Warning: Access is denied
  3:34 PM: BHO Shield: found: -- BHO installation allowed at user request
  ********
  12:51 AM: | Start of Session, Friday, November 18, 2005 |
  12:51 AM: Spy Sweeper started
  12:52 AM: Your spyware definitions have been updated.
  12:53 AM: | End of Session, Friday, November 18, 2005 |
  
  
  

  ---

  hijackthis

  ---

  
  
  Logfile of HijackThis v1.99.1
  Scan saved at 12:11:01 AM, on 11/19/2005
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\hkcmd.exe
  C:\WINDOWS\BCMSMMSG.exe
  C:\Program Files\Dell\AccessDirect\dadapp.exe
  C:\WINDOWS\System32\DSentry.exe
  C:\WINDOWS\system32\dla\tfswctrl.exe
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
  C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\WINDOWS\vsnpstd2.exe
  C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
  C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\ScreenPrint32 v3\ScreenPrint32.exe
  C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
  C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
  C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Dell Support\DSAgnt.exe
  C:\Program Files\Adobe\Acrobat 7.0\Acrobat\acrobat_sl.exe
  C:\Program Files\FinePixViewer\QuickDCF.exe
  C:\Program Files\WinZip\WZQKPICK.EXE
  C:\Program Files\Palm\HOTSYNC.EXE
  C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
  C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
  C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
  C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\WINDOWS\system32\wuauclt.exe
  C:\Program Files\HijackThis\HijackThis.exe
  
  F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe
  O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
  O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
  O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
  O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
  O2 - BHO: MSEvents Object - {B313D637-F405-4052-AC37-E2119AB3C8F8} - C:\WINDOWS\system32\efebc.dll (file missing)
  O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
  O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
  O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll
  O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
  O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
  O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [DadApp] C:\Program Files\Dell\AccessDirect\dadapp.exe
  O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
  O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
  O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
  O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [SNPSTD2] C:\WINDOWS\vsnpstd2.exe
  O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
  O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
  O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
  O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
  O4 - HKLM\..\Run: [ScreenPrint32] C:\Program Files\ScreenPrint32 v3\ScreenPrint32.exe -startup
  O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
  O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
  O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
  O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
  O4 - HKCU\..\Run: [tbon] C:\Program Files\TBONBin\tbon.exe /r
  O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
  O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = %SystemRoot%\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe
  O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
  O4 - Global Startup: Exif Launcher.lnk = ?
  O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
  O8 - Extra context menu item: &Search - http://km.bar.need2find.com/KM/menusearch.html?p=KM
  O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
  O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
  O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
  O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
  O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
  O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
  O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
  O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
  O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
  O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
  O16 - DPF: {2C520C08-1ADA-4CEC-AFFD-D0D1BD268D60} (PDUpdate Control) - http://www.pdbox.co.kr/filebox/ctrl_down/PDUpdate.cab
  O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
  O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/autocomplete.cab
  O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326
  O16 - DPF: {ED1EEBEE-F0AA-474B-9829-61C482E72644} (PDBox28 Control) - http://www.pdbox.co.kr/filebox/ctrl_down/PDBox25.cab
  O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
  O20 - Winlogon Notify: efebc - C:\WINDOWS\system32\efebc.dll (file missing)
  O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
  O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
  O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
  
  

  0
• chiaz

  November 2005 edited November 2005

  Please go to Start -> Control Panel -> Add/Remove Programs and remove the following if it appears:
  Need2Find
  
  Launch HijackThis and check the following entries:
  O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)
  O2 - BHO: MSEvents Object - {B313D637-F405-4052-AC37-E2119AB3C8F8} - C:\WINDOWS\system32\efebc.dll (file missing)
  O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)
  O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
  O4 - HKCU\..\Run: [tbon] C:\Program Files\TBONBin\tbon.exe /r
  O8 - Extra context menu item: &Search - http://km.bar.need2find.com/KM/menusearch.html?p=KM
  O20 - Winlogon Notify: efebc - C:\WINDOWS\system32\efebc.dll (file missing)
  Close all windows except HijackThis and press "Fix checked". Close HijackThis and reboot.
  
  
  Please rescan with HijackThis and SpySweeper and post the two new logs here.

  0
• teacherlooking

  November 2005 edited November 2005

  ok.... I have completed the hijackthis "Fix checked" listed above...
  Here are the new results....
  

  ---

  SpySweeper

  ---

  ********
  5:25 PM: | Start of Session, Saturday, November 19, 2005 |
  5:25 PM: Spy Sweeper started
  5:25 PM: Sweep initiated using definitions version 574
  5:25 PM: Starting Memory Sweep
  5:29 PM: Memory Sweep Complete, Elapsed Time: 00:04:09
  5:29 PM: Starting Registry Sweep
  5:30 PM: Registry Sweep Complete, Elapsed Time:00:00:53
  5:30 PM: Starting Cookie Sweep
  5:30 PM: Found Spy Cookie: atlas dmt cookie
  5:30 PM: [email]think@atdmt[2].txt[/email] (ID = 2253)
  5:30 PM: Found Spy Cookie: belnk cookie
  5:30 PM: [email]think@belnk[1].txt[/email] (ID = 2292)
  5:30 PM: Found Spy Cookie: bluestreak cookie
  5:30 PM: [email]think@bluestreak[1].txt[/email] (ID = 2314)
  5:30 PM: [email]think@dist.belnk[2].txt[/email] (ID = 2293)
  5:30 PM: Cookie Sweep Complete, Elapsed Time: 00:00:02
  5:30 PM: Starting File Sweep
  5:55 PM: File Sweep Complete, Elapsed Time: 00:24:42
  5:55 PM: Full Sweep has completed. Elapsed time 00:29:55
  5:55 PM: Traces Found: 4
  6:41 PM: Removal process initiated
  6:41 PM: Quarantining All Traces: atlas dmt cookie
  6:41 PM: Quarantining All Traces: belnk cookie
  6:41 PM: Quarantining All Traces: bluestreak cookie
  6:41 PM: Removal process completed. Elapsed time 00:00:02
  ********
  11:01 PM: | Start of Session, Friday, November 18, 2005 |
  11:01 PM: Spy Sweeper started
  11:01 PM: Sweep initiated using definitions version 573
  11:01 PM: Starting Memory Sweep
  11:05 PM: Memory Sweep Complete, Elapsed Time: 00:04:00
  11:05 PM: Starting Registry Sweep
  11:05 PM: Registry Sweep Complete, Elapsed Time:00:00:54
  11:05 PM: Starting Cookie Sweep
  11:06 PM: Found Spy Cookie: belnk cookie
  11:06 PM: [email]think@belnk[1].txt[/email] (ID = 2292)
  11:06 PM: [email]think@dist.belnk[2].txt[/email] (ID = 2293)
  11:06 PM: Found Spy Cookie: nextag cookie
  11:06 PM: [email]think@nextag[1].txt[/email] (ID = 5014)
  11:06 PM: Found Spy Cookie: surveys cookie
  11:06 PM: [email]think@surveys[1].txt[/email] (ID = 3473)
  11:06 PM: Cookie Sweep Complete, Elapsed Time: 00:00:03
  11:06 PM: Starting File Sweep
  11:29 PM: File Sweep Complete, Elapsed Time: 00:23:52
  11:30 PM: Full Sweep has completed. Elapsed time 00:28:59
  11:30 PM: Traces Found: 4
  11:30 PM: Removal process initiated
  11:31 PM: Quarantining All Traces: belnk cookie
  11:31 PM: Quarantining All Traces: nextag cookie
  11:31 PM: Quarantining All Traces: surveys cookie
  11:31 PM: Removal process completed. Elapsed time 00:00:18
  12:53 AM: Your spyware definitions have been updated.
  ********
  12:53 AM: | Start of Session, Friday, November 18, 2005 |
  12:53 AM: Spy Sweeper started
  12:53 AM: Sweep initiated using definitions version 573
  12:53 AM: Starting Memory Sweep
  12:55 AM: Found Adware: virtumonde
  12:55 AM: Detected running threat: C:\WINDOWS\SYSTEM32\efebc.dll (ID = 77)
  12:58 AM: Memory Sweep Complete, Elapsed Time: 00:04:42
  12:58 AM: Starting Registry Sweep
  12:58 AM: Found Adware: altnet
  12:58 AM: HKCR\clsid\{3f4d4f88-0198-4921-b630-957f3eb814e0}\ (1 subtraces) (ID = 103460)
  12:58 AM: Found Adware: blazefind
  12:58 AM: HKCR\interface\{8c505a6b-124b-4768-8fd3-1a066c839848}\ (8 subtraces) (ID = 104460)
  12:58 AM: HKLM\software\classes\interface\{8c505a6b-124b-4768-8fd3-1a066c839848}\ (8 subtraces) (ID = 104492)
  12:58 AM: Found Adware: blazefind_adman
  12:58 AM: HKLM\software\microsoft\windows\currentversion\moduleusage\c:/windows/downloaded program files/admanctlx.dll\ (2 subtraces) (ID = 104581)
  12:58 AM: HKLM\software\microsoft\windows\currentversion\shareddlls\ || c:\windows\downloaded program files\admanctlx.dll (ID = 104583)
  12:58 AM: Found Adware: blazefind_adstat
  12:58 AM: HKCR\adstatservx.installer\ (3 subtraces) (ID = 104585)
  12:58 AM: HKLM\software\classes\adstatservx.installer\ (3 subtraces) (ID = 104586)
  12:59 AM: Found Adware: searchrelevancy
  12:59 AM: HKCR\interface\{300fa067-9b94-45cf-a30b-cb5221eeb0c3}\ (8 subtraces) (ID = 141290)
  12:59 AM: HKLM\software\classes\interface\{300fa067-9b94-45cf-a30b-cb5221eeb0c3}\ (8 subtraces) (ID = 141293)
  12:59 AM: HKLM\software\classes\typelib\{65a6bb6d-78d0-4e0a-824d-2de1e0d154af}\ (9 subtraces) (ID = 141295)
  12:59 AM: HKLM\software\classes\updater.bho\ (5 subtraces) (ID = 141297)
  12:59 AM: HKCR\typelib\{65a6bb6d-78d0-4e0a-824d-2de1e0d154af}\ (9 subtraces) (ID = 141302)
  12:59 AM: HKCR\updater.bho\ (5 subtraces) (ID = 141303)
  12:59 AM: Found Adware: rx toolbar
  12:59 AM: HKLM\software\rxresults\ (4 subtraces) (ID = 729611)
  12:59 AM: Found Adware: instafinder
  12:59 AM: HKU\S-1-5-21-2106144596-3885586431-2047718683-1007\software\instafink\ (21 subtraces) (ID = 128666)
  12:59 AM: Found Adware: directrevenue-thebestoffersnetwork
  12:59 AM: HKU\S-1-5-21-2106144596-3885586431-2047718683-1007\software\tbon\ (33 subtraces) (ID = 826461)
  12:59 AM: Registry Sweep Complete, Elapsed Time:00:01:11
  12:59 AM: Starting Cookie Sweep
  12:59 AM: Found Spy Cookie: adultfriendfinder cookie
  12:59 AM: [email]think@adultfriendfinder[1].txt[/email] (ID = 2165)
  12:59 AM: Found Spy Cookie: reliablestats cookie
  12:59 AM: [email]think@stats1.reliablestats[2].txt[/email] (ID = 3254)
  12:59 AM: Cookie Sweep Complete, Elapsed Time: 00:00:01
  1:00 AM: Starting File Sweep
  1:23 AM: Found Adware: java byteverify
  1:23 AM: dummy.class-3cf36b1e-420478d6.class (ID = 64821)
  1:23 AM: dummy.class-dbb525f-533605ae.class (ID = 64821)
  1:23 AM: Warning: Invalid file - not a PKZip file
  1:24 AM: Warning: Invalid file - not a PKZip file
  1:24 AM: Warning: Invalid file - not a PKZip file
  1:24 AM: Warning: Invalid file - not a PKZip file
  1:24 AM: Warning: Invalid file - not a PKZip file
  1:24 AM: Warning: Invalid file - not a PKZip file
  1:24 AM: Warning: Invalid file - not a PKZip file
  1:24 AM: Warning: Invalid file - not a PKZip file
  1:24 AM: Warning: Invalid file - not a PKZip file
  1:24 AM: Warning: Invalid file - not a PKZip file
  1:25 AM: File Sweep Complete, Elapsed Time: 00:25:06
  1:25 AM: Full Sweep has completed. Elapsed time 00:31:11
  1:25 AM: Traces Found: 148
  1:26 AM: Removal process initiated
  1:30 AM: Quarantining All Traces: virtumonde
  1:30 AM: virtumonde is in use. It will be removed on reboot.
  1:30 AM: C:\WINDOWS\SYSTEM32\efebc.dll is in use. It will be removed on reboot.
  1:30 AM: Quarantining All Traces: blazefind
  1:30 AM: Quarantining All Traces: altnet
  1:30 AM: Quarantining All Traces: blazefind_adman
  1:30 AM: Quarantining All Traces: blazefind_adstat
  1:30 AM: Quarantining All Traces: directrevenue-thebestoffersnetwork
  1:30 AM: Quarantining All Traces: instafinder
  1:30 AM: Quarantining All Traces: java byteverify
  1:30 AM: Quarantining All Traces: rx toolbar
  1:30 AM: Quarantining All Traces: searchrelevancy
  1:30 AM: Quarantining All Traces: adultfriendfinder cookie
  1:30 AM: Quarantining All Traces: reliablestats cookie
  1:31 AM: Removal process completed. Elapsed time 00:05:09
  12:04 PM: Warning: Access is denied
  3:34 PM: BHO Shield: found: -- BHO installation allowed at user request
  ********
  12:51 AM: | Start of Session, Friday, November 18, 2005 |
  12:51 AM: Spy Sweeper started
  12:52 AM: Your spyware definitions have been updated.
  12:53 AM: | End of Session, Friday, November 18, 2005 |
  
  
  
  

  ---

  hijackthis

  ---

  
  Logfile of HijackThis v1.99.1
  Scan saved at 7:04:38 PM, on 11/19/2005
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\system32\hkcmd.exe
  C:\WINDOWS\BCMSMMSG.exe
  C:\Program Files\Dell\AccessDirect\dadapp.exe
  C:\WINDOWS\System32\DSentry.exe
  C:\WINDOWS\system32\dla\tfswctrl.exe
  C:\Program Files\Common Files\Real\Update_OB\realsched.exe
  C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
  C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\WINDOWS\vsnpstd2.exe
  C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
  C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\ScreenPrint32 v3\ScreenPrint32.exe
  C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
  C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
  C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Dell Support\DSAgnt.exe
  C:\Program Files\FinePixViewer\QuickDCF.exe
  C:\Program Files\WinZip\WZQKPICK.EXE
  C:\Program Files\Palm\HOTSYNC.EXE
  C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
  C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
  C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
  C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
  C:\Program Files\iPod\bin\iPodService.exe
  C:\Program Files\HijackThis\HijackThis.exe
  
  F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe
  O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
  O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
  O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
  O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll
  O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
  O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
  O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
  O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [DadApp] C:\Program Files\Dell\AccessDirect\dadapp.exe
  O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
  O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
  O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
  O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe
  O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
  O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [SNPSTD2] C:\WINDOWS\vsnpstd2.exe
  O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
  O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
  O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
  O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
  O4 - HKLM\..\Run: [ScreenPrint32] C:\Program Files\ScreenPrint32 v3\ScreenPrint32.exe -startup
  O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
  O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
  O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
  O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
  O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
  O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = %SystemRoot%\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe
  O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
  O4 - Global Startup: Exif Launcher.lnk = ?
  O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
  O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
  O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
  O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
  O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
  O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
  O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
  O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
  O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
  O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
  O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
  O16 - DPF: {2C520C08-1ADA-4CEC-AFFD-D0D1BD268D60} (PDUpdate Control) - http://www.pdbox.co.kr/filebox/ctrl_down/PDUpdate.cab
  O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
  O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/autocomplete.cab
  O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326
  O16 - DPF: {ED1EEBEE-F0AA-474B-9829-61C482E72644} (PDBox28 Control) - http://www.pdbox.co.kr/filebox/ctrl_down/PDBox25.cab
  O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
  O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
  O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
  O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
  
  

  0
• chiaz

  November 2005 edited November 2005

  Please launch HijackThis.
  You may like to check this one:
  O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\BackWeb-8876480.exe
  since it is not necessary and is considered Adware.
  
  
  The following are optional entries that you might like to fix:
  O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
  (Description: Intel hotkey applet. Unnecessary. Removing this will free up a small amount of system resources.)
  
  O4 - HKLM\..\Run: [TkBellExe] \"C:\Program Files\Common Files\Real\Update_OB\realsched.exe\" -osboot
  (Description: RealPlayer scheduler. Completely unnecessary. Removing this entry will free up a small amount of system resources.)
  
  O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
  (Description: Adjusts monitor colours across all programs, including Photoshop. It is needed by some graphics professionals who want their monitor calibrated. Most home users will not need it, and thus should remove this entry. )
  
  O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
  (Description: Logitech Desktop Manager. Searches for updates for Logitech software. Not necessary. Removing this entry will free up a small amount of system resources.)
  
  O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
  (Description: Microsoft Office startup assistant. Not necessary. Removing this entry will free up a significant amount of system resources.)
  
  O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
  (Description: WinZip system tray application. Not necessary. Removing this entry will free up a small amount of system resources.)
  
  Close all windows except HijackThis and press the button "Fix checked". Close HijackThis, reboot and empty your recycle bin.
  
  Your log seems to be clean now. Are you still encountering pop-ups?]
  
  Download and scan with CCleaner
  1. Before first use, select Options > Advanced and UNCHECK "Only delete files in Windows Temp folder older than 48 hours"
  2. Then select the items you wish to clean up.
  In the Windows Tab:
  o Clean all entries in the "Internet Explorer" section except Cookies.
  o Clean all the entries in the "Windows Explorer" section.
  o Clean all entries in the "System" section.
  o Clean all entries in the "Advanced" section.
  o Clean any others that you choose.
  In the Applications Tab:
  o Clean all except cookies in the Firefox/Mozilla section if you use it.
  o Clean all in the Opera section if you use it.
  o Clean Sun Java in the Internet Section.
  o Clean any others that you choose.
  3. Click the "Run Cleaner" button.
  4. A pop up box will appear advising this process will permanently delete files from your system.
  5. Click "OK" and it will scan and clean your system.
  6. Click "exit" when done.
  
  If it asks you to reboot at the end, click NO.
  
  Then, please run this online virus scan: ActiveScan
  
  Reboot.
  
  Rescan with HijackThis and post a new log, together with the results of the ActiveScan.

  0
• teacherlooking

  November 2005 edited November 2005

  Hi.... Here are the results from the ActiveScan anti-virus ... and the latest hijackthis log.
  
  As far as my computer goes... everything is running great. No more pop-ups or slow-downs.
  
  Thanks a lot... You guys are great!!!
  
  

  ---

  ActiveScan

  ---

  
  Detected Disinfected
  Virus 0 0
  Spyware 0 0
  Hacking Tools 0 0
  Dialers 0 0
  Security Risks 0 0
  Suspicious files 0 0
  

  ---

  hijackthis

  ---

  
  Logfile of HijackThis v1.99.1
  Scan saved at 2:48:15 AM, on 11/21/2005
  Platform: Windows XP SP2 (WinNT 5.01.2600)
  MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
  
  Running processes:
  C:\WINDOWS\System32\smss.exe
  C:\WINDOWS\system32\winlogon.exe
  C:\WINDOWS\system32\services.exe
  C:\WINDOWS\system32\lsass.exe
  C:\WINDOWS\system32\svchost.exe
  C:\WINDOWS\System32\svchost.exe
  C:\WINDOWS\system32\spoolsv.exe
  C:\WINDOWS\Explorer.EXE
  C:\WINDOWS\BCMSMMSG.exe
  C:\Program Files\Dell\AccessDirect\dadapp.exe
  C:\WINDOWS\System32\DSentry.exe
  C:\WINDOWS\system32\dla\tfswctrl.exe
  C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
  C:\Program Files\QuickTime\qttask.exe
  C:\WINDOWS\vsnpstd2.exe
  C:\Program Files\HP\hpcoretech\hpcmpmgr.exe
  C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
  C:\Program Files\iTunes\iTunesHelper.exe
  C:\Program Files\ScreenPrint32 v3\ScreenPrint32.exe
  C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
  C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
  C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe
  C:\WINDOWS\system32\ctfmon.exe
  C:\Program Files\Dell Support\DSAgnt.exe
  C:\Program Files\Adobe\Acrobat 7.0\Acrobat\acrobat_sl.exe
  C:\Program Files\FinePixViewer\QuickDCF.exe
  C:\Program Files\Palm\HOTSYNC.EXE
  C:\Program Files\Microsoft AntiSpyware\gcasDtServ.exe
  C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
  C:\Program Files\HijackThis\HijackThis.exe
  C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
  C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
  C:\WINDOWS\System32\svchost.exe
  C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe
  
  F2 - REG:system.ini: UserInit=c:\windows\system32\userinit.exe
  O2 - BHO: Yahoo! Companion BHO - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll
  O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
  O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
  O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
  O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
  O3 - Toolbar: &Yahoo! Companion - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\PROGRA~1\Yahoo!\COMPAN~1\Installs\cpn\ycomp5_3_12_0.dll
  O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
  O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
  O4 - HKLM\..\Run: [BCMSMMSG] BCMSMMSG.exe
  O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
  O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
  O4 - HKLM\..\Run: [DadApp] C:\Program Files\Dell\AccessDirect\dadapp.exe
  O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
  O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
  O4 - HKLM\..\Run: [REGSHAVE] C:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
  O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe
  O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
  O4 - HKLM\..\Run: [SNPSTD2] C:\WINDOWS\vsnpstd2.exe
  O4 - HKLM\..\Run: [gcasServ] "C:\Program Files\Microsoft AntiSpyware\gcasServ.exe"
  O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS\system32\NeroCheck.exe
  O4 - HKLM\..\Run: [HP Component Manager] "C:\Program Files\HP\hpcoretech\hpcmpmgr.exe"
  O4 - HKLM\..\Run: [HPDJ Taskbar Utility] C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb10.exe
  O4 - HKLM\..\Run: [iTunesHelper] C:\Program Files\iTunes\iTunesHelper.exe
  O4 - HKLM\..\Run: [ScreenPrint32] C:\Program Files\ScreenPrint32 v3\ScreenPrint32.exe -startup
  O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
  O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
  O4 - HKLM\..\Run: [SpySweeper] "C:\Program Files\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
  O4 - HKCU\..\Run: [MoneyAgent] "C:\Program Files\Microsoft Money\System\mnyexpr.exe"
  O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet
  O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
  O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\Dell Support\DSAgnt.exe" /startup
  O4 - Startup: HotSync Manager.lnk = C:\Program Files\Palm\HOTSYNC.EXE
  O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = %SystemRoot%\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe
  O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
  O4 - Global Startup: Exif Launcher.lnk = ?
  O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
  O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
  O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
  O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
  O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
  O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
  O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
  O8 - Extra context menu item: Convert to existing PDF - res://C:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
  O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
  O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\System32\msjava.dll (file missing)
  O9 - Extra button: Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
  O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {4528BBE0-4E08-11D5-AD55-00010333D0AD} - C:\Program Files\Yahoo!\Messenger\yhexbmes0521.dll
  O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
  O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=36467&clcid=0x409
  O16 - DPF: {2C520C08-1ADA-4CEC-AFFD-D0D1BD268D60} (PDUpdate Control) - http://www.pdbox.co.kr/filebox/ctrl_down/PDUpdate.cab
  O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
  O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
  O16 - DPF: {B9191F79-5613-4C76-AA2A-398534BB8999} (YAddBook Class) - http://us.dl1.yimg.com/download.yahoo.com/dl/installs/suite/autocomplete.cab
  O16 - DPF: {EB387D2F-E27B-4D36-979E-847D1036C65D} (QDiagHUpdateObj Class) - http://h30043.www3.hp.com/hpdj/en/check/qdiagh.cab?326
  O16 - DPF: {ED1EEBEE-F0AA-474B-9829-61C482E72644} (PDBox28 Control) - http://www.pdbox.co.kr/filebox/ctrl_down/PDBox25.cab
  O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://chat.msn.com/bin/msnchat45.cab
  O20 - Winlogon Notify: igfxcui - C:\WINDOWS\SYSTEM32\igfxsrvc.dll
  O20 - Winlogon Notify: WRNotifier - C:\WINDOWS\SYSTEM32\WRLogonNTF.dll
  O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
  O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
  O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
  O23 - Service: iPod Service (iPodService) - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
  O23 - Service: Webroot Spy Sweeper Engine (svcWRSSSDK) - Webroot Software, Inc. - C:\Program Files\Webroot\Spy Sweeper\WRSSSDK.exe

  0
• chiaz

  November 2005 edited November 2005

  I'm glad that your computer is running fine now. Your log also looks quite clean. Congratulations!
  
  Here are a number of recommendations for additional protection to help prevent future malware infections. These few simple steps can stave off the vast majority of spyware problems.
  
  You may have already taken some of these steps:
  1. Visit Windows Update:
  Make sure that you have all the Critical Updates recommended for your operating system and IE. The first defense against infection is a properly patched OS.
  Windows Update: http://v4.windowsupdate.microsoft.com/en/default.asp
  
  2. Adjust your security settings for ActiveX:
  Go to Internet Options/Security/Internet, press 'default level', then OK.
  Now press "Custom Level."
  In the ActiveX section, set the first two options ("Download signed and unsigned ActiveX controls) to 'prompt', and 'Initialize and Script ActiveX controls not marked as safe" to 'disable'.
  
  3. Download and install the following free programs:
  a. SpywareBlaster: http://www.javacoolsoftware.com/spywareblaster.html
  b. SpywareGuard: http://www.javacoolsoftware.com/spywareguard.html
  Periodically check for updates.
  
  4. Keep your antivirus software (AVG) up to date. Do you have a firewall?
  Some good, free firewalls are:
  ZoneAlarm: http://www.zonelabs.com/
  Sygate: http://www.sygate.com
  
  5. You might consider installing Mozilla / Firefox, which is much safer than Internet Explorer.
  http://www.mozilla.org/
  
  6. Install spyware detection and removal programs:
  Ad-aware: http://www.snapfiles.com/get/adaware.html
  Spybot S&D:
  http://www.safer-networking.org
  Use these programs to regularly scan your system for and remove many forms of spyware/malware.
  
  7. Before using or purchasing any Spyware/Malware protection/removal program, always check the Rogue/Suspect Spyware List. It will save you a lot of grief, as well as money if you are thinking of purchasing. Here is the link: http://www.spywarewarrior.com/rogue_anti-spyware.htm
  If you want to know just how effective your anti-spyware program is, or how well any of the "rogue" programs listed at the above link work, check this for an independent comparison of several anti-spyware programs: http://www.spywarewarrior.com/asw-test-guide.htm
  
  8. Please follow instructions here:
  http://www.broadbandreports.com/forum/remark,14738046
  
  I hope I won't be seeing you in a hurry!

  0
• politik

  March 2006 edited March 2006

  howdy all. been having the same problems.I follwoed the directions all the way up to installing Spy Sweeper but apparently I need to buy the subscription to remove stuff it found ? Is there no longer a free trial ?

  0