hmmm. new problem

jabbathehuttjabbathehutt
edited October 2007 in Spyware & Virus Removal
AVG schualed sacn found the following as a virus

C:\WINDOWS\system32\drivers\ect\hosts file size was about 700kb AVG changed it to about 20kb need a chack to see if this is right

here is a new HJT log file thanks

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 1:52:38 AM, on 28/10/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\XpertVision\TBPanel.exe
C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe
C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Messenger\msmsgs.exe
C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
D:\Program Files\Ventrilo\Ventrilo.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Windows Media Player\wmplayer.exe
D:\Program Files\PlayOnline\SquareEnix\PlayOnlineViewer\pol.exe
C:\PROGRA~1\Grisoft\AVG7\avgwa.dat
C:\Program Files\Internet Explorer\iexplore.exe
D:\BACKUP FILES\scanner.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.thepinkshell.org/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [Gainward] C:\Program Files\XpertVision\TBPanel.exe /A
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1189042076531
O20 - Winlogon Notify: avgwlntf - C:\WINDOWS\SYSTEM32\avgwlntf.dll
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG7 Resident Shield Service (AvgCoreSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgrssvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: AVG Firewall (AVGFwSrv) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgfwsrv.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
--
End of file - 5624 bytes

Comments

  • peku006
    edited October 2007
    Hi jabbathehutt and welcome to Icrontic Spyware & Virus Removal

    Your HJT Log appears to be Clean, What kind of problems are you currently receiving?


    AVG did not change your HOSTS file... it is telling you that the HOSTS file was changed.

    It is normal that AVG shows that files, the MBR or Boot record to have changed. These are done during normal maintainance, when you or windows updates files or have had to correct errors on the drive. The only time that you should worry is if they also show as infected.

    To get AVG to quit showing them as changed, open the AVG Test Center, click the F3 key on your keyboard and tell it to accept the changes. If it still shows something as changed after this.. delete the file named AVG7QT.DAT in the %ALLUSERSPROFILE%\Application Data\avg7\ folder and AVG will rebuild it the next time it is run.

    The %ALLUSERSPROFILE% is different for each version of Windows. The following are the typical locations for XP and Win9x

    XP - C:\Documents and Settings\All Users\Application Data\avg7
    Win9x -C:\Windows\All Users\Application Data\avg7
  • jabbathehuttjabbathehutt
    edited October 2007
    well yesterday the same thing appeared in my AVG log as a virus as AVG split spyware and virus threats so thats twice now AVG has shown this problem thanks

    what is your advice should i still do the above?
  • peku006
    edited October 2007
    Hi jabbathehutt
    I'm not seeing anything malicious in your HJT log. Let's run a couple of scans and see what we find.

    Download and Run ComboFix Note: Do not mouseclick combofix's window whilst it's running. That may cause it to stall


    Please do an online scan with Kaspersky Online Scanner. You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
    • The program will launch and then start to download the latest definition files.
    • Once the scanner is installed and the definitions downloaded, click Next.
    • Now click on Scan Settings
    • In the scan settings make sure that the following are selected:

      o Scan using the following Anti-Virus database:

      + Extended (If available otherwise Standard)

      o Scan Options:

      + Scan Archives
      + Scan Mail Bases
    • Click OK
    • Now under select a target to scan select My Computer
    • The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
    • Now click on the Save as Text button
    • Save the file to your desktop.
    • Copy and paste that information in your next post.
    Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the licence, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

    So in your next reply, please include the following:
    Combofix.txt
    Kaspersky Online Scanner.report
    description of any problems you are having with your PC
  • jabbathehuttjabbathehutt
    edited October 2007
    here are the logs as requested awhile ago (reasion i starting posting with you) my pc security was breached (i feel that this issue may have since been resolved) so now i worry about everything i don't understand. sorry if this turns out to be nothing.

    ComboFix 07-10-29.1** - Default 2007-10-30 12:44:38.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.1360 [GMT 11:00]
    Running from: D:\BACKUP FILES\ComboFix.exe
    * Created a new restore point
    .
    ((((((((((((((((((((((((( Files Created from 2007-09-28 to 2007-10-30 )))))))))))))))))))))))))))))))
    .
    2007-10-30 12:44 51,200 --a
    C:\WINDOWS\NirCmd.exe
    2007-10-26 16:46 <DIR> d
    C:\Documents and Settings\All Users\Application Data\InstallShield
    2007-10-25 21:52 <DIR> d-a
    C:\Documents and Settings\All Users\Application Data\TEMP
    2007-10-25 16:00 <DIR> d
    C:\Program Files\Windows Desktop Search
    2007-10-25 15:55 3,734,536 --a
    C:\WINDOWS\system32\d3dx9_36.dll
    2007-10-25 15:55 1,374,232 --a
    C:\WINDOWS\system32\D3DCompiler_36.dll
    2007-10-25 15:55 444,776 --a
    C:\WINDOWS\system32\d3dx10_36.dll
    2007-10-25 15:55 267,272 --a
    C:\WINDOWS\system32\xactengine2_10.dll
    2007-10-23 16:28 92,208 --a
    C:\WINDOWS\system32\WING.DLL
    2007-10-23 16:28 12,800 --a
    C:\WINDOWS\system32\WING32.DLL
    2007-10-16 13:09 <DIR> d
    C:\NVIDIA
    2007-10-16 12:59 <DIR> d
    C:\Program Files\SystemRequirementsLab
    2007-10-16 04:43 2,246 --a
    C:\WINDOWS\system32\tmp.reg
    2007-10-07 01:57 98,304 --a
    C:\WINDOWS\W2BNEUnin.exe
    2007-10-07 01:57 20,573 --a
    C:\WINDOWS\W2BNEUnin.dat
    2007-10-07 01:57 2,829 --a
    C:\WINDOWS\W2BNEUnin.pif
    2007-10-07 01:51 118,784 --a
    C:\WINDOWS\DiabUnin.exe
    2007-10-07 01:51 5,847 --a
    C:\WINDOWS\DiabUnin.dat
    2007-10-07 01:51 2,829 --a
    C:\WINDOWS\DiabUnin.pif
    2007-10-07 01:50 43,520 --a
    C:\WINDOWS\system32\CmdLineExt03.dll
    2007-10-07 01:37 <DIR> d
    C:\Program Files\Common Files\Blizzard Entertainment
    2007-09-13 19:28 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
    2007-09-06 20:12 271,224 --a
    C:\WINDOWS\system32\mucltui.dll
    2007-09-06 18:26 <DIR> d
    C:\WINDOWS\system32\NtmsData
    2007-09-04 12:07 188,960 --a
    C:\WINDOWS\system\WINGDE.DLL
    2007-09-04 12:07 92,208 --a
    C:\WINDOWS\system\WING.DLL
    2007-09-04 12:07 12,800 --a
    C:\WINDOWS\system\WING32.DLL
    2007-09-02 15:54 98,304 --a
    C:\WINDOWS\system32\CmdLineExt.dll
    2007-09-02 15:16 <DIR> d
    C:\Program Files\WON
    2007-09-02 14:44 <DIR> d
    C:\Program Files\MSXML 4.0
    2007-09-02 10:38 <DIR> d
    C:\SIERRA
    2007-09-02 06:16 <DIR> d
    C:\WINDOWS\solcache
    2007-09-02 06:16 552,960 --a
    C:\WINDOWS\system32\WONshell.DLL
    2007-09-02 06:16 544,768 --a
    C:\WINDOWS\system32\sierranw.dll
    2007-09-02 06:16 200,704 --a
    C:\WINDOWS\system32\snwvalid.dll
    2007-09-02 06:16 196,608 --a
    C:\WINDOWS\system32\WONauth.DLL
    2007-09-02 06:14 <DIR> d
    C:\Program Files\Sierra On-Line
    2007-09-02 05:36 756,736
    C:\WINDOWS\system32\ir41_32.dll
    2007-09-02 05:06 139,264 --a
    C:\WINDOWS\War3Unin.exe
    2007-09-02 05:06 64,737 --a
    C:\WINDOWS\War3Unin.dat
    2007-09-02 05:06 2,829 --a
    C:\WINDOWS\War3Unin.pif
    2007-09-02 04:06 94,208 --a
    C:\WINDOWS\DIIUnin.exe
    2007-09-02 04:06 35,995 --a
    C:\WINDOWS\DIIUnin.dat
    2007-09-02 04:06 2,829 --a
    C:\WINDOWS\DIIUnin.pif
    2007-09-02 03:37 <DIR> d
    C:\Documents and Settings\All Users\Application Data\Age of Empires 3
    2007-09-01 20:09 21,840 --a----t- C:\WINDOWS\system32\SIntfNT.dll
    2007-09-01 20:09 17,212 --a----t- C:\WINDOWS\system32\SIntf32.dll
    2007-09-01 20:09 12,067 --a----t- C:\WINDOWS\system32\SIntf16.dll
    2007-09-01 19:09 <DIR> d
    C:\Program Files\Common Files\Adobe
    2007-09-01 18:35 <DIR> d
    C:\Program Files\MSXML 6.0
    2007-09-01 18:25 0 --a
    C:\WINDOWS\PowerReg.dat
    2007-09-01 17:29 629 --a
    C:\WINDOWS\eReg.dat
    2007-09-01 14:56 <DIR> d
    C:\Program Files\MSBuild
    2007-09-01 14:53 <DIR> d
    C:\WINDOWS\system32\XPSViewer
    2007-09-01 14:53 <DIR> d
    C:\Program Files\Reference Assemblies
    2007-09-01 14:53 14,048
    C:\WINDOWS\system32\spmsg2.dll
    2007-09-01 14:52 <DIR> d
    C:\WINDOWS\system32\LogFiles
    2007-09-01 14:52 <DIR> d
    C:\WINDOWS\system32\drivers\UMDF
    2007-09-01 14:52 <DIR> d
    C:\Program Files\Windows Media Connect 2
    2007-09-01 14:47 288,768
    C:\WINDOWS\system32\rhttpaa.dll
    2007-09-01 14:47 116,736
    C:\WINDOWS\system32\aaclient.dll
    2007-09-01 14:47 36,352
    C:\WINDOWS\system32\tsgqec.dll
    2007-09-01 14:22 <DIR> d
    C:\Documents and Settings\Default\Application Data\My Battle for Middle-earth Files
    2007-09-01 13:23 <DIR> d
    C:\Documents and Settings\All Users\Application Data\Links 2003
    2007-09-01 13:19 <DIR> d
    C:\Documents and Settings\LocalService\Application Data\AVG7
    2007-09-01 09:46 <DIR> d
    C:\WINDOWS\system32\URTTemp
    2007-09-01 09:46 <DIR> d
    C:\Program Files\GameSpy
    2007-09-01 09:23 314,368 --a
    C:\WINDOWS\uninst.exe
    2007-09-01 09:22 <DIR> d--hs---- C:\Documents and Settings\Default\UserData
    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2007-10-29 21:00
    d
    w C:\Documents and Settings\Default\Application Data\AVG7
    2007-10-27 15:52
    d
    w C:\Documents and Settings\All Users\Application Data\avg7
    2007-10-26 10:27
    d--h--w C:\Program Files\InstallShield Installation Information
    2007-10-26 09:51
    d
    w C:\Documents and Settings\Default\Application Data\Ahead
    2007-10-26 05:43
    d
    w C:\Program Files\Common Files\InstallShield
    2007-10-21 17:37 17,928 ----a-w C:\WINDOWS\system32\X3DAudio1_2.dll
    2007-09-16 15:07 81,920 ----a-w C:\WINDOWS\system32\nvwddi.dll
    2007-09-16 15:07 81,920 ----a-w C:\WINDOWS\system32\nvmctray.dll
    2007-09-16 15:07 8,491,008 ----a-w C:\WINDOWS\system32\nvcpl.dll
    2007-09-16 15:07 753,664 ----a-w C:\WINDOWS\system32\nvcplui.exe
    2007-09-16 15:07 6,853,088 ----a-w C:\WINDOWS\system32\drivers\nv4_mini.sys
    2007-09-16 15:07 6,746,112 ----a-w C:\WINDOWS\system32\nvoglnt.dll
    2007-09-16 15:07 6,344,704 ----a-w C:\WINDOWS\system32\nvdisps.dll
    2007-09-16 15:07 5,783,040 ----a-w C:\WINDOWS\system32\nv4_disp.dll
    2007-09-16 15:07 466,944 ----a-w C:\WINDOWS\system32\nvshell.dll
    2007-09-16 15:07 45,056 ----a-w C:\WINDOWS\system32\nvmccsrs.dll
    2007-09-16 15:07 442,368 ----a-w C:\WINDOWS\system32\nvappbar.exe
    2007-09-16 15:07 425,984 ----a-w C:\WINDOWS\system32\keystone.exe
    2007-09-16 15:07 364,544 ----a-w C:\WINDOWS\system32\nvapi.dll
    2007-09-16 15:07 36,864 ----a-w C:\WINDOWS\system32\nvcodins.dll
    2007-09-16 15:07 36,864 ----a-w C:\WINDOWS\system32\nvcod.dll
    2007-09-16 15:07 307,200 ----a-w C:\WINDOWS\system32\nvexpbar.dll
    2007-09-16 15:07 3,551,232 ----a-w C:\WINDOWS\system32\nvvitvs.dll
    2007-09-16 15:07 3,334,144 ----a-w C:\WINDOWS\system32\nvgames.dll
    2007-09-16 15:07 286,720 ----a-w C:\WINDOWS\system32\nvnt4cpl.dll
    2007-09-16 15:07 229,376 ----a-w C:\WINDOWS\system32\nvmccs.dll
    2007-09-16 15:07 2,371,584 ----a-w C:\WINDOWS\system32\nvwss.dll
    2007-09-16 15:07 188,416 ----a-w C:\WINDOWS\system32\nvmccss.dll
    2007-09-16 15:07 155,716 ----a-w C:\WINDOWS\system32\nvsvc32.exe
    2007-09-16 15:07 147,456 ----a-w C:\WINDOWS\system32\nvcolor.exe
    2007-09-16 15:07 1,703,936 ----a-w C:\WINDOWS\system32\nvwdmcpl.dll
    2007-09-16 15:07 1,626,112 ----a-w C:\WINDOWS\system32\nwiz.exe
    2007-09-16 15:07 1,478,656 ----a-w C:\WINDOWS\system32\nview.dll
    2007-09-16 15:07 1,339,392 ----a-w C:\WINDOWS\system32\nvdspsch.exe
    2007-09-16 15:07 1,150,976 ----a-w C:\WINDOWS\system32\nvmobls.dll
    2007-09-16 15:07 1,019,904 ----a-w C:\WINDOWS\system32\nvwimg.dll
    2007-09-13 08:30
    d
    w C:\Documents and Settings\All Users\Application Data\DVD Shrink
    2007-09-02 13:18
    d
    w C:\Program Files\Common Files\LightScribe
    2007-09-01 02:27
    d
    w C:\Documents and Settings\Default\Application Data\Ventrilo
    2007-08-31 22:54 163,644 ----a-w C:\WINDOWS\system32\drivers\secdrv.sys
    2007-08-31 04:18
    d
    w C:\Program Files\Common Files\PlayOnline
    2007-08-31 02:57
    d
    w C:\Program Files\GameSpy Arcade
    2007-08-31 02:57
    d
    w C:\Documents and Settings\Default\Application Data\Leadertech
    2007-08-31 02:23
    d
    w C:\Program Files\MSN Messenger
    2007-08-31 02:21
    d
    w C:\Program Files\Common Files\Wise Installation Wizard
    2007-08-31 01:11 9,216 ----a-w C:\WINDOWS\system32\avgwlntf.dll
    2007-08-31 01:11 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
    2007-08-31 01:11 348,160 ----a-w C:\WINDOWS\system32\msvcr71.dll
    2007-08-31 01:11 19,840 ----a-w C:\WINDOWS\system32\drivers\avgmfx86.sys.~
    2007-08-31 01:11 110,592 ----a-w C:\WINDOWS\system32\avgfwafu.dll
    2007-08-31 01:11
    d
    w C:\Documents and Settings\All Users\Application Data\Grisoft
    2007-08-31 01:06
    d
    w C:\Program Files\Common Files\Ahead
    2007-08-31 01:03
    d
    w C:\Program Files\Nero
    2007-08-31 01:03
    d
    w C:\Documents and Settings\All Users\Application Data\Nero
    2007-08-31 00:55
    d
    w C:\Program Files\XpertVision
    2007-08-31 00:51
    d
    w C:\Program Files\Realtek
    2007-08-31 00:50
    d
    w C:\Program Files\DIFX
    2007-08-31 00:38
    d
    w C:\Program Files\microsoft frontpage
    2007-08-21 06:15 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
    2007-07-30 09:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
    2007-07-30 09:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
    2007-07-30 09:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
    2007-07-30 09:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
    2007-07-30 09:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
    2007-07-30 09:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
    2007-07-30 09:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll
    2007-07-30 09:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll
    2007-07-30 09:18 207,736 ----a-w C:\WINDOWS\system32\muweb.dll
    2007-07-19 14:57 267,112 ----a-w C:\WINDOWS\system32\xactengine2_9.dll
    2007-07-19 08:14 444,776 ----a-w C:\WINDOWS\system32\d3dx10_35.dll
    2007-07-19 08:14 3,727,720 ----a-w C:\WINDOWS\system32\d3dx9_35.dll
    2007-07-19 08:14 1,358,192 ----a-w C:\WINDOWS\system32\D3DCompiler_35.dll
    2007-07-09 13:09 584,192 ----a-w C:\WINDOWS\system32\rpcrt4.dll
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SkyTel"="SkyTel.EXE" [2006-05-16 21:04 C:\WINDOWS\SkyTel.exe]
    "RTHDCPL"="RTHDCPL.EXE" [2006-12-19 14:12 C:\WINDOWS\RTHDCPL.EXE]
    "Gainward"="C:\Program Files\XpertVision\TBPanel.exe" [2007-06-26 16:04]
    "NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2007-09-17 02:07]
    "nwiz"="nwiz.exe" [2007-09-17 02:07 C:\WINDOWS\system32\nwiz.exe]
    "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40]
    "AVG7_CC"="C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2007-10-25 14:50]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51]
    "NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-09-17 02:07]
    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2006-11-16 20:04]
    "MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 13:54]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2006-02-28 23:00]
    "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-14 03:24]
    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgwlntf]
    avgwlntf.dll 2007-08-31 12:11 9216 C:\WINDOWS\system32\avgwlntf.dll
    R3 genmcmnUSB;USB Scroll Mouse Driver;C:\WINDOWS\system32\DRIVERS\gflmouhid.sys
    S3 RTLWUSB;NETGEAR WG111v2 54Mbps Wireless USB 2.0 Adapter NT Driver;C:\WINDOWS\system32\DRIVERS\wg111v2.sys
    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{dabb3bc1-57ab-11dc-8185-806d6172696f}]
    AutoRun\command - E:\Setup.exe
    *Newly Created Service* - CATCHME
    .
    **************************************************************************
    catchme 0.3.1239 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-10-30 12:45:31
    Windows 5.1.2600 Service Pack 2 NTFS
    scanning hidden processes ...
    scanning hidden autostart entries ...
    scanning hidden files ...
    scan completed successfully
    hidden files: 0
    **************************************************************************
    .
    Completion time: 2007-10-30 12:46:06
    .
    --- E O F ---
    KASPERSKY ONLINE SCANNER REPORT
    Tuesday, October 30, 2007 2:31:39 PM
    Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
    Kaspersky Online Scanner version: 5.0.98.0
    Kaspersky Anti-Virus database last update: 30/10/2007
    Kaspersky Anti-Virus database records: 448499
    Scan Settings:
    Scan using the following antivirus database: extended
    Scan Archives: true
    Scan Mail Bases: true
    Scan Target - My Computer:
    C:\
    D:\
    E:\
    Scan Statistics:
    Total number of scanned objects: 159488
    Number of viruses found: 1
    Number of infected objects: 1
    Number of suspicious objects: 0
    Duration of the scan process: 00:41:46
    Infected Object Name / Virus Name / Last Action
    C:\Documents and Settings\All Users\Application Data\avg7\Antispam\scoffset.bin.incr Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\avg7\Log\emc.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\AvgFwLog.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\AvgFwLog.log.lck Object is locked skipped
    C:\Documents and Settings\Default\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\Default\Local Settings\Application Data\Ahead\Nero Home\bl.db Object is locked skipped
    C:\Documents and Settings\Default\Local Settings\Application Data\Ahead\Nero Home\bl.db-journal Object is locked skipped
    C:\Documents and Settings\Default\Local Settings\Application Data\Ahead\Nero Home\is2.db Object is locked skipped
    C:\Documents and Settings\Default\Local Settings\Application Data\Ahead\Nero Home\is2.db-journal Object is locked skipped
    C:\Documents and Settings\Default\Local Settings\Application Data\Microsoft\Messenger\jabbatheblm@hotmail.com\SharingMetadata\Logs\Dfsr00005.log Object is locked skipped
    C:\Documents and Settings\Default\Local Settings\Application Data\Microsoft\Messenger\jabbatheblm@hotmail.com\SharingMetadata\pending.dat Object is locked skipped
    C:\Documents and Settings\Default\Local Settings\Application Data\Microsoft\Messenger\jabbatheblm@hotmail.com\SharingMetadata\Working\database_90D8_EBE0_D8EB_C318\dfsr.db Object is locked skipped
    C:\Documents and Settings\Default\Local Settings\Application Data\Microsoft\Messenger\jabbatheblm@hotmail.com\SharingMetadata\Working\database_90D8_EBE0_D8EB_C318\fsr.log Object is locked skipped
    C:\Documents and Settings\Default\Local Settings\Application Data\Microsoft\Messenger\jabbatheblm@hotmail.com\SharingMetadata\Working\database_90D8_EBE0_D8EB_C318\fsrtmp.log Object is locked skipped
    C:\Documents and Settings\Default\Local Settings\Application Data\Microsoft\Messenger\jabbatheblm@hotmail.com\SharingMetadata\Working\database_90D8_EBE0_D8EB_C318\tmp.edb Object is locked skipped
    C:\Documents and Settings\Default\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\Default\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\Default\Local Settings\Application Data\Microsoft\Windows Live Contacts\jabbatheblm@hotmail.com\real\members.stg Object is locked skipped
    C:\Documents and Settings\Default\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\Default\Local Settings\Temp\~DF99C8.tmp Object is locked skipped
    C:\Documents and Settings\Default\Local Settings\Temp\~DF99D3.tmp Object is locked skipped
    C:\Documents and Settings\Default\Local Settings\Temp\~DFD05.tmp Object is locked skipped
    C:\Documents and Settings\Default\Local Settings\Temp\~DFD13.tmp Object is locked skipped
    C:\Documents and Settings\Default\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
    C:\Documents and Settings\Default\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\Default\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\Default\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
    C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    C:\System Volume Information\_restore{C1FD3DDA-97B0-4E8E-A9BF-F75E9D3221C7}\RP70\change.log Object is locked skipped
    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
    C:\WINDOWS\SchedLgU.Txt Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
    C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\default Object is locked skipped
    C:\WINDOWS\system32\config\default.LOG Object is locked skipped
    C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
    C:\WINDOWS\system32\config\SAM Object is locked skipped
    C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
    C:\WINDOWS\system32\config\software Object is locked skipped
    C:\WINDOWS\system32\config\software.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\system Object is locked skipped
    C:\WINDOWS\system32\config\system.LOG Object is locked skipped
    C:\WINDOWS\system32\h323log.txt Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
    C:\WINDOWS\WindowsUpdate.log Object is locked skipped
    D:\BACKUP FILES\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
    D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    D:\System Volume Information\_restore{C1FD3DDA-97B0-4E8E-A9BF-F75E9D3221C7}\RP70\change.log Object is locked skipped
    Scan process completed.
  • peku006
    edited October 2007
    Hi jabbathehutt
    Well those scans certainly came up clean.
    What kind of problems are you currently receiving?
    Let us take a deeper look.

    Download F-Secure Blacklight (fsbl.exe) to the desktop from here

    Open it and click Accept Agreement.
    Click Scan.
    After the scan is complete, click Next, then Exit.
    It will create a log on the desktop named fsbl-xxxxxxx.log (the xxxxxxx will be the date and time of the scan)
    Save the log to your desktop.


    Please do this: Go to Start>Run and highlight the contents of the box below then use CTRL+C to copy them and CTRL+V to paste them into the run dialogue box. 
    c:\windows\system32\drivers\etc\hosts
    Copy and paste the info for your hosts file back here

    Please, post these logs:
    Blacklight report
    Hosts file
  • jabbathehuttjabbathehutt
    edited October 2007
    FYI i have recived no more warning since the 2nd one i told you about
    here are the logs as requested

    10/30/07 22:13:37 [Info]: BlackLight Engine 1.0.67 initialized
    10/30/07 22:13:37 [Info]: OS: 5.1 build 2600 (Service Pack 2)
    10/30/07 22:13:38 [Note]: 7019 4
    10/30/07 22:13:38 [Note]: 7005 0
    10/30/07 22:13:40 [Note]: 7006 0
    10/30/07 22:13:40 [Note]: 7011 1704
    10/30/07 22:13:40 [Note]: 7026 0
    10/30/07 22:13:40 [Note]: 7026 0
    10/30/07 22:13:41 [Note]: FSRAW library version 1.7.1024
    10/30/07 22:15:47 [Note]: 2000 1012
    10/30/07 22:15:47 [Note]: 2000 1012
    10/30/07 22:16:05 [Note]: 7007 0

    127.0.0.1 localhost
  • peku006
    edited October 2007
    Hi jabbathehutt

    the machine does not show any malware
    Your comp looks clean. :smiles:

    Here are some additional utilities that will enhance your safety
    • IE/Spyad <= IE/Spyad places over 4000 websites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads (Cookies etc) from the sites listed, although you will still be able to connect to the sites.
    • MVPS Hosts file <= The MVPS Hosts file replaces your current HOSTS file with one containing well know ad sites etc. Basically, this prevents your coputer from connecting to those sites by redirecting them to 127.0.0.1 which is your local computer
    • Google Toolbar <= Get the free google toolbar to help stop pop up windows.
    • Comodo BOCLEAN <= Stop identity thieves from getting personal information. Instantly detects well over 1,000,000 unique, variant and repack malware in total. And it's free.
    • Winpatrol <= Download and install the free version of Winpatrol. a tutorial for this product is located here:
      Using Winpatrol to protect your computer from malicious software :wink:
  • jabbathehuttjabbathehutt
    edited October 2007
    ok thaks for the help thankyou thankyou thankyou again
  • peku006
    edited October 2007

    Glad I could be of assistance! The help you received here was free. Please read through some of these Prevention Tips that Short-Media offers.

    This topic is now closed. If you wish it reopened, please send a Private Message (PM) to one of the Spyware Mods with a link to your thread.

    Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required.

    If you are not the user who started this thread, you must start a new Thread instead :)

    Would you also be interested to join Short-Media (Team #93) with the Folding@Home Project? More information available here
Sign In or Register to comment.