Micro Antivirus 2009 & Google results' redirects

HSA-SUCKSHSA-SUCKS
edited October 2008 in Spyware & Virus Removal
Yo!

It's been about three years since my last virus, HSA. And I suppose all good times must come to an end, as I am infectecd once again. This time, I think, by a virus that redirects me from Google result websites, prevents me from connecting to anti-spyware servers for updates (Spybot won't install, Adware updates not connecting to the server, and Windows Update website not connecting), and also the virus has a pop-up "Micro Antivirus 2009" that is "scanning" my computer and finding viruses.


I have been able to download HJT but only from download.com (and not any other link that's been posted in other threads on these forums as the link is "unable to connect to server").

For the record, I believe I got the virus from a bit torrent website file. THANK YOU for helping!!!!

Here's my HJT log:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:22:22 PM, on 10/6/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16608)
Boot mode: Normal

Running processes:
C:\WINNT\System32\smss.exe
C:\WINNT\system32\winlogon.exe
C:\WINNT\system32\services.exe
C:\WINNT\system32\lsass.exe
C:\WINNT\System32\ibmpmsvc.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\svchost.exe
C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINNT\system32\spoolsv.exe
C:\Program Files\Altiris\AClient\AClient.exe
C:\Program Files\Altiris\Altiris Agent\AeXNSAgent.exe
C:\WINNT\System32\Ati2evxx.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\System32\QCONSVC.EXE
C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
C:\WINNT\System32\svchost.exe
C:\WINNT\system32\ZuneBusEnum.exe
C:\WINNT\system32\wscntfy.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
C:\WINNT\AGRSMMSG.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Zune\ZuneLauncher.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
C:\WINNT\system32\rundll32.exe
C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
C:\WINNT\system32\ctfmon.exe
C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
C:\Program Files\Altiris\AClient\AClntUsr.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\ltmoh\ltmoh.exe
C:\Program Files\MicroAV\MicroAV.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINNT\explorer.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://blackle.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Comcast
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = gate.temple.edu:8080
O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
O4 - HKLM\..\Run: [TPKMAPMN] C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
O4 - HKLM\..\Run: [StorageGuard] "C:\Program Files\VERITAS Software\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [AeXAgentLogon] "C:\Program Files\Altiris\Altiris Agent\AeXAgentActivate.exe" /logon
O4 - HKLM\..\Run: [AClntUsr] C:\Program Files\Altiris\AClient\AClntUsr.EXE
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [Zune Launcher] "C:\Program Files\Zune\ZuneLauncher.exe"
O4 - HKLM\..\Run: [184c2d2f] rundll32.exe "C:\WINNT\system32\sgkhjpuq.dll",b
O4 - HKLM\..\Run: [ANTIVIRUS] C:\Program Files\MicroAV\MicroAV.exe
O4 - HKCU\..\Run: [Regscan] C:\WINNT\system32\regscan.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe
O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9
O4 - HKCU\..\Run: [ANTIVIRUS] C:\Program Files\MicroAV\MicroAV.exe
O4 - HKUS\S-1-5-19\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINNT\bdoscandel.exe
O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINNT\bdoscandel.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1202182731363
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1202183109417
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
O16 - DPF: {CE7D2BF2-D173-4CE2-9DAF-15EA153B5B43} - http://entriq.vo.llnwd.net/o1/NBCUniversal/cabs/Entriq_3_4_0_15_Silent.cab
O16 - DPF: {DE0FB644-C59B-46D1-B650-88BA945BC98F} - http://entriq.vo.llnwd.net/o1/NBCUniversal/cabs/NBCUniversal_1_0_0_3.cab
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = sege.local
O17 - HKLM\Software\..\Telephony: DomainName = sege.local
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = sege.local
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Altiris Client Service (AClient) - Altiris, Inc. - C:\Program Files\Altiris\AClient\AClient.exe
O23 - Service: Altiris Agent (AeXNSClient) - Altiris, Inc. - C:\Program Files\Altiris\Altiris Agent\AeXNSAgent.exe
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINNT\System32\ibmpmsvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
O23 - Service: QCONSVC - Unknown owner - C:\WINNT\System32\QCONSVC.EXE
O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

--
End of file - 9415 bytes

Comments

  • chiazchiaz
    edited October 2008
    Hello. :)


    Please download Malwarebytes' Anti-Malware by clicking the link below:
    http://www.besttechie.net/tools/mbam-setup.exe

    Double Click mbam-setup.exe to install the application.

    * Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select "Perform Quick Scan", then click Scan.
    * The scan may take some time to finish,so please be patient.
    * When the scan is complete, click OK, then Show Results to view the results.
    * Make sure that everything is checked, and click Remove Selected.
    * When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
    * The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
    * You'll be required to post the contents of this log later.

    Please Note:
    If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer,please do so immediately.


    ==============================================


    Ok. Let's have you download ComboFix.exe. This will give me a better view to the files running and also hidden on your computer and also those in the registry..Please visit this webpage for downloading and instructions for running the tool:

    Go here ======> A guide and tutorial on using ComboFix <====== Go here

    Please ensure you read this guide carefully and install the Recovery Console first.This applies to XP Pro and XP Home users only.If you have SP3 installed you will need to use SP2

    The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.

    Once installed, you should get a prompt that says:

    The Recovery Console was successfully installed.

    Please continue as follows:

    (1) Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
    (2) Click Yes to allow ComboFix to continue scanning for malware.

    When the tool is finished, it will produce a report for you.

    Please include the following reports for further review (copy and paste them, not attach), so that we may continue cleansing the system:

    MBAM log
    C:\ComboFix.txt
    New HijackThis log

    Caution: Never run and remove files with Combofix unless supervised by a qualified security analyst who is experienced in the use of Combofix. Misuse can cause serious computer problems.
  • HSA-SUCKSHSA-SUCKS
    edited October 2008
    I was unable to download MBAM from the link you posted. The new tab that opened up in Firefox stated:"Failed to connect". This happens to be the same message I get when I previously attempted to download spybot, MBAM, Adware and Windows updates from numerous links. I was able to download MBAM from download.com. Upon installation I opted to get updates but MBAM was unable to connect to the servers. I am currently running MBAM now....logs are coming shortly!!
  • chiazchiaz
    edited October 2008
    No problem. Looking forward to the logs.
  • HSA-SUCKSHSA-SUCKS
    edited October 2008
    Please note that upon restart of my computer, which was automated by combofix, spybot resident protection starting running. I tried to shut it down but in doing so spybot resident auto-denied the registry change from occuring (I dont know what specific registry change it was). The combofix didnt respond and a log wasnt created, so I shut it down (by clicking x) and reran it. This log is that ensuing log. THANKS!


    ComboFix 08-10-06.05 - Raul 2008-10-07 2:55:47.2 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.679 [GMT -4:00]
    Running from: C:\Documents and Settings\Raul\Desktop\ComboFix.exe
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    ---- Previous Run
    .
    C:\Program Files\MicroAV
    C:\Program Files\MicroAV\MicroAV.cpl
    C:\Program Files\MicroAV\MicroAV.exe
    C:\Program Files\MicroAV\MicroAV.ooo
    C:\Program Files\MicroAV\MicroAV0.dat
    C:\Program Files\MicroAV\MicroAV1.dat
    C:\WINNT\fpbkh.dat
    C:\WINNT\oxnss.dat
    C:\WINNT\system32\bbglk.dat
    C:\WINNT\system32\cazfy.dat
    C:\WINNT\system32\gdmuq.dat
    C:\WINNT\system32\mdm.exe
    C:\WINNT\system32\nwxqy.dat
    C:\WINNT\system32\qlegv.dat
    C:\WINNT\system32\setup.ini
    C:\WINNT\system32\TDSSerrors.log
    C:\WINNT\system32\txjrk.dat
    C:\WINNT\system32\vwogf.dat
    C:\WINNT\system32\xmchq.dat
    C:\WINNT\Web\default.htt

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .
    \Legacy_TDSSSERV
    \Service_IAS
    \Service_TDSSserv


    ((((((((((((((((((((((((( Files Created from 2008-09-07 to 2008-10-07 )))))))))))))))))))))))))))))))
    .

    2008-10-07 01:36 . 2008-10-07 01:36 <DIR> d
    C:\Documents and Settings\Raul\Application Data\Malwarebytes
    2008-10-07 01:35 . 2008-10-07 01:36 <DIR> d
    C:\Program Files\Malwarebytes' Anti-Malware
    2008-10-07 01:35 . 2008-10-07 01:35 <DIR> d
    C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-10-07 01:35 . 2008-09-10 00:04 38,528 --a
    C:\WINNT\system32\drivers\mbamswissarmy.sys
    2008-10-07 01:35 . 2008-09-10 00:03 17,200 --a
    C:\WINNT\system32\drivers\mbam.sys
    2008-10-06 21:18 . 2008-10-06 21:18 <DIR> d
    C:\Program Files\Trend Micro
    2008-10-06 20:29 . 2008-10-06 20:29 <DIR> d
    C:\Program Files\Microsoft Silverlight
    2008-10-05 23:54 . 2008-10-05 23:54 <DIR> d
    C:\Program Files\Lavasoft
    2008-10-05 23:54 . 2008-10-05 23:56 <DIR> d
    C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-10-05 23:53 . 2008-10-05 23:53 <DIR> d
    C:\Program Files\Common Files\Wise Installation Wizard
    2008-10-05 22:17 . 2008-10-07 00:52 8,192 --a
    C:\WINNT\system32\tdssserf1.dll
    2008-09-26 19:50 . 2008-10-05 19:30 <DIR> d
    C:\Program Files\PokerStars

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-10-07 06:45 2,401 ----a-w C:\WINNT\system32\drivers\AlKernel.sys
    2008-10-07 06:00
    d
    w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-10-07 05:03
    d
    w C:\Program Files\Spybot - Search & Destroy
    2008-10-06 02:20
    d
    w C:\Documents and Settings\Raul\Application Data\uTorrent
    2008-09-25 01:13
    d--h--w C:\Documents and Settings\Raul\Application Data\Move Networks
    2008-09-09 11:30
    d
    w C:\Documents and Settings\All Users\Application Data\WinZip
    2008-09-08 21:24
    d
    w C:\Program Files\The Weather Channel FW
    2008-09-08 21:22
    d
    w C:\Program Files\Soulseek
    2008-09-08 21:21
    d--h--w C:\Program Files\InstallShield Installation Information
    2008-09-08 21:21
    d
    w C:\Program Files\Full Tilt Poker
    2008-03-29 19:39 24,848 ----a-w C:\Documents and Settings\Raul\Application Data\GDIPFONTCACHEV1.DAT
    2004-08-20 22:20 496 ----a-w C:\Program Files\Altir
    2003-02-05 00:23 271 --sh--w C:\Program Files\desktop.ini
    2003-02-05 00:23 21,952 ---h--w C:\Program Files\folder.htt
    2007-03-27 07:56 548,864 ----a-w C:\Program Files\mozilla firefox\plugins\msvcp80.dll
    2007-03-27 07:56 626,688 ----a-w C:\Program Files\mozilla firefox\plugins\msvcr80.dll
    .
    Sigcheck

    2005-03-02 14:19 577024 1800f293bccc8ede8a70e12b88d80036 C:\WINNT\$hf_mig$\KB890859\SP2QFE\user32.dll
    2001-08-23 08:00 561152 be57a5c3abd240514b98f6bca872fb21 C:\WINNT\$NtServicePackUninstall$\user32.dll
    2004-08-04 01:56 577024 c72661f8552ace7c5c85e16a3cf505c4 C:\WINNT\$NtUninstallKB890859$\user32.dll
    2002-07-22 16:05 405264 4dc317a74845603f6d2b0b325aa234c6 C:\WINNT\$NtUninstallQ328310$\user32.dll
    2004-08-04 01:56 577024 c72661f8552ace7c5c85e16a3cf505c4 C:\WINNT\ServicePackFiles\i386\user32.dll
    2005-03-02 14:09 577024 de2db164bbb35db061af0997e4499054 C:\WINNT\system32\user32.dll

    2005-03-01 20:36 2056832 d8aba3eab509627e707a3b14f00fbb6b C:\WINNT\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
    2001-08-23 08:00 1896704 46e2e3dcf54b819cfb2ebfe48a22b5c9 C:\WINNT\$NtServicePackUninstall$\ntkrnlpa.exe
    2004-08-03 23:59 2056832 947fb1d86d14afcffdb54bf837ec25d0 C:\WINNT\$NtUninstallKB890859$\ntkrnlpa.exe
    2002-07-22 16:05 1687360 08888c725e9ac9f3c8767546d0338b1c C:\WINNT\$NtUninstallQ811493$\ntkrnlpa.exe
    2005-03-01 20:34 2056832 81013f36b21c7f72cf784cc6731e0002 C:\WINNT\Driver Cache\i386\ntkrnlpa.exe
    2004-08-03 23:59 2056832 947fb1d86d14afcffdb54bf837ec25d0 C:\WINNT\ServicePackFiles\i386\ntkrnlpa.exe
    2005-03-01 20:34 2056832 81013f36b21c7f72cf784cc6731e0002 C:\WINNT\system32\ntkrnlpa.exe

    2005-03-01 21:04 2179456 28187802b7c368c0d3aef7d4c382aabb C:\WINNT\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
    2001-08-23 08:00 1982208 a29222d5281056e497408fcc9062f749 C:\WINNT\$NtServicePackUninstall$\ntoskrnl.exe
    2004-08-04 00:20 2180992 ce218bc7088681faa06633e218596ca7 C:\WINNT\$NtUninstallKB890859$\ntoskrnl.exe
    2002-07-22 16:05 1712720 1be931a7bb06c089812029603ae9fe88 C:\WINNT\$NtUninstallQ811493$\ntoskrnl.exe
    2005-03-01 20:59 2179328 4d4cf2c14550a4b7718e94a6e581856e C:\WINNT\Driver Cache\i386\ntoskrnl.exe
    2004-08-04 00:20 2180992 ce218bc7088681faa06633e218596ca7 C:\WINNT\ServicePackFiles\i386\ntoskrnl.exe
    2005-03-01 20:59 2179328 4d4cf2c14550a4b7718e94a6e581856e C:\WINNT\system32\ntoskrnl.exe
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="C:\WINNT\system32\ctfmon.exe" [2004-08-04 15360]
    "updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 313472]
    "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 2156368]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Smapp"="C:\Program Files\Analog Devices\SoundMAX\Smtray.exe" [2002-06-26 90112]
    "EZEJMNAP"="C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe" [2002-11-01 204800]
    "TPHOTKEY"="C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe" [2002-12-02 90112]
    "TPKMAPMN"="C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe" [2002-11-21 32768]
    "SynTPLpr"="C:\Program Files\Synaptics\SynTP\SynTPLpr.exe" [2003-06-24 126976]
    "AeXAgentLogon"="C:\Program Files\Altiris\Altiris Agent\AeXAgentActivate.exe" [2004-06-16 143360]
    "AClntUsr"="C:\Program Files\Altiris\AClient\AClntUsr.EXE" [2008-10-07 180224]
    "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2003-06-24 561152]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 144784]
    "HP Software Update"="C:\Program Files\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
    "googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-01 3739648]
    "NeroFilterCheck"="C:\WINNT\system32\NeroCheck.exe" [2001-07-09 155648]
    "QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2008-02-01 385024]
    "Zune Launcher"="C:\Program Files\Zune\ZuneLauncher.exe" [2008-04-29 158624]
    "Synchronization Manager"="mobsync.exe" [2004-08-04 C:\WINNT\system32\mobsync.exe]
    "ATIModeChange"="Ati2mdxx.exe" [2001-09-04 C:\WINNT\system32\Ati2mdxx.exe]
    "AGRSMMSG"="AGRSMMSG.exe" [2002-10-18 C:\WINNT\AGRSMMSG.exe]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "^SetupICWDesktop"="C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe" [2004-08-04 214528]
    "tscuninstall"="C:\WINNT\system32\tscupgrd.exe" [2004-08-03 44544]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2008-04-23 29696]
    HP Digital Imaging Monitor.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe [2006-02-19 288472]
    HP Photosmart Premier Fast Start.lnk - C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe [2006-02-10 73728]
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 83360]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
    "DisableCAD"= 1 (0x1)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
    "NoMSAppLogo5ChannelNotify"= 1 (0x1)
    "NoBandCustomize"= 0 (0x0)

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
    "Btn_Back"= 0 (0x0)
    "Btn_Forward"= 0 (0x0)
    "Btn_Stop"= 0 (0x0)
    "Btn_Refresh"= 0 (0x0)
    "Btn_Home"= 0 (0x0)
    "Btn_Search"= 0 (0x0)
    "Btn_History"= 0 (0x0)
    "Btn_Favorites"= 0 (0x0)
    "Btn_Media"= 0 (0x0)
    "Btn_Folders"= 0 (0x0)
    "Btn_Fullscreen"= 0 (0x0)
    "Btn_Tools"= 0 (0x0)
    "Btn_MailNews"= 0 (0x0)
    "Btn_Size"= 0 (0x0)
    "Btn_Print"= 0 (0x0)
    "Btn_Edit"= 0 (0x0)
    "Btn_Discussions"= 0 (0x0)
    "Btn_Cut"= 0 (0x0)
    "Btn_Copy"= 0 (0x0)
    "Btn_Paste"= 0 (0x0)
    "Btn_Encoding"= 0 (0x0)
    "Btn_PrintPreview"= 0 (0x0)
    "NoFavoritesMenu"= 0 (0x0)
    "NoLogoff"= 0 (0x0)
    "EnforceShellExtensionSecurity"= 0 (0x0)
    "NoDeletePrinter"= 0 (0x0)
    "NoAddPrinter"= 0 (0x0)
    "NoPrinterTabs"= 0 (0x0)

    [HKEY_LOCAL_MACHINE\software\policies\microsoft\windows\windowsupdate\au]
    "NoAutoUpdate"= 1 (0x1)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\tphotkey]
    2002-09-04 17:25 20480 C:\WINNT\system32\tphklock.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "aux"= mmdrv.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sglfb.sys]
    @=&quot;Driver"

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\tga.sys]
    @=&quot;Driver"

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
    @=&quot;Driver"

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusOverride"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "C:\\Program Files\\Altiris\\aclient\\AClntUsr.EXE"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqtra08.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqste08.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpofxm08.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposfx08.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hposid01.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqscnvw.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqkygrp.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqCopy.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpfccopy.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpzwiz01.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqPhUnl.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\Unload\\HpqDIA.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpoews01.exe"=
    "C:\\Program Files\\HP\\Digital Imaging\\bin\\hpqnrs08.exe"=
    "C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\AIM6\\aim6.exe"=
    "C:\\Program Files\\uTorrent\\uTorrent.exe"=
    "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
    "C:\\Program Files\\Mozilla Firefox\\firefox.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

    R0 Fd16_700;Fd16_700;C:\WINNT\system32\DRIVERS\fd16_700.sys [1999-09-25 11280]
    R0 ipsraidn;ipsraidn;C:\WINNT\system32\DRIVERS\ipsraidn.sys [1999-09-25 14736]
    R1 aswSP;avast! Self Protection;C:\WINNT\system32\drivers\aswSP.sys [2008-07-19 78416]
    R1 IBMTPCHK;IBMTPCHK;C:\WINNT\system32\drivers\IBMBLDID.SYS [2003-01-08 2295]
    R1 TPPWR;TPPWR;C:\WINNT\system32\drivers\Tppwr.sys [2002-11-01 12288]
    R2 aswFsBlk;aswFsBlk;C:\WINNT\system32\DRIVERS\aswFsBlk.sys [2008-07-19 20560]
    R2 zumbus;Zune Bus Enumerator Driver;C:\WINNT\system32\DRIVERS\zumbus.sys [2008-04-29 40704]
    R2 ZuneBusEnum;Zune Bus Enumerator;C:\WINNT\system32\ZuneBusEnum.exe [2008-04-29 61856]
    R3 PCX500;Cisco Wireless LAN Adapters Driver;C:\WINNT\system32\DRIVERS\pcx500.sys [2003-02-14 222720]
    S3 payweb30;PayWeb3000 USB Adapter Driver;C:\WINNT\system32\DRIVERS\payweb30.sys [2001-11-14 172050]
    S3 PCX500MP;Cisco 350 Series Lower Device Filter;C:\WINNT\system32\DRIVERS\pcx500mp.sys [2002-08-05 4990]
    S3 ZuneWlanCfgSvc;Zune Wireless Configuration Service;C:\WINNT\system32\ZuneWlanCfgSvc.exe [2008-04-29 245664]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2ae1de03-f37f-11dc-914c-000dbd17db36}]
    \Shell\AutoRun\command - E:\setupSNK.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7be13ef9-0176-11dd-9158-000dbd17db36}]
    \Shell\Auto\command - UFO.exe
    \Shell\AutoRun\command - C:\WINNT\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL UFO.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{7be13f00-0176-11dd-9158-00096b8667d7}]
    \Shell\Auto\command - UFO.exe
    \Shell\AutoRun\command - C:\WINNT\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL UFO.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{81c0d901-ed1b-11dc-9149-00096b8667d7}]
    \Shell\AutoRun\command - E:\LaunchU3.exe
    .
    Contents of the 'Scheduled Tasks' folder

    2008-09-02 C:\WINNT\Tasks\AppleSoftwareUpdate.job
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 15:57]

    2006-06-19 C:\WINNT\Tasks\BMMTask.job
    - C:\PROGRA~1\ThinkPad\UTILIT~1\BMMTASK.EXE [2002-11-01 05:31]
    .
    - - - - ORPHANS REMOVED - - - -

    HKLM-Run-StorageGuard - C:\Program Files\VERITAS Software\Update Manager\sgtray.exe


    .
    Supplementary Scan
    .
    FireFox -: Profile - C:\Documents and Settings\Raul\Application Data\Mozilla\Firefox\Profiles\5fnyd5q9.Default User\
    FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://blackle.com/
    FF -: plugin - C:\Program Files\Adobe\Acrobat 7.0\Reader\browser\nppdf32.dll
    FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npbittorrent.dll
    FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\npunagi2.dll
    FF -: plugin - C:\Program Files\Viewpoint\Viewpoint Experience Technology\npViewpoint.dll
    FF -: plugin - C:\Program Files\Yahoo!\Shared\npYState.dll
    .

    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-10-07 02:57:49
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...


    **************************************************************************
    .
    Completion time: 2008-10-07 3:02:53
    ComboFix-quarantined-files.txt 2008-10-07 07:01:48

    Pre-Run: 16,996,147,200 bytes free
    Post-Run: 16,982,216,704 bytes free

    256
  • HSA-SUCKSHSA-SUCKS
    edited October 2008
    HSA SUCKS wrote:
    I was unable to download MBAM from the link you posted. The new tab that opened up in Firefox stated:"Failed to connect". This happens to be the same message I get when I previously attempted to download spybot, MBAM, Adware and Windows updates from numerous links. I was able to download MBAM from download.com. Upon installation I opted to get updates but MBAM was unable to connect to the servers. I am currently running MBAM now....logs are coming shortly!!


    Here's the MBAM log that preceded the combofix log (THANK YOU):

    Malwarebytes' Anti-Malware 1.28
    Database version: 1134
    Windows 5.1.2600 Service Pack 2

    10/7/2008 1:55:34 AM
    mbam-log-2008-10-07 (01-55-34).txt

    Scan type: Quick Scan
    Objects scanned: 52741
    Time elapsed: 14 minute(s), 14 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 3
    Registry Keys Infected: 17
    Registry Values Infected: 3
    Registry Data Items Infected: 2
    Folders Infected: 1
    Files Infected: 29

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    C:\WINNT\system32\cbXRLccC.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINNT\system32\sgkhjpuq.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINNT\system32\jkkKcDWn.dll (Trojan.Vundo) -> Delete on reboot.

    Registry Keys Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{a91eab47-7b98-4b05-be3d-4b41321ddc35} (Trojan.Vundo.H) -> Delete on reboot.
    HKEY_CLASSES_ROOT\CLSID\{a91eab47-7b98-4b05-be3d-4b41321ddc35} (Trojan.Vundo.H) -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c7093db8-d5fb-4ff9-851c-3e4c5c5bd4fd} (Trojan.Vundo.H) -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\jkkkcdwn (Trojan.Vundo.H) -> Delete on reboot.
    HKEY_CLASSES_ROOT\CLSID\{c7093db8-d5fb-4ff9-851c-3e4c5c5bd4fd} (Trojan.Vundo.H) -> Delete on reboot.
    HKEY_CLASSES_ROOT\virtualdns.virtualdnsobj (Adware.WebDir) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\virtualdns.virtualdnsobj.1 (Adware.WebDir) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{1f63b171-e2f3-4362-a484-8563144d62e6} (Adware.WebDir) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c} (Adware.Minibug) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{86c510e9-97ef-4749-914f-0280247be3a6} (Adware.WebDir) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{143414d1-c324-4d6f-9756-5075d9a4a485} (Adware.WebDir) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\tdssdata (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\tdss (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{daa873d4-958c-453c-81ca-3fe6f3676a87} (Rootkit.ADS) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\MicroAV (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.

    Registry Values Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\184c2d2f (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{c7093db8-d5fb-4ff9-851c-3e4c5c5bd4fd} (Trojan.Vundo) -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\SharedDLLs\C:\WINNT\Downloaded Program Files\uninst.bat (Trojan.Agent) -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Notification Packages (Trojan.Vundo.H) -> Data: c:\winnt\system32\cbxrlccc -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\winnt\system32\cbxrlccc -> Delete on reboot.

    Folders Infected:
    C:\Program Files\PCHealthCenter (Trojan.Fakealert) -> Quarantined and deleted successfully.

    Files Infected:
    C:\WINNT\system32\cbXRLccC.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINNT\system32\CccLRXbc.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINNT\system32\CccLRXbc.ini2 (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINNT\system32\jkkKcDWn.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINNT\system32\sgkhjpuq.dll (Trojan.Vundo.H) -> Delete on reboot.
    C:\WINNT\system32\qupjhkgs.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINNT\system32\tkppttid.dll (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINNT\system32\dittppkt.ini (Trojan.Vundo.H) -> Quarantined and deleted successfully.
    C:\WINNT\system32\qoMdBQJc.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Program Files\PCHealthCenter\0.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
    C:\Program Files\PCHealthCenter\1.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
    C:\Program Files\PCHealthCenter\1.ico (Trojan.Fakealert) -> Quarantined and deleted successfully.
    C:\Program Files\PCHealthCenter\2.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
    C:\Program Files\PCHealthCenter\2.ico (Trojan.Fakealert) -> Quarantined and deleted successfully.
    C:\Program Files\PCHealthCenter\3.gif (Trojan.Fakealert) -> Quarantined and deleted successfully.
    C:\Program Files\PCHealthCenter\5.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
    C:\Program Files\PCHealthCenter\7.exe (Trojan.Fakealert) -> Quarantined and deleted successfully.
    C:\Program Files\PCHealthCenter\sc.html (Trojan.Fakealert) -> Quarantined and deleted successfully.
    C:\WINNT\Downloaded Program Files\uninst.bat (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINNT\system32\tdssadw.dll (Trojan.Agent) -> Delete on reboot.
    C:\WINNT\system32\tdssl.dll (Trojan.Agent) -> Delete on reboot.
    C:\WINNT\system32\tdssserf.dll (Trojan.Agent) -> Delete on reboot.
    C:\WINNT\system32\tdssmain.dll (Trojan.Agent) -> Delete on reboot.
    C:\WINNT\system32\tdssinit.dll (Trojan.Agent) -> Delete on reboot.
    C:\WINNT\system32\tdsslog.dll (Trojan.Agent) -> Delete on reboot.
    C:\WINNT\system32\tdssservers.dat (Trojan.Agent) -> Delete on reboot.
    C:\WINNT\system32\drivers\tdssserv.sys (Trojan.Agent) -> Delete on reboot.
    C:\WINNT\system32:dbaa.dll (Rootkit.ADS) -> Quarantined and deleted successfully.
    C:\WINNT\system32\MicroAV.cpl (Rogue.MicroAntivirus) -> Quarantined and deleted successfully.
  • HSA-SUCKSHSA-SUCKS
    edited October 2008
    Ironically, I've got an exam tomorrow on viruses and bacteria of the mouth (oral pathology).... :zombie:


    I will resume posting and carrying out your suggestions on how to beat this computer virus in about 18 hours.


    Damn viruses, are making my life a bit challenging. :mouldy:

    Thanks again for the help....
  • chiazchiaz
    edited October 2008
    I will need to see a new HijackThis log as well.

    Good luck with the exam! :D
  • HSA-SUCKSHSA-SUCKS
    edited October 2008
    I've just woke up my computer from standby and run the HJT scan and log:
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 8:41:44 AM, on 10/7/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Normal

    Running processes:
    C:\WINNT\System32\smss.exe
    C:\WINNT\system32\winlogon.exe
    C:\WINNT\system32\services.exe
    C:\WINNT\system32\lsass.exe
    C:\WINNT\System32\ibmpmsvc.exe
    C:\WINNT\system32\svchost.exe
    C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
    C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
    C:\WINNT\System32\svchost.exe
    C:\WINNT\system32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINNT\system32\spoolsv.exe
    C:\Program Files\Altiris\AClient\AClient.exe
    C:\Program Files\Altiris\Altiris Agent\AeXNSAgent.exe
    C:\WINNT\System32\Ati2evxx.exe
    C:\WINNT\System32\svchost.exe
    C:\WINNT\System32\QCONSVC.EXE
    C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe
    C:\WINNT\System32\svchost.exe
    C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
    C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
    C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
    C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\WINNT\system32\ZuneBusEnum.exe
    C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    C:\WINNT\AGRSMMSG.exe
    C:\Program Files\Zune\ZuneLauncher.exe
    C:\Program Files\ThinkPad\PkgMgr\HOTKEY\TPONSCR.exe
    C:\WINNT\system32\ctfmon.exe
    C:\Program Files\ThinkPad\PkgMgr\HOTKEY_1\TpScrex.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\WINNT\system32\wscntfy.exe
    C:\Program Files\Altiris\AClient\AClntUsr.exe
    C:\Program Files\HP\Digital Imaging\bin\hpqimzone.exe
    C:\WINNT\explorer.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://blackle.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = gate.temple.edu:8080
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O4 - HKLM\..\Run: [Synchronization Manager] mobsync.exe /logon
    O4 - HKLM\..\Run: [ATIModeChange] Ati2mdxx.exe
    O4 - HKLM\..\Run: [Smapp] C:\Program Files\Analog Devices\SoundMAX\Smtray.exe
    O4 - HKLM\..\Run: [EZEJMNAP] C:\PROGRA~1\ThinkPad\UTILIT~1\EzEjMnAp.Exe
    O4 - HKLM\..\Run: [TPHOTKEY] C:\PROGRA~1\ThinkPad\PkgMgr\HOTKEY\TPHKMGR.exe
    O4 - HKLM\..\Run: [TPKMAPMN] C:\Program Files\ThinkPad\Utilities\TpKmapMn.exe
    O4 - HKLM\..\Run: [SynTPLpr] C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
    O4 - HKLM\..\Run: [AeXAgentLogon] "C:\Program Files\Altiris\Altiris Agent\AeXAgentActivate.exe" /logon
    O4 - HKLM\..\Run: [AClntUsr] C:\Program Files\Altiris\AClient\AClntUsr.EXE
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\HP\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINNT\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [Zune Launcher] "C:\Program Files\Zune\ZuneLauncher.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINNT\system32\ctfmon.exe
    O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKUS\S-1-5-19\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-19\..\RunOnce: [tscuninstall] %systemroot%\system32\tscupgrd.exe (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\RunOnce: [^SetupICWDesktop] C:\Program Files\Internet Explorer\Connection Wizard\icwconn1.exe /desktop (User 'Default user')
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: HP Digital Imaging Monitor.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqtra08.exe
    O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: (no name) - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINNT\bdoscandel.exe
    O9 - Extra 'Tools' menuitem: Uninstall BitDefender Online Scanner v8 - {85d1f590-48f4-11d9-9669-0800200c9a66} - C:\WINNT\bdoscandel.exe
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O16 - DPF: {5D86DDB5-BDF9-441B-9E9E-D4730F4EE499} (BDSCANONLINE Control) - http://download.bitdefender.com/resources/scan8/oscan8.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1202182731363
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1202183109417
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O16 - DPF: {CE7D2BF2-D173-4CE2-9DAF-15EA153B5B43} - http://entriq.vo.llnwd.net/o1/NBCUniversal/cabs/Entriq_3_4_0_15_Silent.cab
    O16 - DPF: {DE0FB644-C59B-46D1-B650-88BA945BC98F} - http://entriq.vo.llnwd.net/o1/NBCUniversal/cabs/NBCUniversal_1_0_0_3.cab
    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = sege.local
    O17 - HKLM\Software\..\Telephony: DomainName = sege.local
    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = sege.local
    O17 - HKLM\System\CS3\Services\Tcpip\Parameters: Domain = sege.local
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Altiris Client Service (AClient) - Altiris, Inc. - C:\Program Files\Altiris\AClient\AClient.exe
    O23 - Service: Altiris Agent (AeXNSClient) - Altiris, Inc. - C:\Program Files\Altiris\Altiris Agent\AeXNSAgent.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINNT\System32\Ati2evxx.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: IBM PM Service (IBMPMSVC) - Unknown owner - C:\WINNT\System32\ibmpmsvc.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINNT\system32\HPZipm12.exe
    O23 - Service: QCONSVC - Unknown owner - C:\WINNT\System32\QCONSVC.EXE
    O23 - Service: SoundMAX Agent Service (SoundMAX Agent Service (default)) - Analog Devices, Inc. - C:\Program Files\Analog Devices\SoundMAX\SMAgent.exe

    --
    End of file - 9531 bytes
  • chiazchiaz
    edited October 2008
    Please run HijackThis and place a tick by the following entries:
    O16 - DPF: {CE7D2BF2-D173-4CE2-9DAF-15EA153B5B43} - http://entriq.vo.llnwd.net/o1/NBCUni..._15_Silent.cab
    O16 - DPF: {DE0FB644-C59B-46D1-B650-88BA945BC98F} - http://entriq.vo.llnwd.net/o1/NBCUni...al_1_0_0_3.cab

    Close all other windows except HijackThis and press "Fix Checked". Then close HijackThis and reboot the computer.



    Next, please go HERE to run Panda ActiveScan 2.0
    • Click the big green Scan now button
    • If it wants to install an ActiveX component allow it
    • It will start downloading the files it requires for the scan (Note: It may take a couple of minutes)
    • Once the scan is completed, please hit the notepad icon next to the text Export to:
    • Save it to a convenient location such as your Desktop
    • Post the contents of the ActiveScan.txt in your next reply.
  • HSA-SUCKSHSA-SUCKS
    edited October 2008
    Hey Chiaz,

    I deleted the two 016 items. I am running the panda scan right now.

    Outta curiosity, I thought the two items were associated with NBC's online video player -needed to watch shows/episodes...?

    I'll post the activescan.txt in a coupla minutes
  • chiazchiaz
    edited October 2008
    The 016 items are ActiveX items. There is a database on 016 entries. Since it does not contain those two entries, I had you remove it. This does not mean that it is necessarily malicious in nature. If need be, you can simply re-download the ActiveX controls when you run the website again.

    I hope that clears things up, it's good to ask questions when in doubt. :)
  • HSA-SUCKSHSA-SUCKS
    edited October 2008
    Well honestly I try to keep my computer slim and trim. So I'm down with getting rid of those seldomly used items. Pandascan is still running....only at 18%...might have to go to sleep and post the .txt in the morning.

    good looking out.
  • chiazchiaz
    edited October 2008
    Ok, just post the log whenever you are ready. :)
  • HSA-SUCKSHSA-SUCKS
    edited October 2008
    ;***********************************************************************************************************************************************************************************
    ANALYSIS: 2008-10-08 08:03:59
    PROTECTIONS: 1
    MALWARE: 6
    SUSPECTS: 0
    ;***********************************************************************************************************************************************************************************
    PROTECTIONS
    Description Version Active Updated
    ;===================================================================================================================================================================================
    avast! antivirus 4.8.1229 [VPS 081007-0] 4.8.1229 Yes Yes
    ;===================================================================================================================================================================================
    MALWARE
    Id Description Type Active Severity Disinfectable Disinfected Location
    ;===================================================================================================================================================================================
    00399682 Trj/DNSChanger.AKX Virus/Trojan No 0 Yes No C:\WINNT\system32\tdssserf1.dll
    00399899 Adware/SpywareNo Adware No 0 Yes No C:\QooBox\Quarantine\C\Program Files\MicroAV\MicroAV.exe.vir
    00399899 Adware/SpywareNo Adware No 0 Yes No C:\System Volume Information\_restore{F993C8B0-21AD-4539-B7AC-1BD38EBC4A35}\RP147\A0030995.exe
    00402019 Adware/MicroAntivirus2009 Adware No 1 Yes No C:\System Volume Information\_restore{F993C8B0-21AD-4539-B7AC-1BD38EBC4A35}\RP147\A0030994.cpl
    00402019 Adware/MicroAntivirus2009 Adware No 1 Yes No C:\QooBox\Quarantine\C\Program Files\MicroAV\MicroAV.cpl.vir
    01185375 Application/Psexec.A HackTools No 0 Yes No C:\System Volume Information\_restore{F993C8B0-21AD-4539-B7AC-1BD38EBC4A35}\RP147\A0031094.EXE
    02885963 Rootkit/Booto.C Virus/Worm No 0 Yes No C:\System Volume Information\_restore{F993C8B0-21AD-4539-B7AC-1BD38EBC4A35}\RP147\A0031003.sys
    03738686 Generic Malware Virus/Trojan No 0 No No C:\Documents and Settings\Raul\Desktop\ComboFix.exe[32788R22FWJFW\catchme.cfexe]
    ;===================================================================================================================================================================================
    SUSPECTS
    Sent Location -
    ;===================================================================================================================================================================================
    ;===================================================================================================================================================================================
    VULNERABILITIES
    Id Severity Description -
    ;===================================================================================================================================================================================
    182048 HIGH MS07-069 -
    176382 HIGH MS07-057 -
    170911 HIGH MS07-050 -
    170907 HIGH MS07-046 -
    170906 HIGH MS07-045 -
    170904 HIGH MS07-043 -
    164915 HIGH MS07-035 -
    164913 HIGH MS07-033 -
    164911 HIGH MS07-031 -
    160623 HIGH MS07-027 -
    157262 HIGH MS07-022 -
    157261 HIGH MS07-021 -
    157260 HIGH MS07-020 -
    157259 HIGH MS07-019 -
    156477 HIGH MS07-017 -
    150253 HIGH MS07-016 -
    150249 HIGH MS07-013 -
    150248 HIGH MS07-012 -
    150247 HIGH MS07-011 -
    150243 HIGH MS07-008 -
    150242 HIGH MS07-007 -
    150241 MEDIUM MS07-006 -
    145501 HIGH MS07-004 -
    141034 HIGH MS06-076 -
    141033 MEDIUM MS06-075 -
    137571 HIGH MS06-070 -
    133387 MEDIUM MS06-065 -
    133386 MEDIUM MS06-064 -
    133385 MEDIUM MS06-063 -
    133379 HIGH MS06-057 -
    129977 MEDIUM MS06-053 -
    129976 MEDIUM MS06-052 -
    126093 HIGH MS06-051 -
    126092 MEDIUM MS06-050 -
    126087 HIGH MS06-046 -
    126082 HIGH MS06-041 -
    126081 HIGH MS06-040 -
    123421 HIGH MS06-036 -
    123420 HIGH MS06-035 -
    104237 HIGH MS06-001 -
    96574 HIGH MS05-053 -
    ;===================================================================================================================================================================================
  • chiazchiaz
    edited October 2008
    Download The Avenger by Swandog46, and save it to your Desktop.
    • Extract avenger.exe from the Zip file and save it to your Desktop.
    • Run avenger.exe by double-clicking on it.
    • The Do not change any check box options!!
    • Copy everything in the Quote box below, and paste it into the Input script here: part of the window:
      Files to delete:
      C:\WINNT\system32\tdssserf1.dll
    • Now click the Execute button.
    • Click Yes to the prompt to confirm you want to execute.
    • Click Yes to the Reboot now? question that will appear when Avenger finishes running.
    • Your PC should reboot, if not, reboot it yourself.
    • A log file from Avenger will be produced at C:\avenger.txt and it will popup for you to view when you login after reboot.
    • Please post the contents of this logfile later.



    Next, this will clear away any of the files and folders that were created by ComboFix.

    Go to :
    Start > Run then copy and paste the following highlighted text below into the box and click OK.



    ComboFix /u

    CF_Cleanup.png



    Now, flush System Restore by following the instructions here:
    http://safecomputing.umn.edu/guides/systemrestore.html




    Post a new Panda ActiveScan log. Also let me know how your PC is running now. :)
  • HSA-SUCKSHSA-SUCKS
    edited October 2008
    I was unable to execute the script. After I copied and pasted it into the Avenger "input script here" box and clicked yes on the "confirm" pop up dialog box, a second pop up dialog box appeared, it reads: "Error: Invalid script. A valid script must begin with a command directive. Aborting execution!"
  • chiazchiaz
    edited October 2008
    Did you include the "Files to delete" in the script?

    This is a common error committed.
  • HSA-SUCKSHSA-SUCKS
    edited October 2008
    lol. my bad. sorry will do that again.
  • HSA-SUCKSHSA-SUCKS
    edited October 2008
    [//////////////////////////////////////////
    Avenger Pre-Processor log
    //////////////////////////////////////////

    Platform: Windows XP (build 2600, Service Pack 2)
    Thu Oct 09 08:26:02 2008

    08:26:02: Error: Invalid script. A valid script must begin with a command directive.
    Aborting execution!


    //////////////////////////////////////////


    //////////////////////////////////////////
    Avenger Pre-Processor log
    //////////////////////////////////////////

    Platform: Windows XP (build 2600, Service Pack 2)
    Thu Oct 09 08:30:45 2008

    08:30:45: Error: Invalid script. A valid script must begin with a command directive.
    Aborting execution!


    //////////////////////////////////////////


    Logfile of The Avenger Version 2.0, (c) by Swandog46
    http://swandog46.geekstogo.com

    Platform: Windows XP

    *******************

    Script file opened successfully.
    Script file read successfully.

    Backups directory opened successfully at C:\Avenger

    *******************

    Beginning to process script file:

    Rootkit scan active.
    No rootkits found!

    File "C:\WINNT\system32\tdssserf1.dll" deleted successfully.

    Completed script processing.

    *******************

    Finished! Terminate.
  • HSA-SUCKSHSA-SUCKS
    edited October 2008
    Panda Scan Log:


    ;***********************************************************************************************************************************************************************************
    ANALYSIS: 2008-10-09 21:47:38
    PROTECTIONS: 1
    MALWARE: 0
    SUSPECTS: 0
    ;***********************************************************************************************************************************************************************************
    PROTECTIONS
    Description Version Active Updated
    ;===================================================================================================================================================================================
    avast! antivirus 4.8.1229 [VPS 081009-1] 4.8.1229 Yes Yes
    ;===================================================================================================================================================================================
    MALWARE
    Id Description Type Active Severity Disinfectable Disinfected Location
    ;===================================================================================================================================================================================
    ;===================================================================================================================================================================================
    SUSPECTS
    Sent Location
    ;===================================================================================================================================================================================
    ;===================================================================================================================================================================================
    VULNERABILITIES
    Id Severity Description
    ;===================================================================================================================================================================================
    182048 HIGH MS07-069
    176382 HIGH MS07-057
    170911 HIGH MS07-050
    170907 HIGH MS07-046
    170906 HIGH MS07-045
    170904 HIGH MS07-043
    164915 HIGH MS07-035
    164913 HIGH MS07-033
    164911 HIGH MS07-031
    160623 HIGH MS07-027
    157262 HIGH MS07-022
    157261 HIGH MS07-021
    157260 HIGH MS07-020
    157259 HIGH MS07-019
    156477 HIGH MS07-017
    150253 HIGH MS07-016
    150249 HIGH MS07-013
    150248 HIGH MS07-012
    150247 HIGH MS07-011
    150243 HIGH MS07-008
    150242 HIGH MS07-007
    150241 MEDIUM MS07-006
    145501 HIGH MS07-004
    141034 HIGH MS06-076
    141033 MEDIUM MS06-075
    137571 HIGH MS06-070
    133387 MEDIUM MS06-065
    133386 MEDIUM MS06-064
    133385 MEDIUM MS06-063
    133379 HIGH MS06-057
    129977 MEDIUM MS06-053
    129976 MEDIUM MS06-052
    126093 HIGH MS06-051
    126092 MEDIUM MS06-050
    126087 HIGH MS06-046
    126082 HIGH MS06-041
    126081 HIGH MS06-040
    123421 HIGH MS06-036
    123420 HIGH MS06-035
    104237 HIGH MS06-001
    96574 HIGH MS05-053
    ;===================================================================================================================================================================================
  • HSA-SUCKSHSA-SUCKS
    edited October 2008
    My comp does seem to be performing better.
  • chiazchiaz
    edited October 2008
    Looks good to me as well.

    Glad we could be of assistance! The help you received here was free.

    This topic is now closed. If you wish it reopened, please send a Private Message to Trogan with a link to your thread.

    If you are not the user who started this thread, you must start your own Thread instead :)
    _______________________________
    Have we helped you with any issues you have had with your PCs or other items? If so, you can now help us by Joining Team 93 and fold for a cure.
Sign In or Register to comment.