CastleCops® Trojan-Clicker Hijack this log

Need help? Click here to register for free! Absolutely zero advertisements on this site!

**$9736.22 of $21422.68**

Help CastleCops serve the community on new servers, Donate Here to reach our goal.

	Donation/Premium

	Donations. Become Premium Today!

	Security Central

	· Home · PIRT/Fried Phish · MIRT · SIRT · Deutsch · Wiki · Newsletter · O16/ActiveX · CLSID List · Contest2007 · Downloads · Feedback (send) · Forums · HijackThis · Hijacktrend · LSPs · My Downloads · O18 · O20 · O21 · O22 · O23 · O9 · Premium · Private Messages · Proxomitron · Reviews · Search · StartupList · Stories Archive · Submit News · WsIRT · Your Account · Acceptable Use Policy

Survey

Forum FAQ

Usergroups

Profile

Select FavForums

[IN PROGRESS]Trojan-Clicker Hijack this log
Goto page 1, 2 Next

All -> FavForums -> Trend Micro HijackThis Logs

[del.icio.us!] [digg it!] [reddit!]

View previous topic :: View next topic

Author

Message

Pccamper

Trooper
Trooper

Joined: May 14, 2008
Posts: 12
Location: Uk

Posted: Thu May 15, 2008 9:24 pm Post subject: Trojan-Clicker Hijack this log

My zone alarm suit has detected Trojan-Clicker.win32.Agent.adg but have tried a number of way but can't remove it. Please help detect issues using Hijack my log file. Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 22:48:47, on 13/05/2008 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: H:\WINDOWS\System32\smss.exe H:\WINDOWS\system32\winlogon.exe H:\WINDOWS\system32\services.exe H:\WINDOWS\system32\lsass.exe H:\WINDOWS\system32\svchost.exe H:\WINDOWS\System32\svchost.exe H:\WINDOWS\system32\ZoneLabs\vsmon.exe H:\Program Files\CheckPoint\ZAForceField\IswSvc.exe H:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe H:\WINDOWS\system32\CTsvcCDA.exe H:\WINDOWS\eHome\ehRecvr.exe H:\WINDOWS\eHome\ehSched.exe H:\WINDOWS\system32\nvsvc32.exe H:\WINDOWS\system32\svchost.exe H:\WINDOWS\system32\dllhost.exe H:\WINDOWS\Explorer.EXE H:\WINDOWS\ehome\ehtray.exe H:\WINDOWS\eHome\ehmsas.exe H:\WINDOWS\stsystra.exe H:\Program Files\Java\jre1.6.0_03\bin\jusched.exe H:\WINDOWS\system32\dla\tfswctrl.exe H:\Program Files\Common Files\InstallShield\UpdateService\issch.exe H:\Program Files\CheckPoint\ZAForceField\ForceField.exe H:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe H:\Program Files\Creative\VoiceCenter\AndreaVC.exe H:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe H:\WINDOWS\system32\Rundll32.exe H:\DOCUME~1\***\LOCALS~1\Temp\clclean.0001 H:\Program Files\CheckPoint\ZAForceField\ISWMGR.exe H:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe H:\Program Files\CheckPoint\ZAForceField\ISWMGR.exe H:\WINDOWS\system32\ctfmon.exe H:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe H:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe H:\Program Files\FinePixViewer\QuickDCF.exe H:\Program Files\PC Connectivity Solution\ServiceLayer.exe H:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe H:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe H:\WINDOWS\System32\svchost.exe H:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe H:\Program Files\Internet Explorer\iexplore.exe H:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe H:\WINDOWS\system32\spoolsv.exe H:\Program Files\Trend Micro\HijackThis\HijackThis.exe H:\WINDOWS\system32\notepad.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ O1 - Hosts file is located at: H:\WINDOWS\System32\drivers\etc\hosts O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - H:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - H:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - H:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: ForceField Toolbar Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - H:\Program Files\CheckPoint\ZAForceField\TrustChecker\Components\TrustCheckerIEPlugin.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - H:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - h:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - H:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - H:\Program Files\Windows Live Toolbar\msntb.dll O2 - BHO: (no name) - {C02026CB-8BD4-4A9B-B9E1-606F9E76BE35} - h:\windows\system32\comaddinn.dll O2 - BHO: (no name) - {C96CF488-A4E3-4E46-A301-0C878DC192F1} - H:\WINDOWS\system32\avicapn.dll (file missing) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - h:\program files\google\googletoolbar2.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - H:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: ForceField Toolbar - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - H:\Program Files\CheckPoint\ZAForceField\TrustChecker\Components\TrustCheckerIEPlugin.dll O4 - HKLM\..\Run: [ehTray] H:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "H:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE H:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "H:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [dla] H:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [ISUSPM Startup] H:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "H:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [DVDLauncher] "H:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [REGSHAVE] H:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN O4 - HKLM\..\Run: [VoiceCenter] "H:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray O4 - HKLM\..\Run: [CTSysVol] H:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon O4 - HKLM\..\Run: [UpdReg] H:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [vis490huy3vb] H:\WINDOWS\system32\vis490huy3vb.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "H:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [ZoneAlarm Client] "H:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [ISW] "H:\Program Files\CheckPoint\ZAForceField\ForceField.exe" /start_mode="auto" O4 - HKCU\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] H:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe O4 - HKCU\..\Run: [vis490huy3vb] H:\WINDOWS\system32\vis490huy3vb.exe O4 - HKCU\..\Run: [PC Suite Tray] "H:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-21-1275210071-1960408961-725345543-1004\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\ctfmon.exe (User '***') O4 - HKUS\S-1-5-21-1275210071-1960408961-725345543-1004\..\Run: [vis490huy3vb] H:\WINDOWS\system32\vis490huy3vb.exe (User '********') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Exif Launcher.lnk = H:\Program Files\FinePixViewer\QuickDCF.exe O4 - Global Startup: Microsoft Office.lnk = H:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &Windows Live Search - res://H:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx O8 - Extra context menu item: E&xport to Microsoft Excel - res://H:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Open in new background tab - res://H:\Program Files\Windows Live Toolbar\Components\en-gb\msntabres.dll.mui/229?29bbac2cfd474f89b512753e76944392 O8 - Extra context menu item: Open in new foreground tab - res://H:\Program Files\Windows Live Toolbar\Components\en-gb\msntabres.dll.mui/230?29bbac2cfd474f89b512753e76944392 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: H:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O15 - Trusted Zone: http://webmail.tiscali.co.uk O15 - Trusted Zone: http://download.zonealarm.com O16 - DPF: {164B406B-0FD6-4E7F-BA7E-64D227D4CA37} (dnlplayer Class) - http://www.digitalwebbooks.com/reader/dbplugin.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O20 - Winlogon Notify: !SASWinLogon - H:\Program Files\SUPERAntiSpyware\SASWINLO.dll O20 - Winlogon Notify: dtnjnzyb - comaddinn.dll (file missing) O23 - Service: Creative Labs Licensing Service - Creative Labs - H:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - H:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: Google Updater Service (gusvc) - Google - H:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: ForceField IswSvc (IswSvc) - Check Point Software Technologies - H:\Program Files\CheckPoint\ZAForceField\IswSvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - H:\WINDOWS\system32\nvsvc32.exe O23 - Service: ServiceLayer - Nokia. - H:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: SolidWorks Licensing Service - SolidWorks - H:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - H:\WINDOWS\system32\ZoneLabs\vsmon.exe -- End of file - 9670 bytes

Prince_Serendip

Site Moderator

Joined: Sep 07, 2002
Posts: 17437

Posted: Fri May 16, 2008 2:42 pm Post subject:

You're Ready for cleaning. At CastleCops we screen all HijackThis logs for errors, out-of-date versions, unupdated operating systems, omissions and P2P applications; getting you [READY] for cleaning by our 1st Responders and Security Experts. Now you wait for one of them to come help you. _________________ Microsoft MVP Consumer Security 2006, 2007 & 2008

Pccamper

Trooper
Trooper

Joined: May 14, 2008
Posts: 12
Location: Uk

Posted: Fri May 16, 2008 9:08 pm Post subject:

Prince_Serendip Ref getting ready for cleaningI completed a search on my PC for psp and found the following: psp.dll Folder window system 32 pspgasvc.dll Folder window system 32 pspgraph.dll Folder window system 32 pspnetsh..dll Folder window system 32 p2psvc.dll Folder window system 32 stp2port Folder window Driver cash 386 psp.dll Folder software distribution download pspgasvc.dll Folder software distribution download pspgraph.dll Folder software distribution download pspnetsh..dll Folder software distribution download p2psvc.dll Folder software distribution download stp2port Folder window Driver cash 386 p2p Folder software distribution download Please advise further.

sjpritch25

1st Responder
Premium Member

Joined: Mar 31, 2005
Posts: 5156
Location: West Coast of Florida, USA

Posted: Tue May 20, 2008 4:54 am Post subject:

Welcome to Castlecops!!!! Sorry for the delay If you still require help, please post a fresh Hijackthis log. Thanks. _________________ Microsoft Valuable Professional--Consumer Security 2007-2009 http://geekfox26.blogspot.com/

Pccamper

Trooper
Trooper

Joined: May 14, 2008
Posts: 12
Location: Uk

Posted: Tue May 20, 2008 8:28 pm Post subject: Trojan-Clicker log file

Hi sjpritch25 I post new log, just updated and scaned my system using SUPERantispyware and it seem to have quarantined the virus, file name win32/ comaddinn.dll virus name Trojan-Clicker.win32.Agent.adg Now running my Zonealarm to check if it finds it. Please can you check my log as I want to be sure i'm not being monitored by the any trojan clicker. Thanks PCcamper Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 20:52:53, on 20/05/2008 Platform: Windows XP SP3 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP3 (6.00.2900.2180) Boot mode: Normal Running processes: H:\WINDOWS\System32\smss.exe H:\WINDOWS\system32\csrss.exe H:\WINDOWS\system32\winlogon.exe H:\WINDOWS\system32\services.exe H:\WINDOWS\system32\lsass.exe H:\WINDOWS\system32\svchost.exe H:\WINDOWS\system32\svchost.exe H:\WINDOWS\System32\svchost.exe H:\WINDOWS\system32\svchost.exe H:\WINDOWS\system32\svchost.exe H:\WINDOWS\system32\ZoneLabs\vsmon.exe H:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe H:\Program Files\CheckPoint\ZAForceField\IswSvc.exe H:\WINDOWS\system32\spoolsv.exe H:\WINDOWS\system32\ZoneLabs\avsys\ScanningProcess.exe H:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe H:\WINDOWS\system32\CTsvcCDA.exe H:\WINDOWS\eHome\ehRecvr.exe H:\WINDOWS\eHome\ehSched.exe H:\WINDOWS\system32\svchost.exe H:\WINDOWS\system32\svchost.exe H:\WINDOWS\ehome\mcrdsvc.exe H:\WINDOWS\system32\dllhost.exe H:\WINDOWS\System32\alg.exe H:\WINDOWS\Explorer.EXE H:\WINDOWS\ehome\ehtray.exe H:\WINDOWS\eHome\ehmsas.exe H:\WINDOWS\stsystra.exe H:\Program Files\Java\jre1.6.0_03\bin\jusched.exe H:\WINDOWS\system32\dla\tfswctrl.exe H:\Program Files\Common Files\InstallShield\UpdateService\issch.exe H:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe H:\Program Files\Creative\VoiceCenter\AndreaVC.exe H:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe H:\WINDOWS\system32\Rundll32.exe H:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe H:\Program Files\CheckPoint\ZAForceField\ForceField.exe H:\WINDOWS\system32\ctfmon.exe H:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe H:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe H:\DOCUME~1\****\LOCALS~1\Temp\clclean.0001 H:\Program Files\FinePixViewer\QuickDCF.exe H:\Program Files\PC Connectivity Solution\ServiceLayer.exe H:\Program Files\CheckPoint\ZAForceField\ISWMGR.exe H:\Program Files\CheckPoint\ZAForceField\ISWMGR.exe H:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe H:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe H:\Program Files\Internet Explorer\iexplore.exe H:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe H:\Program Files\Internet Explorer\iexplore.exe H:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe H:\Program Files\Trend Micro\HijackThis\HijackThis.exe H:\WINDOWS\system32\wbem\wmiprvse.exe R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/ O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - H:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - H:\WINDOWS\system32\dla\tfswshx.dll O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - H:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file) O2 - BHO: ForceField Toolbar Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - H:\Program Files\CheckPoint\ZAForceField\TrustChecker\Components\TrustCheckerIEPlugin.dll O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - H:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - h:\program files\google\googletoolbar2.dll O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - H:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - H:\Program Files\Windows Live Toolbar\msntb.dll O2 - BHO: (no name) - {C02026CB-8BD4-4A9B-B9E1-606F9E76BE35} - h:\windows\system32\comaddinn.dll O2 - BHO: (no name) - {C96CF488-A4E3-4E46-A301-0C878DC192F1} - H:\WINDOWS\system32\avicapn.dll (file missing) O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - h:\program files\google\googletoolbar2.dll O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - H:\Program Files\Windows Live Toolbar\msntb.dll O3 - Toolbar: ForceField Toolbar - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - H:\Program Files\CheckPoint\ZAForceField\TrustChecker\Components\TrustCheckerIEPlugin.dll O4 - HKLM\..\Run: [ehTray] H:\WINDOWS\ehome\ehtray.exe O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "H:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE H:\WINDOWS\system32\NvCpl.dll,NvStartup O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe O4 - HKLM\..\Run: [SunJavaUpdateSched] "H:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" O4 - HKLM\..\Run: [dla] H:\WINDOWS\system32\dla\tfswctrl.exe O4 - HKLM\..\Run: [ISUSPM Startup] H:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup O4 - HKLM\..\Run: [ISUSScheduler] "H:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start O4 - HKLM\..\Run: [DVDLauncher] "H:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" O4 - HKLM\..\Run: [REGSHAVE] H:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN O4 - HKLM\..\Run: [VoiceCenter] "H:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray O4 - HKLM\..\Run: [CTSysVol] H:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon O4 - HKLM\..\Run: [UpdReg] H:\WINDOWS\UpdReg.EXE O4 - HKLM\..\Run: [vis490huy3vb] H:\WINDOWS\system32\vis490huy3vb.exe O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "H:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [ZoneAlarm Client] "H:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" O4 - HKLM\..\Run: [ISW] "H:\Program Files\CheckPoint\ZAForceField\ForceField.exe" /start_mode="auto" O4 - HKCU\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [swg] H:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe O4 - HKCU\..\Run: [vis490huy3vb] H:\WINDOWS\system32\vis490huy3vb.exe O4 - HKCU\..\Run: [PC Suite Tray] "H:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Global Startup: Exif Launcher.lnk = H:\Program Files\FinePixViewer\QuickDCF.exe O4 - Global Startup: Microsoft Office.lnk = H:\Program Files\Microsoft Office\Office10\OSA.EXE O8 - Extra context menu item: &Windows Live Search - res://H:\Program Files\Windows Live Toolbar\msntb.dll/search.htm O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx O8 - Extra context menu item: E&xport to Microsoft Excel - res://H:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000 O8 - Extra context menu item: Open in new background tab - res://H:\Program Files\Windows Live Toolbar\Components\en-gb\msntabres.dll.mui/229?29bbac2cfd474f89b512753e76944392 O8 - Extra context menu item: Open in new foreground tab - res://H:\Program Files\Windows Live Toolbar\Components\en-gb\msntabres.dll.mui/230?29bbac2cfd474f89b512753e76944392 O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Program Files\Java\jre1.6.0_03\bin\ssv.dll O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe O12 - Plugin for .spop: H:\Program Files\Internet Explorer\Plugins\NPDocBox.dll O15 - Trusted Zone: http://webmail.tiscali.co.uk O15 - Trusted Zone: http://download.zonealarm.com O16 - DPF: {164B406B-0FD6-4E7F-BA7E-64D227D4CA37} (dnlplayer Class) - http://www.digitalwebbooks.com/reader/dbplugin.cab O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204 O20 - Winlogon Notify: !SASWinLogon - H:\Program Files\SUPERAntiSpyware\SASWINLO.dll O20 - Winlogon Notify: dtnjnzyb - H:\WINDOWS\SYSTEM32\comaddinn.dll O23 - Service: Creative Labs Licensing Service - Creative Labs - H:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - H:\WINDOWS\system32\CTsvcCDA.exe O23 - Service: Google Updater Service (gusvc) - Google - H:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe O23 - Service: ForceField IswSvc (IswSvc) - Check Point Software Technologies - H:\Program Files\CheckPoint\ZAForceField\IswSvc.exe O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - H:\WINDOWS\system32\nvsvc32.exe O23 - Service: ServiceLayer - Nokia. - H:\Program Files\PC Connectivity Solution\ServiceLayer.exe O23 - Service: SolidWorks Licensing Service - SolidWorks - H:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - H:\WINDOWS\system32\ZoneLabs\vsmon.exe

sjpritch25

1st Responder
Premium Member

Joined: Mar 31, 2005
Posts: 5156
Location: West Coast of Florida, USA

Posted: Wed May 21, 2008 9:57 pm Post subject:

Nope, it wasn't successful against your infection. You have a delf trojan infection. Do you do any online banking on this PC?? I only ask because sometimes this infection will steal passwords and stuff.

Download Combofix from any of the links below, and save it to your desktop. For information regarding this download, please visit this webpage: http://www.bleepingcomputer.com/combofix/how-to-use-combofix

Link 1
Link 2
Link 3

**Note: It is important that it is saved directly to your desktop**

--------------------------------------------------------------------

1. Close any open browsers.

2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.

--------------------------------------------------------------------

Double click on combofix.exe & follow the prompts.

Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.

Note:
Do not mouseclick combofix's window while it's running. That may cause it to stall

_________________
Microsoft Valuable Professional--Consumer Security 2007-2009

http://geekfox26.blogspot.com/

Pccamper

Trooper
Trooper

Joined: May 14, 2008
Posts: 12
Location: Uk

Posted: Wed May 28, 2008 2:06 pm Post subject: Combofix Log

Hi sjpritch25
I carried out the combofix and post my log but not sure if it actualy ran correctly, have the following error come up on screen during the process
Error loading CTMBHA.DLL
Invalid access to mermory location.

Hijack my log pasted in.
Combofix log attached

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:42:49, on 28/05/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.5730.0013)
Boot mode: Normal

Running processes:
H:\WINDOWS\System32\smss.exe
H:\WINDOWS\system32\winlogon.exe
H:\WINDOWS\system32\services.exe
H:\WINDOWS\system32\lsass.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\System32\svchost.exe
H:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
H:\WINDOWS\system32\spoolsv.exe
H:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
H:\WINDOWS\system32\CTsvcCDA.exe
H:\WINDOWS\eHome\ehRecvr.exe
H:\WINDOWS\eHome\ehSched.exe
H:\WINDOWS\system32\nvsvc32.exe
H:\WINDOWS\system32\svchost.exe
H:\WINDOWS\system32\dllhost.exe
H:\WINDOWS\ehome\ehtray.exe
H:\WINDOWS\eHome\ehmsas.exe
H:\WINDOWS\stsystra.exe
H:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
H:\WINDOWS\system32\dla\tfswctrl.exe
H:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
H:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
H:\Program Files\Creative\VoiceCenter\AndreaVC.exe
H:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
H:\WINDOWS\system32\ctfmon.exe
H:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
H:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe
H:\Program Files\FinePixViewer\QuickDCF.exe
H:\Program Files\PC Connectivity Solution\ServiceLayer.exe
H:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
H:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
H:\WINDOWS\explorer.exe
H:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
H:\WINDOWS\system32\ZoneLabs\vsmon.exe
H:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
H:\Program Files\CheckPoint\ZAForceField\ForceField.exe
H:\Program Files\CheckPoint\ZAForceField\ISWMGR.exe
H:\Program Files\CheckPoint\ZAForceField\ISWMGR.exe
H:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
H:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
H:\Program Files\Internet Explorer\iexplore.exe
H:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - H:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - H:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - H:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: ForceField Toolbar Registrar - {8A4A36C2-0535-4D2C-BD3D-496CB7EED6E3} - H:\Program Files\CheckPoint\ZAForceField\TrustChecker\Components\TrustCheckerIEPlugin.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - H:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - H:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - H:\Program Files\Windows Live Toolbar\msntb.dll
O2 - BHO: (no name) - {C02026CB-8BD4-4A9B-B9E1-606F9E76BE35} - h:\windows\system32\comaddinn.dll
O2 - BHO: (no name) - {C96CF488-A4E3-4E46-A301-0C878DC192F1} - H:\WINDOWS\system32\avicapn.dll (file missing)
O3 - Toolbar: (no name) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - (no file)
O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - H:\Program Files\Windows Live Toolbar\msntb.dll
O3 - Toolbar: ForceField Toolbar - {EE2AC4E5-B0B0-4EC6-88A9-BCA1A32AB107} - H:\Program Files\CheckPoint\ZAForceField\TrustChecker\Components\TrustCheckerIEPlugin.dll
O4 - HKLM\..\Run: [ehTray] H:\WINDOWS\ehome\ehtray.exe
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "H:\Program Files\Thomson\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE H:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "H:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [dla] H:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ISUSPM Startup] H:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
O4 - HKLM\..\Run: [ISUSScheduler] "H:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [DVDLauncher] "H:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
O4 - HKLM\..\Run: [REGSHAVE] H:\Program Files\REGSHAVE\REGSHAVE.EXE /AUTORUN
O4 - HKLM\..\Run: [VoiceCenter] "H:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray
O4 - HKLM\..\Run: [CTSysVol] H:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
O4 - HKLM\..\Run: [UpdReg] H:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [vis490huy3vb] H:\WINDOWS\system32\vis490huy3vb.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "H:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [ZoneAlarm Client] "H:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe"
O4 - HKLM\..\Run: [ISW] "H:\Program Files\CheckPoint\ZAForceField\ForceField.exe" /start_mode="auto"
O4 - HKCU\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] H:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
O4 - HKCU\..\Run: [vis490huy3vb] H:\WINDOWS\system32\vis490huy3vb.exe
O4 - HKCU\..\Run: [PC Suite Tray] "H:\Program Files\Nokia\Nokia PC Suite 6\PCSuite.exe" -onlytray
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] H:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Exif Launcher.lnk = H:\Program Files\FinePixViewer\QuickDCF.exe
O4 - Global Startup: Microsoft Office.lnk = H:\Program Files\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: &Windows Live Search - res://H:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
O8 - Extra context menu item: E&xport to Microsoft Excel - res://H:\PROGRA~1\MICROS~3\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Open in new background tab - res://H:\Program Files\Windows Live Toolbar\Components\en-gb\msntabres.dll.mui/229?29bbac2cfd474f89b512753e76944392
O8 - Extra context menu item: Open in new foreground tab - res://H:\Program Files\Windows Live Toolbar\Components\en-gb\msntabres.dll.mui/230?29bbac2cfd474f89b512753e76944392
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - H:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - H:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - H:\Program Files\Messenger\msmsgs.exe
O12 - Plugin for .spop: H:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
O15 - Trusted Zone: http://webmail.tiscali.co.uk
O15 - Trusted Zone: http://download.zonealarm.com
O16 - DPF: {164B406B-0FD6-4E7F-BA7E-64D227D4CA37} (dnlplayer Class) - http://www.digitalwebbooks.com/reader/dbplugin.cab
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O20 - Winlogon Notify: !SASWinLogon - H:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: dtnjnzyb - H:\WINDOWS\SYSTEM32\comaddinn.dll
O23 - Service: Creative Labs Licensing Service - Creative Labs - H:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - H:\WINDOWS\system32\CTsvcCDA.exe
O23 - Service: Google Updater Service (gusvc) - Google - H:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: ForceField IswSvc (IswSvc) - Check Point Software Technologies - H:\Program Files\CheckPoint\ZAForceField\IswSvc.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - H:\WINDOWS\system32\nvsvc32.exe
O23 - Service: ServiceLayer - Nokia. - H:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: SolidWorks Licensing Service - SolidWorks - H:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe
O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - H:\WINDOWS\system32\ZoneLabs\vsmon.exe

--
End of file - 9763 bytes

ComboFix.txt

Description:

Download

Filename:

ComboFix.txt

Filesize:

19.68 KB

Downloaded:

117 Time(s)

sjpritch25

1st Responder
Premium Member

Joined: Mar 31, 2005
Posts: 5156
Location: West Coast of Florida, USA

Posted: Mon Jun 02, 2008 11:21 pm Post subject:

Sorry for the delay

Open notepad and copy/paste the text in the quote box below into it:

Quote:

File::
H:\WINDOWS\system32\drivers\szcixzwg.sys
H:\WINDOWS\system32\comaddinn.dll
Driver::
szcixzwg
NetSvc::
cfkfjtdz
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C02026CB-8BD4-4A9B-B9E1-606F9E76BE35}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C96CF488-A4E3-4E46-A301-0C878DC192F1}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dtnjnzyb]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"vis490huy3vb"=-
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"vis490huy3vb"=-

Save this as CFScript.txt

Referring to the picture above, drag CFScript.txt into ComboFix.exe

When finished, it shall produce a log for you at "C:\ComboFix.txt". In your next reply, please include the ComboFix log and a fresh HIjackthis log.

Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall

Note:Please do not use this script on another computer, you may damage the system. The script is made especially for this computer only!!!!

_________________
Microsoft Valuable Professional--Consumer Security 2007-2009

http://geekfox26.blogspot.com/

Pccamper

Trooper
Trooper

Joined: May 14, 2008
Posts: 12
Location: Uk

Posted: Tue Jun 03, 2008 9:55 pm Post subject:

Hi sjpritch25

I carried out instruction as requested on your last message, please see attached.

Thanks,
Pccamper

hijackthislog.txt

Description:

Download

Filename:

hijackthislog.txt

Filesize:

8.84 KB

Downloaded:

16 Time(s)

combo fi log report.txt

Description:

Download

Filename:

combo fi log report.txt

Filesize:

18.75 KB

Downloaded:

107 Time(s)

sjpritch25

1st Responder
Premium Member

Joined: Mar 31, 2005
Posts: 5156
Location: West Coast of Florida, USA

Posted: Wed Jun 04, 2008 12:54 am Post subject:

Please download ATF Cleaner by Atribune.

This program is for XP, Windows 2000, and Vista

Double-click ATF-Cleaner.exe to run the program.
Under Main choose: Select All
Click the Empty Selected button.

If you use Firefox browser

Click Firefox at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click
No at the prompt.

If you use Opera browser

Click Opera at the top and choose: Select All
Click the Empty Selected button.
NOTE: If you would like to keep your saved passwords, please click No at the prompt.

Click Exit on the Main menu to close the program. For Technical Support, double-click the e-mail address located at the bottom of each menu.

==================================

Please download Malwarebytes Anti-Malware from Here or Here
Double Click mbam-setup.exe to install the application.

Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes Anti-Malware, then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform Quick Scan, then click Scan.
The scan may take some time to finish,so please be patient.
When the scan is complete, click OK, then Show Results to view the results.
Make sure that everything is checked, and click Remove Selected.
When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.(See Extra Note)
The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
Copy&Paste the entire report in your next reply.

Extra Note:

If MBAM encounters a file that is difficult to remove,you will be presented with 1 of 2 prompts,click OK to either and let MBAM proceed with the disinfection process,if asked to restart the computer, please do so immediately.

_________________
Microsoft Valuable Professional--Consumer Security 2007-2009

http://geekfox26.blogspot.com/

Pccamper

Trooper
Trooper

Joined: May 14, 2008
Posts: 12
Location: Uk

Posted: Wed Jun 04, 2008 8:36 pm Post subject:

Hi sjpritch25
Carried out what you suggested, logs attached.
Notice new Trojan name!!!!!!

Regards,
Pccamper

mbam-log-6-4-2008 (21-21-50).txt

Description:

Download

Filename:

mbam-log-6-4-2008 (21-21-50).txt

Filesize:

846 Bytes

Downloaded:

18 Time(s)

hijackthis2.txt

Description:

Download

Filename:

hijackthis2.txt

Filesize:

9.14 KB

Downloaded:

28 Time(s)

sjpritch25

1st Responder
Premium Member

Joined: Mar 31, 2005
Posts: 5156
Location: West Coast of Florida, USA

Posted: Wed Jun 04, 2008 9:05 pm Post subject:

Okay, you need to select Remove Selected and Malwarebytes will remove that backup file. How is everything running?? _________________ Microsoft Valuable Professional--Consumer Security 2007-2009 http://geekfox26.blogspot.com/

Pccamper

Trooper
Trooper

Joined: May 14, 2008
Posts: 12
Location: Uk

Posted: Sat Jun 07, 2008 7:25 am Post subject:

Hi sjpritch25 Removed trojan with Malwarebytes. Over the weekend going to run a deep scan, but it seems to be running fine thanks. Any other advice. Pccamper

sjpritch25

1st Responder
Premium Member

Joined: Mar 31, 2005
Posts: 5156
Location: West Coast of Florida, USA

Posted: Sat Jun 07, 2008 11:59 pm Post subject:

Please post a fresh HIjackthis log. _________________ Microsoft Valuable Professional--Consumer Security 2007-2009 http://geekfox26.blogspot.com/