Printable View
Both of my home desktops running XP PRO have just died in the past 24 hours. It started out being flakey yesterday. Dropping connection to my work every few minutes. Now I can still connect but I'm seeing 20 minute response. For example I wen to download one of those free internet optimizers and it said it was downloading at 300 bytes/sec. I've gone round and round with internet provider who says it looks fine from their end. Wher should I start? Maybe I picked up a virus?
Quote:
Originally Posted by winch
A nasty of some sort makes sense. SO, . . .
Pls post your hijackthis log in the hijackthis forum (unless instructed otherwise). It's right next door at this link..
http://discussions.virtualdr.com/for...?s=&forumid=71
Print these instructions out.
NOTE. If any of the programs listed below refuse to run, try renaming executive file to something else; for instance, rename hijackthis.exe to scanner.exe
1. Download SUPERAntiSpyware Free for Home Users:
http://www.superantispyware.com/
* Double-click SUPERAntiSpyware.exe and use the default settings for installation.
* An icon will be created on your desktop. Double-click that icon to launch the program.
* If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here: http://www.superantispyware.com/definitions.html.)
* Close SUPERAntiSpyware.
PHYSICALLY DISCONNECT FROM THE INTERNET
Restart computer in Safe Mode.
To enter Safe Mode, restart computer, and keep tapping F8 key, until menu appears; select Safe Mode; you'll see "Safe Mode" in all four corners of your screen
* Open SUPERAntiSpyware.
* Under Configuration and Preferences, click the Preferences button.
* Under [b]General and Startup" tab, make sure, Start SUPERAntiSpyware when Windows starts option is UN-checked.
* Click the Scanning Control tab.
* Under Scanner Options make sure the following are checked (leave all others unchecked):
- Close browsers before scanning.
- Scan for tracking cookies.
- Terminate memory threats before quarantining.
* Click the Close button to leave the control center screen.
* Back on the main screen, under Scan for Harmful Software click Scan your computer.
* On the left, make sure you check C:\Fixed Drive.
* On the right, under Complete Scan, choose Perform Complete Scan.
* Click Next to start the scan. Please be patient while it scans your computer.
* After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click OK.
* Make sure everything has a checkmark next to it and click Next.
* A notification will appear that Quarantine and Removal is Complete. Click OK and then click the Finish button to return to the main menu.
* If asked if you want to reboot, click Yes.
* To retrieve the removal information after reboot, launch SUPERAntispyware again.
- Click Preferences, then click the Statistics/Logs tab.
- Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
- If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
- Please copy and paste the Scan Log results in your next reply.
* Click Close to exit the program.
Post SUPERAntiSpyware log.
NOTE: Tracking cookies can be omitted from the log.
RECONNECT TO THE INTERNET
RESTART COMPUTER!
2. Download Malwarebytes' Anti-Malware: http://www.malwarebytes.org/mbam.php to your desktop.
(Malwarebytes is free to use as a manual scanner. Payment is only required if you wish to have it run and update automatically which is not necessary for our purposes)
* Double-click mbam-setup.exe and follow the prompts to install the program.
* At the end, be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform full scan, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad.
* Post the log back here.
The log can also be found here:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\log-date.txt
Or at C:\Program Files\Malwarebytes' Anti-Malware\Logs\log-date.txt
RESTART COMPUTER!
3. Download gmer.zip: http://www.gmer.net/files.php
Unzip the file, and double click on gmer.exe, select Rootkit tab and click the Scan button.
When scan is completed, click Save button, and save the results as gmer.log
Warning ! Please, do not select the "Show all" checkbox during the scan.
Post the log to your next reply.
RESTART COMPUTER
4. Download, install, and run HijackThis:
http://www.snapfiles.com/get/hijackthis.html
Post HijackThis log.
Do NOT attempt to "fix" anything!
DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!__________________
Above layout courtesy of Broni
I had to have my daughter download the anitvirus software and other files and burn a CD. Then I incorrectly ran a quick scan. It took 40 minutes and found 0 threats. Now I'm running the complete scan and it has been going for 10 hours and has detected 147. Any idea how long I can expect it to run? I have 2 HDs. C: is 60 gig and D: is 80 gig both are probably 80% full. D is almost entirely mp3s.
Also when I woke up this morning the screen was locked and I had to enter my password (normal screen saver thing). Was the scan process going all that time?
The bigger the drive and the more on it the longer it takes. :(
That is just the nature of the critter. :(
My 1.1 GB of hdds takes even longer.
It's looking like the problem was my cable modem. I just bought a new one and I'm real fast again. I only have thi smachine on it so far but I'll hook up the VOIP modem and router next. I'm also in the process of running Malware so I'll update with the results of that when it finishes.
Here's the log from SuperAntiSpyware followed by the log from Malware:
SUPERAntiSpyware Scan Log
http://www.superantispyware.com
Generated 12/05/2009 at 06:51 PM
Application Version : 4.31.1000
Core Rules Database Version : 4304
Trace Rules Database Version: 2191
Scan type : Complete Scan
Total Scan Time : 20:00:43
Memory items scanned : 216
Memory threats detected : 0
Registry items scanned : 6021
Registry threats detected : 1
File items scanned : 132921
File threats detected : 146
Adware.WinSrc
HKU\S-1-5-21-839522115-1482476501-725345543-1003\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{037C7B8A-151A-49E6-BAED-CC05FCB50328}
Adware.Tracking Cookie
D:\Documents and Settings\Ken Winchester\Cookies\[email protected][1].txt
D:\Documents and Settings\Ken Winchester\Cookies\[email protected][2].txt
D:\Documents and Settings\Ken Winchester\Cookies\[email protected][2].txt
D:\Documents and Settings\Ken Winchester\Cookies\ken_winchester@247realmedia[1].txt
D:\Documents and Settings\Ken Winchester\Cookies\ken_winchester@tacoda[1].txt
D:\Documents and Settings\Ken Winchester\Cookies\ken_winchester@doubleclick[1].txt
D:\Documents and Settings\Ken Winchester\Cookies\ken_winchester@revsci[2].txt
D:\Documents and Settings\Ken Winchester\Cookies\[email protected][2].txt
D:\Documents and Settings\Ken Winchester\Cookies\ken_winchester@advertising[2].txt
D:\Documents and Settings\Ken Winchester\Cookies\ken_winchester@serving-sys[1].txt
D:\Documents and Settings\Ken Winchester\Cookies\ken_winchester@atdmt[1].txt
D:\Documents and Settings\Ken Winchester\Cookies\ken_winchester@zedo[2].txt
D:\Documents and Settings\Ken Winchester\Cookies\[email protected][1].txt
www.xxx69.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\v4b372xe.default\cookies.txt ]
www.xxx69.net [ C:\Documents and Settings\Administrator\Application Data\Mozilla\Firefox\Profiles\v4b372xe.default\cookies.txt ]
C:\Documents and Settings\Administrator\Cookies\administrator@advertising[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@doubleclick[1].txt
C:\Documents and Settings\Administrator\Cookies\[email protected][2].txt
C:\Documents and Settings\Administrator\Cookies\[email protected][2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@hitbox[2].txt
C:\Documents and Settings\Administrator\Cookies\administrator@mediaplex[1].txt
C:\Documents and Settings\Administrator\Cookies\administrator@questionmarket[2].txt
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@2o7[1].txt
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\[email protected][1].txt
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@advertising[2].txt
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@atdmt[2].txt
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@belnk[1].txt
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@burstnet[2].txt
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\[email protected][2].txt
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\[email protected][2].txt
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@doubleclick[1].txt
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\[email protected][2].txt
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\[email protected][2].txt
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@hitbox[2].txt
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@mediaplex[1].txt
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@overture[2].txt
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@realmedia[2].txt
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\[email protected][2].txt
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@statcounter[1].txt
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\[email protected][2].txt
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\administrator@tacoda[1].txt
C:\Documents and Settings\Administrator\Local Settings\Temp\Cookies\[email protected][2].txt
C:\Documents and Settings\Ken Winchester old\Cookies\ken winchester@atdmt[2].txt
C:\Documents and Settings\Ken Winchester old\Cookies\ken [email protected][1].txt
C:\Documents and Settings\Ken Winchester old\Cookies\ken winchester@hitbox[2].txt
C:\Documents and Settings\Ken Winchester old\Cookies\ken winchester@mediaplex[1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@247realmedia[1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@2o7[2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@accounts[1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@accounts[2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@adbrite[2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@adrevenue[1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@adrevolver[2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@adrevolver[3].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@advertising[2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@adviva[1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@apmebf[1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@atdmt[2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@atwola[2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@bluestreak[2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@burstnet[2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@casalemedia[2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@clickbank[1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@clicklab[1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@doubleclick[1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@fastclick[1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@hentaicounter[2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@hitbox[1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@insightexpressai[1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@kanoodle[1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@kontera[2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@maxserving[2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@mediaplex[2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@nextag[1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@overture[2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@partner2profit[1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@questionmarket[2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@realmedia[1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@rentclicks[1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@revenue[2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@revsci[1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@serving-sys[2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@statcounter[2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@superstats[1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@tacoda[2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@trafficmp[1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@tribalfusion[1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][2].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\[email protected][1].txt
C:\RECYCLER\S-1-5-21-776561741-1303643608-725345543-500\Dc71\Cookies\administrator@zedo[1].txt
D:\Documents and Settings\Ken Winchester\Cookies\[email protected][2].txt
D:\Documents and Settings\Ken Winchester\Cookies\[email protected][1].txt
D:\Documents and Settings\Ken Winchester\Cookies\[email protected][1].txt
D:\Documents and Settings\Ken Winchester\Cookies\[email protected][2].txt
D:\Documents and Settings\Ken Winchester\Cookies\ken_winchester@interclick[1].txt
D:\Documents and Settings\Ken Winchester\Cookies\[email protected][1].txt
D:\Documents and Settings\Ken Winchester\Cookies\[email protected][1].txt
D:\Documents and Settings\Ken Winchester\Cookies\ken_winchester@tribalfusion[2].txt
D:\Documents and Settings\Ken Winchester\Cookies\ken_winchester@zedo[1].txt
MALWARE:
Malwarebytes' Anti-Malware 1.42
Database version: 3303
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702
12/6/2009 12:40:01 PM
mbam-log-2009-12-06 (12-40-01).txt
Scan type: Full Scan (C:\|D:\|)
Objects scanned: 270520
Time elapsed: 3 hour(s), 42 minute(s), 57 second(s)
Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 1
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 1
Memory Processes Infected:
(No malicious items detected)
Memory Modules Infected:
(No malicious items detected)
Registry Keys Infected:
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{2d2bee6e-3c9a-4d58-b9ec-458edb28d0f6} (Rogue.DriveCleaner) -> Quarantined and deleted successfully.
Registry Values Infected:
(No malicious items detected)
Registry Data Items Infected:
(No malicious items detected)
Folders Infected:
(No malicious items detected)
Files Infected:
D:\System Volume Information\_restore{93AD659B-3261-411F-8880-F7310AE6EE54}\RP2\A0003067.exe (Trojan.Dropper) -> Quarantined and deleted successfully.
I just went to another website I use a lot - TV Guide and it took a really long time to load and free up the page to where I could scroll it up and down. I looked at task manager and iexplore.exe was running 98% of my CPU and even now 20 minutes later when I can finally scroll OK task mgr shows iexpler.exe is using 40% CPU. That doesn't sound right does it?
And aftre finally posting this thread it came back to a blank screen (just the banner across the top) and says done with errors on page. Sheesh
You need to post 2 more logs.
Do you mean the HiJackThis log and gmer.log? I posted those over on the link you put it the first reply over on HijAck log but I'll include them here:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:42:53 PM, on 12/6/2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal
Running processes:
D:\WINDOWS\System32\smss.exe
D:\WINDOWS\system32\winlogon.exe
D:\WINDOWS\system32\services.exe
D:\WINDOWS\system32\lsass.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\svchost.exe
D:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe
D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
D:\Program Files\Bonjour\mDNSResponder.exe
D:\Program Files\Juniper Networks\Common Files\dsNcService.exe
D:\Program Files\CA\eTrust Antivirus\InoRpc.exe
D:\Program Files\CA\eTrust Antivirus\InoRT.exe
D:\Program Files\CA\eTrust Antivirus\InoTask.exe
C:\Program Files\Java\jre6\bin\jqs.exe
D:\WINDOWS\System32\svchost.exe
D:\WINDOWS\system32\wuauclt.exe
D:\WINDOWS\Explorer.EXE
D:\PROGRA~1\CA\ETRUST~1\realmon.exe
D:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
D:\Program Files\Google\Gmail Notifier\gnotify.exe
D:\Program Files\Canon\MyPrinter\BJMyPrt.exe
D:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe
C:\Program Files\Winamp\winampa.exe
D:\WINDOWS\713xRMTMon.exe
C:\Program Files\Java\jre6\bin\jusched.exe
D:\Program Files\iTunes\iTunesHelper.exe
D:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
D:\WINDOWS\system32\tbctray.exe
D:\Program Files\Messenger\msmsgs.exe
D:\WINDOWS\system32\ctfmon.exe
D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
D:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe
D:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientSystemTray.exe
D:\WINDOWS\713xRMT.exe
D:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
D:\WINDOWS\System32\svchost.exe
D:\Program Files\honestech\honestech TVR\scheduleTV.exe
D:\Program Files\iPod\bin\iPodService.exe
D:\Program Files\Microsoft Office\Office\EXCEL.EXE
D:\WINDOWS\system32\wuauclt.exe
C:\HIJackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - D:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Canon Easy Web Print Helper - {68F9551E-0411-48E4-9AAF-4BC42A6A46BE} - D:\Program Files\Canon\Easy-WebPrint\EWPBrowseLoader.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - D:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - D:\Program Files\Google\GoogleToolbarNotifier\5.4.4525.1752\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - D:\Program Files\Google\Google Toolbar\Component\fastsearch_B7C5AC242193BB3E.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - D:\Program Files\Canon\Easy-WebPrint\Toolband.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - D:\Program Files\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [Realtime Monitor] D:\PROGRA~1\CA\ETRUST~1\realmon.exe -s
O4 - HKLM\..\Run: [AdaptecDirectCD] D:\Program Files\Adaptec\Easy CD Creator 5\DirectCD\DirectCD.exe
O4 - HKLM\..\Run: [{0228e555-4f9c-4e35-a3ec-b109a192b4c2}] D:\Program Files\Google\Gmail Notifier\gnotify.exe
O4 - HKLM\..\Run: [CanonMyPrinter] D:\Program Files\Canon\MyPrinter\BJMyPrt.exe /logon
O4 - HKLM\..\Run: [SSBkgdUpdate] "D:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "D:\Program Files\ScanSoft\OmniPageSE4.0\OpwareSE4.exe"
O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
O4 - HKLM\..\Run: [AppleSyncNotifier] D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleSyncNotifier.exe
O4 - HKLM\..\Run: [TV Card Remote Control Device Monitor] D:\WINDOWS\713xRMTMon.exe
O4 - HKLM\..\Run: [NeroFilterCheck] D:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "D:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [iTunesHelper] "D:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "D:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TraySantaCruz] D:\WINDOWS\system32\tbctray.exe
O4 - HKCU\..\Run: [MSMSGS] "D:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [ctfmon.exe] D:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] "D:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [EasyLinkAdvisor] "D:\Program Files\Linksys EasyLink Advisor\LinksysAgent.exe" /startup
O4 - HKCU\..\Run: [Google Update] "D:\Documents and Settings\Ken Winchester\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
O4 - Global Startup: Amazon Unbox.lnk = ?
O4 - Global Startup: Kodak EasyShare software.lnk = D:\Program Files\Kodak\Kodak EasyShare software\bin\EasyShare.exe
O4 - Global Startup: Microsoft Office.lnk = D:\Program Files\Microsoft Office\Office\OSA9.EXE
O4 - Global Startup: Scheduler for OEM.lnk = D:\Program Files\honestech\honestech TVR\scheduleTV.exe
O8 - Extra context menu item: Easy-WebPrint Add To Print List - res://D:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_AddToList.html
O8 - Extra context menu item: Easy-WebPrint High Speed Print - res://D:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_HSPrint.html
O8 - Extra context menu item: Easy-WebPrint Preview - res://D:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Preview.html
O8 - Extra context menu item: Easy-WebPrint Print - res://D:\Program Files\Canon\Easy-WebPrint\Toolband.dll/RC_Print.html
O9 - Extra button: Bonjour - {7F9DB11C-E358-4ca6-A83D-ACC663939424} - D:\Program Files\Bonjour\ExplorerPlugin.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - D:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - D:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsof...?1170850277437
O16 - DPF: {F27237D7-93C8-44C2-AC6E-D6057B9A918F} (JuniperSetupClientControl Class) - https://caconnect.ca.com/dana-cached...etupClient.cab
O20 - Winlogon Notify: !SASWinLogon - D:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Amazon Unbox Video Service (ADVService) - Amazon.com - D:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe
O23 - Service: Apple Mobile Device - Apple Inc. - D:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Bonjour Service - Apple Inc. - D:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Juniper Network Connect Service (dsNcService) - Juniper Networks - D:\Program Files\Juniper Networks\Common Files\dsNcService.exe
O23 - Service: Google Software Updater (gusvc) - Google - D:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: eTrust Antivirus RPC Server (InoRPC) - Computer Associates International, Inc. - D:\Program Files\CA\eTrust Antivirus\InoRpc.exe
O23 - Service: eTrust Antivirus Realtime Server (InoRT) - Computer Associates International, Inc. - D:\Program Files\CA\eTrust Antivirus\InoRT.exe
O23 - Service: eTrust Antivirus Job Server (InoTask) - Computer Associates International, Inc. - D:\Program Files\CA\eTrust Antivirus\InoTask.exe
O23 - Service: iPod Service - Apple Inc. - D:\Program Files\iPod\bin\iPodService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
--
End of file - 9052 bytes
gmer.log:
GMER 1.0.15.15252 - http://www.gmer.net
Rootkit scan 2009-12-06 15:35:23
Windows 5.1.2600 Service Pack 3
Running: gmer.exe; Driver: D:\DOCUME~1\KENWIN~1\LOCALS~1\Temp\ugldapob.sys
---- System - GMER 1.0.15 ----
SSDT \??\D:\Program Files\SUPERAntiSpyware\SASKUTIL.sys (SASKUTIL.SYS/SUPERAdBlocker.com and SUPERAntiSpyware.com) ZwTerminateProcess [0xF40A80B0]
---- Kernel code sections - GMER 1.0.15 ----
.text ntoskrnl.exe!_abnormal_termination + 451 804E2AAD 3 Bytes [80, 0A, F4] {OR BYTE [EDX], 0xf4}
---- User code sections - GMER 1.0.15 ----
.text D:\Program Files\Internet Explorer\iexplore.exe[2824] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E215435 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[2824] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2ED67C D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[2824] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E418F D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[2824] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E40C1 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[2824] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E412C D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[2824] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E3F92 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[2824] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E3FF4 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[2824] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E41F2 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[2824] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E4056 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[3040] USER32.dll!DialogBoxParamW 7E4247AB 5 Bytes JMP 3E215435 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[3040] USER32.dll!SetWindowsHookExW 7E42820F 5 Bytes JMP 3E2E97F5 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[3040] USER32.dll!CallNextHookEx 7E42B3C6 5 Bytes JMP 3E2DCE79 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[3040] USER32.dll!CreateWindowExW 7E42D0A3 5 Bytes JMP 3E2ED67C D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[3040] USER32.dll!UnhookWindowsHookEx 7E42D5F3 5 Bytes JMP 3E25466C D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[3040] USER32.dll!DialogBoxIndirectParamW 7E432072 5 Bytes JMP 3E3E418F D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[3040] USER32.dll!MessageBoxIndirectA 7E43A082 5 Bytes JMP 3E3E40C1 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[3040] USER32.dll!DialogBoxParamA 7E43B144 5 Bytes JMP 3E3E412C D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[3040] USER32.dll!MessageBoxExW 7E450838 5 Bytes JMP 3E3E3F92 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[3040] USER32.dll!MessageBoxExA 7E45085C 5 Bytes JMP 3E3E3FF4 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[3040] USER32.dll!DialogBoxIndirectParamA 7E456D7D 5 Bytes JMP 3E3E41F2 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[3040] USER32.dll!MessageBoxIndirectW 7E4664D5 5 Bytes JMP 3E3E4056 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[3040] ole32.dll!CoCreateInstance 7750057E 5 Bytes JMP 3E2ED6D8 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
.text D:\Program Files\Internet Explorer\iexplore.exe[3040] ole32.dll!OleLoadFromStream 77529C85 5 Bytes JMP 3E3E44F7 D:\WINDOWS\system32\IEFRAME.dll (Internet Explorer/Microsoft Corporation)
---- User IAT/EAT - GMER 1.0.15 ----
IAT D:\Program Files\Internet Explorer\iexplore.exe[3040] @ D:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExA] [03D32070] D:\Program Files\Canon\Easy-WebPrint\EWPCore.dll
IAT D:\Program Files\Internet Explorer\iexplore.exe[3040] @ D:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryExW] [03D320B0] D:\Program Files\Canon\Easy-WebPrint\EWPCore.dll
IAT D:\Program Files\Internet Explorer\iexplore.exe[3040] @ D:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryW] [03D32030] D:\Program Files\Canon\Easy-WebPrint\EWPCore.dll
IAT D:\Program Files\Internet Explorer\iexplore.exe[3040] @ D:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!LoadLibraryA] [03D32000] D:\Program Files\Canon\Easy-WebPrint\EWPCore.dll
IAT D:\Program Files\Internet Explorer\iexplore.exe[3040] @ D:\WINDOWS\system32\SHLWAPI.dll [KERNEL32.dll!GetProcAddress] [03D34C50] D:\Program Files\Canon\Easy-WebPrint\EWPCore.dll
IAT D:\Program Files\Internet Explorer\iexplore.exe[3040] @ D:\WINDOWS\system32\ole32.dll [KERNEL32.dll!LoadLibraryExW] [451F1ACB] D:\Program Files\Internet Explorer\xpshims.dll (Internet Explorer Compatibility Shims for XP/Microsoft Corporation)
---- Devices - GMER 1.0.15 ----
AttachedDevice \FileSystem\Ntfs \Ntfs ino_flpy.sys (CA eTrust Antivirus/InoculateIT File System Mounting Filter Driver for Windows 2000/XP/.Net/Computer Associates)
AttachedDevice \FileSystem\Ntfs \Ntfs ino_fltr.sys (CA eTrust Antivirus/InoculateIT File System Filter Driver for Windows 2000/XP/2003/Computer Associates)
AttachedDevice \FileSystem\Fastfat \Fat ino_flpy.sys (CA eTrust Antivirus/InoculateIT File System Mounting Filter Driver for Windows 2000/XP/.Net/Computer Associates)
---- EOF - GMER 1.0.15 ----
I apologize , my goof!
The hjt forum is where they should be. :(
And a link to you hjt thread.
http://discussions.virtualdr.com/sho...d.php?t=242449
The cable company replaced the cable coming from the box outside to my house. He said it looks like moles in my yard may have been chewing on the old one!
I'd still like to know if all the cleanup software I ran cleaned off anything significant.
(Rogue.DriveCleaner) -> Quarantined and deleted successfully. Is a example of garbage that was removed.