fakealert wallpaper and trojan
Page 1 of 3 123 LastLast
Results 1 to 15 of 40

Thread: fakealert wallpaper and trojan

  1. January 25th, 2009, 01:46 PM #1
    boombrown33
    boombrown33 is offline Virtual Med Student
    Join Date
    Jan 2009
    Posts
    32

    fakealert wallpaper and trojan

    I am running Windows XP on a Dell Dimension9100. Last night I started getting the alert wallpaper. My McAfee program said nothing detected. Adaware couldn't run

    I have run SUPERantispyware, Malwarebytes and HijackThis. I have the logs.
    (SUPERantispyware kept shutting down after 20-30 minutes, so I cleaned in pieces, and I am not sure that I got to the end, including WINDOWS files)

    My logs are too long, so should I post one at a time?

    Any help you can offer!
    Thanks.
    Reply With Quote Reply With Quote
  2. January 25th, 2009, 02:04 PM #2
    Train
    Train is offline Friend of Site Staff
    Join Date
    Apr 2000
    Location
    Sheboygan, WI
    Posts
    53,392
    Post oine at a time is fine and should you need to use two or three posts for one log, that is fine also. Just disable wordwrap in notepad before you post.
    It makes for easier reading.
    Reply With Quote Reply With Quote
  3. January 25th, 2009, 02:04 PM #3
    boombrown33
    boombrown33 is offline Virtual Med Student
    Join Date
    Jan 2009
    Posts
    32

    my HijackThis file

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:21:16 PM, on 1/25/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16762)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\stsystra.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program Files\McAfee.com\Agent\mcagent.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Netgear Update Assistant\LanUpdate.exe
    C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe
    C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Documents and Settings\Lauren Kitch\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
    C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\McAfee\MSK\MskSrver.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    C:\Program Files\McAfee\MPF\MPFSrv.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://wapp.verizon.net/bookmarks/bm...&bm=ho_central
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.yahoo.com/search?fr=mcafee&p=%s
    O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: {4af4e449-0995-7dd9-ca04-35acb1b573b4} - {4b375b1b-ca53-40ac-9dd7-5990944e4fa4} - (no file)
    O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
    O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O2 - BHO: (no name) - {B46D980F-AED4-42A3-BE1B-01B5F23B5EEF} - (no file)
    O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
    O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
    O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
    O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [LanUpdate] "C:\Program Files\Netgear Update Assistant\LanUpdate.exe"
    O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] C:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=012609 serial=DR12WUX-0649381-KWJ lang=EN
    O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
    O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
    O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
    O4 - HKLM\..\Run: [Adobe_ID0ENQBO] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
    O4 - HKLM\..\Run: [McAfee Backup] "C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Lauren Kitch\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
    O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O15 - ProtocolDefaults: '@ivt' protocol is in My Computer Zone, should be Intranet Zone (HKLM)
    O15 - ProtocolDefaults: 'file' protocol is in My Computer Zone, should be Internet Zone (HKLM)
    O15 - ProtocolDefaults: 'ftp' protocol is in My Computer Zone, should be Internet Zone (HKLM)
    O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone (HKLM)
    O15 - ProtocolDefaults: 'https' protocol is in My Computer Zone, should be Internet Zone (HKLM)
    O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O20 - AppInit_DLLs: mdlfyb.dll
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Adobe Version Cue CS4 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: MBackMonitor - McAfee - C:\Program Files\McAfee\MBK\MBackMonitor.exe
    O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
    O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
    O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe

    --
    End of file - 9152 bytes
    Reply With Quote Reply With Quote
  4. January 25th, 2009, 02:05 PM #4
    boombrown33
    boombrown33 is offline Virtual Med Student
    Join Date
    Jan 2009
    Posts
    32

    Malwarebytes log

    Malwarebytes' Anti-Malware 1.33
    Database version: 1691
    Windows 5.1.2600 Service Pack 3

    1/25/2009 12:14:57 PM
    mbam-log-2009-01-25 (12-14-57).txt

    Scan type: Full Scan (C:\|)
    Objects scanned: 168600
    Time elapsed: 1 hour(s), 3 minute(s), 46 second(s)

    Memory Processes Infected: 1
    Memory Modules Infected: 1
    Registry Keys Infected: 2
    Registry Values Infected: 2
    Registry Data Items Infected: 7
    Folders Infected: 0
    Files Infected: 15

    Memory Processes Infected:
    C:\WINDOWS\system32\frmwrk32.exe (Trojan.FakeAlert) -> Unloaded process successfully.

    Memory Modules Infected:
    C:\WINDOWS\Temp\ntdll64.dll (Trojan.FakeAlert) -> Delete on reboot.

    Registry Keys Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\xpreapp (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\instkey (Trojan.Vundo) -> Quarantined and deleted successfully.

    Registry Values Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\rdila (Trojan.Agent) -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Framework Windows (Trojan.FakeAlert) -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr (Hijack.TaskManager) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\ActiveDesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\activedesktop\NoChangingWallpaper (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoSetActiveDesktop (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    C:\Documents and Settings\Lauren Kitch\Local Settings\Temp\seneka7849.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Lauren Kitch\Local Settings\Temp\winvsnet.tmp (Rogue.Installer) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\seneka.sys (Trojan.TDSS) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\senekamndrqljk.sys (Trojan.TDSS) -> Quarantined and deleted successfully.
    C:\WINDOWS\atosazukuyaseza.dll (Trojan.Agent) -> Delete on reboot.
    C:\WINDOWS\system32\ntdll64.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\senekahnyirfhg.dll (Trojan.Agent) -> Delete on reboot.
    C:\WINDOWS\system32\senekatdpulvdf.dll (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\senekadf.dat (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\senekalog.dat (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\warning.gif (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\ahtn.htm (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\frmwrk32.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\WINDOWS\Temp\ntdll64.dll (Trojan.FakeAlert) -> Delete on reboot.
    C:\WINDOWS\Temp\mousehook.dll (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    Reply With Quote Reply With Quote
  5. January 25th, 2009, 02:10 PM #5
    boombrown33
    boombrown33 is offline Virtual Med Student
    Join Date
    Jan 2009
    Posts
    32

    HijackThis logfile

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:21:16 PM, on 1/25/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16762)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\stsystra.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program Files\McAfee.com\Agent\mcagent.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\Netgear Update Assistant\LanUpdate.exe
    C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe
    C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Documents and Settings\Lauren Kitch\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
    C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\McAfee\MSK\MskSrver.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    C:\Program Files\McAfee\MPF\MPFSrv.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://wapp.verizon.net/bookmarks/bm...&bm=ho_central
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.yahoo.com/search?fr=mcafee&p=%s
    O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: {4af4e449-0995-7dd9-ca04-35acb1b573b4} - {4b375b1b-ca53-40ac-9dd7-5990944e4fa4} - (no file)
    O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
    O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O2 - BHO: (no name) - {B46D980F-AED4-42A3-BE1B-01B5F23B5EEF} - (no file)
    O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
    O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
    O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
    O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [LanUpdate] "C:\Program Files\Netgear Update Assistant\LanUpdate.exe"
    O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] C:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=012609 serial=DR12WUX-0649381-KWJ lang=EN
    O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
    O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
    O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
    O4 - HKLM\..\Run: [Adobe_ID0ENQBO] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
    O4 - HKLM\..\Run: [McAfee Backup] "C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Lauren Kitch\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
    O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O15 - ProtocolDefaults: '@ivt' protocol is in My Computer Zone, should be Intranet Zone (HKLM)
    O15 - ProtocolDefaults: 'file' protocol is in My Computer Zone, should be Internet Zone (HKLM)
    O15 - ProtocolDefaults: 'ftp' protocol is in My Computer Zone, should be Internet Zone (HKLM)
    O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone (HKLM)
    O15 - ProtocolDefaults: 'https' protocol is in My Computer Zone, should be Internet Zone (HKLM)
    O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O20 - AppInit_DLLs: mdlfyb.dll
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Adobe Version Cue CS4 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: MBackMonitor - McAfee - C:\Program Files\McAfee\MBK\MBackMonitor.exe
    O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
    O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
    O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe

    --
    End of file - 9152 bytes
    Reply With Quote Reply With Quote
  6. January 25th, 2009, 02:15 PM #6
    boombrown33
    boombrown33 is offline Virtual Med Student
    Join Date
    Jan 2009
    Posts
    32

    Ignore dbl HijTh post--sorry! SUPERanti#1 log

    (I deleted the cookies for brevity's sake)


    SUPERAntiSpyware Scan Log
    http://www.superantispyware.com

    Generated 01/25/2009 at 10:11 AM

    Application Version : 4.25.1012

    Core Rules Database Version : 3728
    Trace Rules Database Version: 1699

    Scan type : Complete Scan
    Total Scan Time : 00:33:42

    Memory items scanned : 245
    Memory threats detected : 0
    Registry items scanned : 6194
    Registry threats detected : 64
    File items scanned : 52749
    File threats detected : 192

    Trojan.Unknown Origin
    [Wallpaper] C:\WINDOWS\SYSTEM32\AHTN.HTM
    C:\WINDOWS\SYSTEM32\AHTN.HTM
    [Wallpaper] C:\WINDOWS\SYSTEM32\AHTN.HTM
    [Wallpaper] C:\WINDOWS\SYSTEM32\AHTN.HTM
    C:\DOCUMENTS AND SETTINGS\LAUREN KITCH\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\YTWCUH9F\WINLOGON[1].HTM

    Unclassified.Unknown Origin
    HKLM\Software\Classes\CLSID\{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}
    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}
    HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks#{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C}
    HKU\S-1-5-21-2502057745-4085956505-3141651129-1007\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{6D794CB4-C7CD-4C6F-BFDC-9B77AFBDC02C}
    HKCR\CLSID\{6D794CB4-C7CD-4C6F-BFDC-9B77AFBDC02C}

    Rogue.AntiSpywareMaster
    HKU\S-1-5-21-2502057745-4085956505-3141651129-1007\Software\{5222008A-DD62-49c7-A735-7BD18ECC7350}

    Adware.Vundo Variant/Rel
    HKLM\SOFTWARE\Microsoft\FCOVM
    HKLM\SOFTWARE\Microsoft\RemoveRP
    HKLM\SOFTWARE\Microsoft\MS Juan
    HKLM\SOFTWARE\Microsoft\MS Juan#RID
    HKLM\SOFTWARE\Microsoft\MS Juan\DJZERO
    HKLM\SOFTWARE\Microsoft\MS Juan\DJZERO#LTM
    HKLM\SOFTWARE\Microsoft\MS Juan\DJZERO#CDY
    HKLM\SOFTWARE\Microsoft\MS Juan\DJZERO#CNT
    HKLM\SOFTWARE\Microsoft\MS Juan\JKWL
    HKLM\SOFTWARE\Microsoft\MS Juan\JKWL\http%3A%2F%2Fwww.eweek.com%2Fc%2Fa%2FSecurity%2FCleaning-Conficker-Keeping-Your-Network-Safe-From-Windows-Worm%2F
    HKLM\SOFTWARE\Microsoft\MS Juan\JKWL\http%3A%2F%2Fwww.eweek.com%2Fc%2Fa%2FSecurity%2FCleaning-Conficker-Keeping-Your-Network-Safe-From-Windows-Worm%2F#LU
    HKLM\SOFTWARE\Microsoft\MS Juan\JKWL\http%3A%2F%2Fwww.eweek.com%2Fc%2Fa%2FSecurity%2FCleaning-Conficker-Keeping-Your-Network-Safe-From-Windows-Worm%2F#CT
    HKLM\SOFTWARE\Microsoft\MS Juan\JKWL\http%3A%2F%2Fwww.eweek.com%2Fc%2Fa%2FSecurity%2FCleaning-Conficker-Keeping-Your-Network-Safe-From-Windows-Worm%2F#LT
    HKLM\SOFTWARE\Microsoft\MS Juan\metajuan
    HKLM\SOFTWARE\Microsoft\MS Juan\metajuan#LTM
    HKLM\SOFTWARE\Microsoft\MS Juan\metajuan#CDY
    HKLM\SOFTWARE\Microsoft\MS Juan\metajuan#CNT
    HKLM\SOFTWARE\Microsoft\MS Juan\metajuan#LBL
    HKLM\SOFTWARE\Microsoft\MS Juan\metajuan#MN
    HKLM\SOFTWARE\Microsoft\MS Juan\meta_mg
    HKLM\SOFTWARE\Microsoft\MS Juan\meta_mg#LTM
    HKLM\SOFTWARE\Microsoft\MS Juan\meta_mg#CDY
    HKLM\SOFTWARE\Microsoft\MS Juan\meta_mg#CNT
    HKLM\SOFTWARE\Microsoft\MS Juan\profiling4
    HKLM\SOFTWARE\Microsoft\MS Juan\profiling4#LTM
    HKLM\SOFTWARE\Microsoft\MS Juan\profiling4#CDY
    HKLM\SOFTWARE\Microsoft\MS Juan\profiling4#CNT
    HKLM\SOFTWARE\Microsoft\MS Juan\superjuan
    HKLM\SOFTWARE\Microsoft\MS Juan\superjuan#LTM
    HKLM\SOFTWARE\Microsoft\MS Juan\superjuan#CDY
    HKLM\SOFTWARE\Microsoft\MS Juan\superjuan#CNT
    HKLM\SOFTWARE\Microsoft\MS Juan\TrackDJuan
    HKLM\SOFTWARE\Microsoft\MS Juan\TrackDJuan#LTM
    HKLM\SOFTWARE\Microsoft\MS Juan\TrackDJuan#CDY
    HKLM\SOFTWARE\Microsoft\MS Juan\TrackDJuan#CNT
    HKLM\SOFTWARE\Microsoft\contim
    HKLM\SOFTWARE\Microsoft\contim#SysShell
    HKLM\SOFTWARE\Microsoft\MS Track System
    HKLM\SOFTWARE\Microsoft\MS Track System#Uid
    HKLM\SOFTWARE\Microsoft\MS Track System#Click1
    HKLM\SOFTWARE\Microsoft\MS Track System#Uqs
    HKLM\SOFTWARE\Microsoft\rdfa
    HKLM\SOFTWARE\Microsoft\rdfa#F
    HKLM\SOFTWARE\Microsoft\rdfa#N

    Rogue.VirusRemover2008
    HKLM\Software\{5222008A-DD62-49c7-A735-7BD18ECC7350}
    HKU\S-1-5-21-2502057745-4085956505-3141651129-1007\Software\VirusRemover2008
    HKLM\Software\VirusRemover2008

    Rogue.Component/Trace
    HKLM\Software\Microsoft\BCD0A15C
    HKLM\Software\Microsoft\BCD0A15C#bcd0a15c
    HKLM\Software\Microsoft\BCD0A15C#Version
    HKLM\Software\Microsoft\BCD0A15C#bcd00cdc
    HKLM\Software\Microsoft\BCD0A15C#bcd06539
    HKU\S-1-5-21-2502057745-4085956505-3141651129-1007\Software\Microsoft\CS41275
    HKU\S-1-5-21-2502057745-4085956505-3141651129-1007\Software\Microsoft\FIAS4018

    Adware.Prun
    HKU\S-1-5-21-2502057745-4085956505-3141651129-1007\Software\Microsoft\Windows\CurrentVersion\Run#prunnet [ "C:\WINDOWS\system32\prunnet.exe" ]

    Rootkit.Agent/Gen-MHook
    C:\DOCUMENTS AND SETTINGS\LAUREN KITCH\LOCAL SETTINGS\TEMP\MOUSEHOOK.DLL

    Trojan.Unclassified/NTDLL64
    C:\DOCUMENTS AND SETTINGS\LAUREN KITCH\LOCAL SETTINGS\TEMP\NTDLL64.DLL

    Rogue.FakeAlert/Wallpaper
    C:\DOCUMENTS AND SETTINGS\LAUREN KITCH\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\7RK61BOD\WARNING[1].GIF
    Reply With Quote Reply With Quote
  7. January 25th, 2009, 02:16 PM #7
    boombrown33
    boombrown33 is offline Virtual Med Student
    Join Date
    Jan 2009
    Posts
    32

    SUPERanti log #2 (minus cookies)

    SUPERAntiSpyware Scan Log
    http://www.superantispyware.com

    Generated 01/25/2009 at 10:24 AM

    Application Version : 4.25.1012

    Core Rules Database Version : 3728
    Trace Rules Database Version: 1699

    Scan type : Complete Scan
    Total Scan Time : 00:06:57

    Memory items scanned : 282
    Memory threats detected : 0
    Registry items scanned : 6187
    Registry threats detected : 56
    File items scanned : 5520
    File threats detected : 74

    Rogue.AntiSpywareMaster
    HKU\S-1-5-21-2502057745-4085956505-3141651129-1007\Software\{5222008A-DD62-49c7-A735-7BD18ECC7350}

    Adware.Vundo Variant/Rel
    HKLM\SOFTWARE\Microsoft\FCOVM
    HKLM\SOFTWARE\Microsoft\RemoveRP
    HKLM\SOFTWARE\Microsoft\MS Juan
    HKLM\SOFTWARE\Microsoft\MS Juan#RID
    HKLM\SOFTWARE\Microsoft\MS Juan\DJZERO
    HKLM\SOFTWARE\Microsoft\MS Juan\DJZERO#LTM
    HKLM\SOFTWARE\Microsoft\MS Juan\DJZERO#CDY
    HKLM\SOFTWARE\Microsoft\MS Juan\DJZERO#CNT
    HKLM\SOFTWARE\Microsoft\MS Juan\JKWL
    HKLM\SOFTWARE\Microsoft\MS Juan\JKWL\http%3A%2F%2Fwww.eweek.com%2Fc%2Fa%2FSecurity%2FCleaning-Conficker-Keeping-Your-Network-Safe-From-Windows-Worm%2F
    HKLM\SOFTWARE\Microsoft\MS Juan\JKWL\http%3A%2F%2Fwww.eweek.com%2Fc%2Fa%2FSecurity%2FCleaning-Conficker-Keeping-Your-Network-Safe-From-Windows-Worm%2F#LU
    HKLM\SOFTWARE\Microsoft\MS Juan\JKWL\http%3A%2F%2Fwww.eweek.com%2Fc%2Fa%2FSecurity%2FCleaning-Conficker-Keeping-Your-Network-Safe-From-Windows-Worm%2F#CT
    HKLM\SOFTWARE\Microsoft\MS Juan\JKWL\http%3A%2F%2Fwww.eweek.com%2Fc%2Fa%2FSecurity%2FCleaning-Conficker-Keeping-Your-Network-Safe-From-Windows-Worm%2F#LT
    HKLM\SOFTWARE\Microsoft\MS Juan\metajuan
    HKLM\SOFTWARE\Microsoft\MS Juan\metajuan#LTM
    HKLM\SOFTWARE\Microsoft\MS Juan\metajuan#CDY
    HKLM\SOFTWARE\Microsoft\MS Juan\metajuan#CNT
    HKLM\SOFTWARE\Microsoft\MS Juan\metajuan#LBL
    HKLM\SOFTWARE\Microsoft\MS Juan\metajuan#MN
    HKLM\SOFTWARE\Microsoft\MS Juan\meta_mg
    HKLM\SOFTWARE\Microsoft\MS Juan\meta_mg#LTM
    HKLM\SOFTWARE\Microsoft\MS Juan\meta_mg#CDY
    HKLM\SOFTWARE\Microsoft\MS Juan\meta_mg#CNT
    HKLM\SOFTWARE\Microsoft\MS Juan\profiling4
    HKLM\SOFTWARE\Microsoft\MS Juan\profiling4#LTM
    HKLM\SOFTWARE\Microsoft\MS Juan\profiling4#CDY
    HKLM\SOFTWARE\Microsoft\MS Juan\profiling4#CNT
    HKLM\SOFTWARE\Microsoft\MS Juan\superjuan
    HKLM\SOFTWARE\Microsoft\MS Juan\superjuan#LTM
    HKLM\SOFTWARE\Microsoft\MS Juan\superjuan#CDY
    HKLM\SOFTWARE\Microsoft\MS Juan\superjuan#CNT
    HKLM\SOFTWARE\Microsoft\MS Juan\TrackDJuan
    HKLM\SOFTWARE\Microsoft\MS Juan\TrackDJuan#LTM
    HKLM\SOFTWARE\Microsoft\MS Juan\TrackDJuan#CDY
    HKLM\SOFTWARE\Microsoft\MS Juan\TrackDJuan#CNT
    HKLM\SOFTWARE\Microsoft\contim
    HKLM\SOFTWARE\Microsoft\contim#SysShell
    HKLM\SOFTWARE\Microsoft\MS Track System
    HKLM\SOFTWARE\Microsoft\MS Track System#Uid
    HKLM\SOFTWARE\Microsoft\MS Track System#Click1
    HKLM\SOFTWARE\Microsoft\MS Track System#Uqs
    HKLM\SOFTWARE\Microsoft\rdfa
    HKLM\SOFTWARE\Microsoft\rdfa#F
    HKLM\SOFTWARE\Microsoft\rdfa#N

    Rogue.VirusRemover2008
    HKLM\Software\{5222008A-DD62-49c7-A735-7BD18ECC7350}
    HKU\S-1-5-21-2502057745-4085956505-3141651129-1007\Software\VirusRemover2008
    HKLM\Software\VirusRemover2008

    Rogue.Component/Trace
    HKLM\Software\Microsoft\BCD0A15C
    HKLM\Software\Microsoft\BCD0A15C#bcd0a15c
    HKLM\Software\Microsoft\BCD0A15C#Version
    HKLM\Software\Microsoft\BCD0A15C#bcd00cdc
    HKLM\Software\Microsoft\BCD0A15C#bcd06539
    HKU\S-1-5-21-2502057745-4085956505-3141651129-1007\Software\Microsoft\CS41275
    HKU\S-1-5-21-2502057745-4085956505-3141651129-1007\Software\Microsoft\FIAS4018

    Adware.Prun
    HKU\S-1-5-21-2502057745-4085956505-3141651129-1007\Software\Microsoft\Windows\CurrentVersion\Run#prunnet [ "C:\WINDOWS\system32\prunnet.exe" ]
    Reply With Quote Reply With Quote
  8. January 25th, 2009, 02:16 PM #8
    boombrown33
    boombrown33 is offline Virtual Med Student
    Join Date
    Jan 2009
    Posts
    32

    SUPERanti#3

    SUPERAntiSpyware Scan Log
    http://www.superantispyware.com

    Generated 01/25/2009 at 10:35 AM

    Application Version : 4.25.1012

    Core Rules Database Version : 3728
    Trace Rules Database Version: 1699

    Scan type : Complete Scan
    Total Scan Time : 00:08:14

    Memory items scanned : 241
    Memory threats detected : 0
    Registry items scanned : 6186
    Registry threats detected : 0
    File items scanned : 6600
    File threats detected : 2

    Rootkit.Agent/Gen-MHook
    C:\DOCUMENTS AND SETTINGS\LAUREN KITCH\LOCAL SETTINGS\TEMP\MOUSEHOOK.DLL

    Trojan.Unclassified/NTDLL64
    C:\DOCUMENTS AND SETTINGS\LAUREN KITCH\LOCAL SETTINGS\TEMP\NTDLL64.DLL
    Reply With Quote Reply With Quote
  9. January 25th, 2009, 02:18 PM #9
    boombrown33
    boombrown33 is offline Virtual Med Student
    Join Date
    Jan 2009
    Posts
    32

    SUPERanti#4

    SUPERAntiSpyware Scan Log
    http://www.superantispyware.com

    Generated 01/25/2009 at 10:46 AM

    Application Version : 4.25.1012

    Core Rules Database Version : 3728
    Trace Rules Database Version: 1699

    Scan type : Complete Scan
    Total Scan Time : 00:08:20

    Memory items scanned : 241
    Memory threats detected : 0
    Registry items scanned : 6186
    Registry threats detected : 0
    File items scanned : 7209
    File threats detected : 1

    Rogue.FakeAlert/Wallpaper
    C:\DOCUMENTS AND SETTINGS\LAUREN KITCH\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\7RK61BOD\WARNING[1].GIF
    Reply With Quote Reply With Quote
  10. January 25th, 2009, 02:40 PM #10
    Broni's Avatar
    Broni
    Broni is offline Friend of Site Staff
    Join Date
    Dec 2007
    Location
    Daly City, CA
    Posts
    22,550
    I'm curious here....
    Malwarebytes:
    1/25/2009 12:14:57 PM
    HJT:
    12:21:16 PM, on 1/25/2009
    Did Malwarebytes scan for 7 minutes? Quiet unlikely...
    ...or you ran both scans at the pretty much same time?
    My Home Page
    Reply With Quote Reply With Quote
  11. January 25th, 2009, 02:47 PM #11
    boombrown33
    boombrown33 is offline Virtual Med Student
    Join Date
    Jan 2009
    Posts
    32
    No, I definitely ran the Hijack after the Malware was finished...not sure what the times mean.
    Reply With Quote Reply With Quote
  12. January 25th, 2009, 02:49 PM #12
    Broni's Avatar
    Broni
    Broni is offline Friend of Site Staff
    Join Date
    Dec 2007
    Location
    Daly City, CA
    Posts
    22,550
    OK. Let's see what we have in HJT log...
    My Home Page
    Reply With Quote Reply With Quote
  13. January 25th, 2009, 03:10 PM #13
    Broni's Avatar
    Broni
    Broni is offline Friend of Site Staff
    Join Date
    Dec 2007
    Location
    Daly City, CA
    Posts
    22,550
    *** Verify your Java version here: http://www.java.com/en/download/installed.jsp
    Update, if necessary.
    Uninstall all previous Java versions, through Add\Remove.

    *** Download, and run CTFMON-Remover: http://www.gerhard-schlager.at/en/pr...ctfmonremover/
    The CTFMON-Remover helps you removing the annoying CTFMON.EXE from your Windows operating system. The program is easy to use and displays whether the CTFMON.EXE is installed and running or not. If it was found then you can remove it within seconds. Just in case that you need the CTFMON sometime in the future there is also an option to restore the original one.
    Note:The CTFMON.EXE is among other things responsible for changing the language schema of your keyboard (e.g. for switching between the German and English keyboard layout). So in case you are using this feature you shouldn't remove or disable the CTFMON.EXE!
    NOTE. CTFMON.EXE is not a threat, but unnecessary startup, which can't be disabled in any other way.

    *** Download, and run QuickTime Killer: http://www.softpedia.com/get/System/...e-Killer.shtml
    After downloading, double click on EnGraphQuickTimeKillerInstaller.msi file.
    You may be asked to download, and install .NET Framework
    QuickTime Killer will remove QuickTime from start up and kill any running QuickTime processes. This application runs silently at start up and closes itself as soon as it takes care of QuickTime. QuickTime itself won't be removed from your computer, and will be available whenever needed.
    NOTE. QuickTime is not a threat, but unnecessary startup, which can't be disabled in any other way.

    1. Print this post out, since you won't have an access to it, at some point.

    2. Close all windows, except for HijackThis.

    3. Put a checkmark next to the following HijackThis entries (some entries will be checkmarked to disable unnecessary startups; in those cases [marked with *], no actual program will be removed):

    - R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://search.yahoo.com/search?fr=mcafee&p=%s
    - O2 - BHO: {4af4e449-0995-7dd9-ca04-35acb1b573b4} - {4b375b1b-ca53-40ac-9dd7-5990944e4fa4} - (no file)
    - O2 - BHO: (no name) - {B46D980F-AED4-42A3-BE1B-01B5F23B5EEF} - (no file)
    - *O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    - *O4 - HKLM\..\Run: [LanUpdate] "C:\Program Files\Netgear Update Assistant\LanUpdate.exe"
    - *O4 - HKLM\..\Run: [MMTray] "C:\Program Files\Musicmatch\Musicmatch Jukebox\mm_tray.exe"
    - *O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    - *O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    - *O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] C:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=012609 serial=DR12WUX-0649381-KWJ lang=EN
    - O15 - ProtocolDefaults: '@ivt' protocol is in My Computer Zone, should be Intranet Zone (HKLM)
    - O15 - ProtocolDefaults: 'file' protocol is in My Computer Zone, should be Internet Zone (HKLM)
    - O15 - ProtocolDefaults: 'ftp' protocol is in My Computer Zone, should be Internet Zone (HKLM)
    - O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone (HKLM)
    - O15 - ProtocolDefaults: 'https' protocol is in My Computer Zone, should be Internet Zone (HKLM)
    - O20 - AppInit_DLLs: mdlfyb.dll
    - * O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

    4. Click on Fix checked button.

    5. Restart computer in Safe Mode (keep tapping F8 key, when your computer starts, until menu appears)

    6. Open Windows Explorer. Go Tools>Folder Options>View tab, put a checkmark next to Show hidden files, and folders.

    7. Delete following files/folders (if present):

    - Search the computer for mdlfyb.dll; delete all instances, if found

    8. Restart in Normal Mode.

    9. Post new HijackThis log.
    My Home Page
    Reply With Quote Reply With Quote
  14. January 25th, 2009, 03:49 PM #14
    boombrown33
    boombrown33 is offline Virtual Med Student
    Join Date
    Jan 2009
    Posts
    32

    new HijackThis log

    no mdlfyb.dll found
    below ids HijTh log

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 2:46:34 PM, on 1/25/2009
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16762)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\stsystra.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program Files\McAfee.com\Agent\mcagent.exe
    C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe
    C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Documents and Settings\Lauren Kitch\Local Settings\Application Data\Google\Update\GoogleUpdate.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\McAfee\MSK\MskSrver.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://wapp.verizon.net/bookmarks/bm...&bm=ho_central
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
    O2 - BHO: McAfee SiteAdvisor BHO - {B164E929-A1B6-4A06-B104-2CD0E90A88FF} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
    O3 - Toolbar: McAfee SiteAdvisor Toolbar - {0EBBBE48-BAD4-4B4C-8E5A-516ABECAE064} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
    O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS4/contributeieplugin.dll
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [mcagent_exe] "C:\Program Files\McAfee.com\Agent\mcagent.exe" /runkey
    O4 - HKLM\..\Run: [McENUI] C:\PROGRA~1\McAfee\MHN\McENUI.exe /hide
    O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
    O4 - HKLM\..\Run: [Adobe Acrobat Speed Launcher] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrobat_sl.exe"
    O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
    O4 - HKLM\..\Run: [Adobe_ID0ENQBO] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
    O4 - HKLM\..\Run: [McAfee Backup] "C:\Program Files\McAfee\MBK\McAfeeDataBackup.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre6\bin\jusched.exe
    O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Lauren Kitch\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
    O8 - Extra context menu item: Append Link Target to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Append to Existing PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert Link Target to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\npjpi160_11.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\npjpi160_11.dll
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O15 - ProtocolDefaults: '@ivt' protocol is in My Computer Zone, should be Intranet Zone (HKLM)
    O15 - ProtocolDefaults: 'file' protocol is in My Computer Zone, should be Internet Zone (HKLM)
    O15 - ProtocolDefaults: 'ftp' protocol is in My Computer Zone, should be Internet Zone (HKLM)
    O15 - ProtocolDefaults: 'http' protocol is in My Computer Zone, should be Internet Zone (HKLM)
    O15 - ProtocolDefaults: 'https' protocol is in My Computer Zone, should be Internet Zone (HKLM)
    O18 - Protocol: sacore - {5513F07E-936B-4E52-9B00-067394E91CC5} - c:\PROGRA~1\mcafee\SITEAD~1\mcieplg.dll
    O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
    O23 - Service: Adobe Version Cue CS4 - Adobe Systems Incorporated - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) - Intel Corporation - C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: MBackMonitor - McAfee - C:\Program Files\McAfee\MBK\MBackMonitor.exe
    O23 - Service: McAfee SiteAdvisor Service - Unknown owner - C:\Program Files\McAfee\SiteAdvisor\McSACore.exe
    O23 - Service: McAfee Services (mcmscsvc) - McAfee, Inc. - C:\PROGRA~1\McAfee\MSC\mcmscsvc.exe
    O23 - Service: McAfee Network Agent (McNASvc) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mna\mcnasvc.exe
    O23 - Service: McAfee Scanner (McODS) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcods.exe
    O23 - Service: McAfee Proxy Service (McProxy) - McAfee, Inc. - c:\PROGRA~1\COMMON~1\mcafee\mcproxy\mcproxy.exe
    O23 - Service: McAfee Real-time Scanner (McShield) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe
    O23 - Service: McAfee SystemGuards (McSysmon) - McAfee, Inc. - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe
    O23 - Service: McAfee Personal Firewall Service (MpfService) - McAfee, Inc. - C:\Program Files\McAfee\MPF\MPFSrv.exe
    O23 - Service: McAfee Anti-Spam Service (MSK80Service) - McAfee, Inc. - C:\Program Files\McAfee\MSK\MskSrver.exe

    --
    End of file - 8564 bytes
    Reply With Quote Reply With Quote
  15. January 25th, 2009, 04:11 PM #15
    Broni's Avatar
    Broni
    Broni is offline Friend of Site Staff
    Join Date
    Dec 2007
    Location
    Daly City, CA
    Posts
    22,550
    What happened with O15 entries?
    My Home Page
    Reply With Quote Reply With Quote
« Previous Thread | Next Thread »

Thread Information

Users Browsing this Thread

There are currently 1 users browsing this thread. (0 members and 1 guests)

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules