infected with 'tanatos.m' + 'heur' with hijackthis.log

[mogli_saiyan]

hello peeps,

hope you can help..my pc freezes allot now and i gotta final on friday, cant work like this
this is my hijackthis log

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:26:42, on 06.07.2009
Platform: Windows Vista SP1 (WinNT 6.00.1905)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
C:\Windows\system32\taskeng.exe
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\AVG\AVG8\avgtray.exe
C:\Program Files\Parallels\Parallels Tools\prl_cc.exe
C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Windows\system32\wbem\unsecapp.exe
C:\Windows\system32\wuauclt.exe
C:\Users\Mogli\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Mogli\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Mogli\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Users\Mogli\AppData\Local\Google\Chrome\Application\chrome.exe
C:\Program Files\AVG\AVG8\avgui.exe
C:\Program Files\AVG\AVG8\avgcsrvx.exe
C:\Users\Mogli\Desktop\HijackThis.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll
O2 - BHO: Google Dictionary Compression sdch - {C84D72FE-E17D-4195-BB24-76C02E2E7C4E} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: TextAloud - {F053C368-5458-45B2-9B4D-D8914BDDDBFF} - C:\PROGRA~1\TEXTAL~1\TAForIE.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files\Google\Google Toolbar\GoogleToolbar.dll
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [Parallels Shared Internet Applications] "C:\Program Files\Parallels\Parallels Tools\SIA\SharedIntApp.exe" /start
O4 - HKLM\..\Run: [Parallels Tools Center] "C:\Program Files\Parallels\Parallels Tools\prl_cc.exe"
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - res://C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O13 - Gopher Prefix:
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {7530BFB8-7293-4D34-9923-61A11451AFC5} (OnlineScanner Control) - http://download.eset.com/special/eos/OnlineScanner.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/s ... wflash.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{CBC3FA34-36B2-48B4-8C8B-12E6F4DB8828}: NameServer = 192.168.0.1
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O18 - Filter: x-sdch - {B1759355-3EEC-4C1E-B0F1-B719FE26E377} - C:\Program Files\Google\Google Toolbar\Component\fastsearch_A8904FB862BD9564.dll
O20 - AppInit_DLLs: C:\Windows\System32\avgrsstx.dll
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Apple OS Switch Manager (AppleOSSMgr) - Unknown owner - C:\Windows\system32\AppleOSSMgr.exe
O23 - Service: Apple-Time-Server (AppleTimeSrv) - Apple Inc. - C:\Windows\system32\AppleTimeSrv.exe
O23 - Service: Ati External Event Utility - ATI Technologies Inc. - C:\Windows\system32\Ati2evxx.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
O23 - Service: Parallels Coherence Service - Parallels, Inc. - C:\Program Files\Parallels\Parallels Tools\Services\coherence.exe
O23 - Service: Parallels Tools Service - Parallels, Inc. - C:\Program Files\Parallels\Parallels Tools\Services\prl_tools_service.exe
O23 - Service: SBSD Security Center Service (SBSDWSCService) - Safer Networking Ltd. - C:\Program Files\Spybot - Search & Destroy\SDWinSec.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - TuneUp Software GmbH - C:\Windows\System32\TuneUpDefragService.exe

--
End of file - 8857 bytes

[Jack&Jill]

Hello mogli_saiyan,

Welcome to Malware Removal. I am Jack&Jill, and I will be helping you out.

Before we go further, there are a few things that I would like to make clear so that we are share the same understanding.

• Please observe and follow these Forum Rules.
• As I am currently training at Malware Removal, it will take some time for me to go through your logs, please be patient with me.
• Be assured that any recommendations to you will be done as soon as possible and will be approved by an expert.
• Reply and keep only to this thread. If you have the same topic elsewhere, please inform me or the other forum so that either can be closed.
• Any advice is for your computer only and is taken at your own risk. Fixes sometimes will cause unexpected results, but I will do my best to assist you.
• If you have any doubts or problems during the fix, please stop and ask.
• Do not use or run any tools without supervision as they may cause more harm if improperly used.
• If you do not reply within 3 days, this topic will be closed.

If you are agreeable to the above, then everything should go smoothly . We may begin.
I am working on your log now and will be back the soonest.

At the mean time, please post an Uninstall list

• Open HijackThis.
• Go to Open the Misc Tools section by clicking on the box.
• Under the Systems tools, look for Open Uninstall Manager and click on it.
• Click Save list... and save the text file in a convenient location.
• Post the Uninstall list contents in your reply.

[Jack&Jill]

Hello mogli_saiyan,

It has been 3 days since my last post. Do you still need help? Any problems following my instructions? Need more time?

According to Malware Removal's latest policy, topics can be closed after 3 days without a response. If I do not get any within the next 24 hours, this topic will be closed.

[mogli_saiyan]

hello Jack&Jill,

thanks for the reply.

yes i would still like support.. just didnt know if i was gonna get a reply..

i will send the uninstall list asap!

br

[Jack&Jill]

Hello mogli_saiyan ,

No problem, I will wait for your Uninstall list.

All helpers here try our best to attend to all the logs as soon as we are able to, but there are more victims than helpers and most of us work at many forums, thus the delay in responding. If you wait patiently, you will definitely get a reply in due course. Once started, we always see you through until the problems are solved, or at least point you to the right direction if they are not malware-related. That said, hope to hear from you soon.

[mogli_saiyan]

hello Jack and Jill,

in the attachment the list..


br

[Jack&Jill]

Hello mogli_saiyan ,

Please copy and paste the contents of all the logs I request for. Attaching them would make it difficult for people following this topic, including myself.

AVG Free 8.5
Backburner
Boot Camp-Dienste
Canon MP Navigator 3.0
Canon MP160
Canon MP160 Benutzerregistrierung
CloneDVD2
Connect
DHTML Editing Component
DivX Web Player
DVD Shrink 3.2
ESET Online Scanner v3
FBX Plugin 2006.08 for Max 9.0
ffdshow [rev 2653] [2009-02-03]
FileZilla (remove only)
FileZilla Client 3.2.2.1
Fraps (remove only)
Free Video Converter V 2.0
GetDataBack for FAT
GLOBEtrotter FLEXid Drivers
Google Toolbar for Internet Explorer
HijackThis 2.0.2
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)
HP Imaging Device Functions 9.0
HP OCR Software 9.0
HP Photosmart Essential
HP Product Assistant
HP Scanjet G2710 9.0
HP Solution Center 9.0
HP Update
InFlac 1.1.1
iTunes
Java(TM) 6 Update 13
Java(TM) 6 Update 3
kuler
Loquendo TTS: Bernard (French)
Loquendo TTS: Elizabeth (British English)
Loquendo TTS: Juliette (French)
Loquendo TTS: LinLin (Chinese)
Loquendo TTS: Roberto (Italian)
Loquendo TTS: Simon (British English)
Loquendo TTS: Stefan (German)
Malwarebytes' Anti-Malware
Maya 2008 Extension 2
Maya 8.5 Documentation (en_US)
Microsoft .NET Framework 3.5 SP1
Microsoft .NET Framework 3.5 SP1
Microsoft Office Professional Edition 2003
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2005 Redistributable
Microsoft Works
Microsoft XNA Framework Redistributable 1.0 Refresh
Mobile Connect
Mobile Partner
Mozilla Firefox (3.0.11)
MSXML 4.0 SP2 (KB936181)
MSXML 4.0 SP2 (KB941833)
MSXML 4.0 SP2 (KB954430)
MyDSC2
N Schach 3
Nero 7 Ultra Edition
neroxml
NetChess
Notepad++
O&O DiskRecovery
Parallels Tools
PDF Settings CS4
Photoshop Camera Raw
Pixel Bender Toolkit
PowerISO
QuickTime
RealPlayer
RealSpeak Solo fur Deutsch - Steffi
Realtek High Definition Audio Driver
SD-SIGN netSchach
Sentinel System Driver
SigmaTel Audio
Skype™ 4.0
Some PDF to Word Converter 1.5
Spybot - Search & Destroy
Suite Shared Configuration CS4
SUPERAntiSpyware Free Edition
TextAloud
Trapcode Particular
TuneUp Utilities 2008
UltraVNC 1.0.4 RC12
VC80CRTRedist - 8.0.50727.762
VideoLAN VLC media player 0.8.6c
Winamp
Windows Driver Package - Apple Inc. (applebt) Bluetooth (06/27/2007 2.0.0.1)
Windows Driver Package - Apple Inc. Apple Bluetooth Enabler (06/27/2007 2.0.0.1)
Windows Driver Package - Apple Inc. Apple Built-in iSight (04/09/2007 1.3.0.0)
Windows Driver Package - Apple Inc. Apple IR Receiver (07/16/2007 2.0.0.1)
Windows Driver Package - Apple Inc. Apple Keyboard (07/18/2007 2.0.0.7)
Windows Driver Package - Apple Inc. Apple Trackpad (04/19/2007 1.3.0.2)
Windows Driver Package - Apple Inc. Apple Trackpad Enabler (04/19/2007 1.3.0.2)
Windows Driver Package - Apple Inc. System (06/21/2007 2.0.0.0)
Windows Driver Package - Atheros Communications Inc. (athr) Net (04/15/2007 7.2.0.204)
Windows Driver Package - Atheros Communications Inc. Net (04/15/2007 7.2.0.204)
Windows Driver Package - Marvell (yukonwlh) Net (03/23/2007 10.12.7.3)
Windows Live Sign-in Assistant
Windows Media Player Firefox Plugin
WinRAR
World of Warcraft FREE Trial
ZBrush3


Is this your personal computer? Do you know what is Parallels Tools and how is it being used?

For Windows Vista, please use right click and select Run as administrator instead of double click to run all the tools I ask you to, or they may not work properly.

Validate Windows

• Please download MGADiag.exe from Microsoft and save it to a convenient location. Click here.
• Double click on MGADiag.exe to run it.
• Click Continue.
• The program will run. It takes a while to finish the diagnosis, please be patient.
• Once done, click on Copy.
• Open Notepad and paste the contents in. Save this file and post it in your next reply.

Please download Rooter© by Eric_71 and save it to your desktop. Click here.

Run Rooter

• Double click on Rooter.exe to run the tool. Allow if prompted by your security softwares.
• Click on Scan to start scanning.
• When completed, a Notepad file containing the report will open, also found at %systemdrive%\Rooter$\Rooter_#.txt. %systemdrive% is usually C:\ and # is a number.
• Please post the contents of that report here.

Please post back:
1. answers to questions regarding your computer and Parallels Tools
2. MGADiag result
3. Rooter report

[Jack&Jill]

Hello mogli_saiyan,

It has been 3 days since my last post. Do you still need help? Any problems following my instructions? Need more time?

According to Malware Removal's latest policy, topics can be closed after 3 days without a response. If I do not get any within the next 24 hours, this topic will be closed.

[mogli_saiyan]

yes i would like more time.. have been very busy recently.

sorry for any inconvenience

br

[Jack&Jill]

Hello mogli_saiyan,

No problem if you need more time , but please let me know in advance. As you are already aware, Malware Removal has policy to close topic after 3 days without response. A message to inform before time is up would be sufficient to keep this topic active.

[askey127]

Due to Lack of Response this topic is now closed.

If you still require help, please open a new thread in the Infected? Virus, malware, adware, ransomware, oh my! forum, include a fresh FRST log, and wait for a new helper.