This is a read-only archive of malwareremoval.com. No new posts or registrations. Privacy Page
Malware Removal Forums

HJT Log

17 min read

This thread's last reply is from March 1, 2006, 8:47 PM UTC. Software, malware, and removal-tool advice below may be out of date — treat specific steps and download links with caution.

ianr
February 26, 2006, 2:37 PM UTC
Hi can one of you good people check my log
Thanks
Ian

Logfile of HijackThis v1.99.1
Scan saved at 14:35:15, on 26/02/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Belkin\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\soundman.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\dpps2.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
C:\Program Files\Winamp\winampa.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Belkin\Bluetooth Software\BTTray.exe
C:\Program Files\Nikon\NkView5\NkvMon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\wuauclt.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Grisoft\AVG Free\avgcc.exe
C:\Documents and Settings\IAN\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.co.uk/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/customize/ie/defaults/stp/ymsgr*http://my.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WebCam III SetFirst] webc3uns setfirst
O4 - HKLM\..\Run: [WebCam Autolaunch] webc3lch
O4 - HKLM\..\Run: [Pop-Up Stopper] "C:\PROGRA~1\PANICW~1\POP-UP~1\dpps2.exe"
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_06\bin\jusched.exe
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView5\NkvMon.exe
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_06\bin\npjpi142_06.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: AOL Instant Messenger (TM) - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay102.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1121099615013
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan ... asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://static.photobox.co.uk/sg/common/uploader.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4379/mcfscan.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O16 - DPF: {FF3F0F03-0F01-131A-A3F9-08F02B23E0CC} - http://66.117.37.13/gba2335.exe
O17 - HKLM\System\CCS\Services\Tcpip\..\{F2AA399D-AC7B-4D6C-9A82-088458F34663}: NameServer = 62.241.162.200 62.241.163.201
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\Belkin\Bluetooth Software\bin\btwdins.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
amateur
February 26, 2006, 3:05 PM UTC
Hi ianr,

Welcome to MR. :D

Please download Ccleaner but do not use it yet.

Ccleaner

======================================

Scan with HijackThis and put a checkmark against the following entries:


R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/customize/ie/defaults/stp/ymsgr*http://my.yahoo.com
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O16 - DPF: {FF3F0F03-0F01-131A-A3F9-08F02B23E0CC} - http://66.117.37.13/gba2335.exe
Close all other browsers/windows, except HijackThis and click on "fix checked".

======================================

Next, please reboot your computer in Safe Mode by doing the following:
1) Restart your computer
2) After hearing your computer beep once during startup, but before the Windows icon appears, press F8.
3) Instead of Windows loading as normal, a menu should appear
4) Select the first option, to run Windows in Safe Mode.
Look in here for more information.

======================================

We need to do a search. Start > Search > All Files and Folders.
Expand Search Options, check Advanced Options, check Search system folders, Search hidden files and folders, and Search Subfolders.
Paste this into the Search for files and folders named box:

gba2335.exe

and delete it, if found.

=======================================

Run Ccleaner

Click on Options, Select Advanced Now UNCHECK "Only delete files in Windows Temp folders older than 48 hours"
Make sure the Cleaner block on the left is selected. (Do not use the "Issues" block) Choose the Windows tab.
Check everything EXCEPT cookies, the Autocomplete Form History and the Advanced part of the Menu.
Choose Run Cleaner. This process could take a while.
When CCleaner shows how much has been removed, cleaning is finished. Click Exit.

=======================================

Restart your computer in Normal Mode.

=======================================

You have an old and vulnerable version of the Java Runtime Environment (JRE) installed. Please go to this link and it will describe how you can remove your old version and update to a new JRE:
http://wiki.castlecops.com/Windows_Update_Fix

=======================================

Run Panda's ActiveScan from here and perform a full system scan.
- Once you are on the Panda site click the "Scan your PC" button
- A new window will open...click the big "Check Now" button
- Enter your Country
- Enter your State/Province
- Enter your e-mail address and click send
- Select either Home User or Company
- Click the big Scan Now button
- If it wants to install an ActiveX component allow it
- It will start downloading the files it requires for the scan (Note: It will take a couple minutes)
- Click on "Local Disks" to start the scan
- When the scan completes, if anything malicious is detected, click the See Report button, then Save Report and save it to a convenient location.

=======================================

Post a new HijackThis and the online scan result.
ianr
February 26, 2006, 4:19 PM UTC
My new HJT log:

Logfile of HijackThis v1.99.1
Scan saved at 16:16:31, on 26/02/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
C:\Program Files\Belkin\Bluetooth Software\bin\btwdins.exe
C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
C:\WINDOWS\System32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\soundman.exe
C:\PROGRA~1\PANICW~1\POP-UP~1\dpps2.exe
C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Winamp\winampa.exe
C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe
C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE
C:\Program Files\Belkin\Bluetooth Software\BTTray.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\Program Files\Nikon\NkView5\NkvMon.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Documents and Settings\IAN\Desktop\hijackthis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.co.uk/
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [SoundMan] soundman.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [WebCam III SetFirst] webc3uns setfirst
O4 - HKLM\..\Run: [WebCam Autolaunch] webc3lch
O4 - HKLM\..\Run: [Pop-Up Stopper] "C:\PROGRA~1\PANICW~1\POP-UP~1\dpps2.exe"
O4 - HKLM\..\Run: [SpeedTouch USB Diagnostics] "C:\Program Files\Alcatel\SpeedTouch USB\Dragdiag.exe" /icon
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\System32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\WCESCOMM.EXE"
O4 - Global Startup: Adobe Gamma Loader.exe.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: BTTray.lnk = ?
O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
O4 - Global Startup: NkvMon.exe.lnk = C:\Program Files\Nikon\NkView5\NkvMon.exe
O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie_ctx.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\INETREPL.DLL
O9 - Extra button: AOL Instant Messenger (TM) - {AC9E2541-2814-11d5-BC6D-00B0D0A1DE45} - C:\WINDOWS\System32\shdocvw.dll
O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\Belkin\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: ppctlcab - http://www.pestscan.com/scanner/ppctlcab.cab
O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://download.ewido.net/ewidoOnlineScan.cab
O16 - DPF: {2FC9A21E-2069-4E47-8235-36318989DB13} (PPSDKActiveXScanner.MainScreen) - http://www.pestscan.com/scanner/axscanner.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by102fd.bay102.hotmail.msn.com/resources/MsnPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1121099615013
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) - http://a840.g.akamai.net/7/840/537/2004061001/housecall.trendmicro.com/housecall/xscan53.cab
O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan ... asinst.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/MsnMessengerSetupDownloader.cab
O16 - DPF: {CE3409C4-9E26-4F8E-83E4-778498F9E7B4} (PB_Uploader Class) - http://static.photobox.co.uk/sg/common/uploader.cab
O16 - DPF: {EF791A6B-FC12-4C68-99EF-FB9E207A39E6} (McFreeScan Class) - http://download.mcafee.com/molbin/iss-loc/vso/en-us/tools/mcfscan/2,0,0,4379/mcfscan.cab
O16 - DPF: {F58E1CEF-A068-4C15-BA5E-587CAF3EE8C6} (MSN Chat Control 4.5) - http://fdl.msn.com/public/chat/msnchat45.cab
O16 - DPF: {FE0BD779-44EE-4A4B-AA2E-743C63F2E5E6} (IWinAmpActiveX Class) - http://pdl.stream.aol.com/downloads/aol/unagi/ampx_en_dl.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{F2AA399D-AC7B-4D6C-9A82-088458F34663}: NameServer = 62.241.162.200 62.241.163.201
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - "C:\PROGRA~1\MSNMES~1\msgrapp.dll" (file missing)
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVGFRE~1\avgemc.exe
O23 - Service: Bluetooth Service (btwdins) - WIDCOMM, Inc. - C:\Program Files\Belkin\Bluetooth Software\bin\btwdins.exe
O23 - Service: EPSON Printer Status Agent2 (EPSONStatusAgent2) - SEIKO EPSON CORPORATION - C:\Program Files\Common Files\EPSON\EBAPI\SAgent2.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe




And my online scan results:

Incident Status Location

Spyware:Cookie/Com.com Not disinfected C:\Documents and Settings\IAN\Cookies\ian@com[2].txt
Spyware:Cookie/Statcounter Not disinfected C:\Documents and Settings\IAN\Cookies\ian@statcounter[2].txt
Spyware:Cookie/Xmts Not disinfected C:\Documents and Settings\IAN\Cookies\ian@xmts[2].txt
Spyware:Cookie/2o7.net Not disinfected C:\Documents and Settings\Mandy\Cookies\mandy@112.2o7[2].txt
Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Mandy\Cookies\mandy@atdmt[2].txt
Spyware:Cookie/Hitbox Not disinfected C:\Program Files\Spybot - Search & Destroy 1.1\Recovery\HitBox.zip[ian@hitbox[1].txt]
Spyware:Cookie/Apmebf Not disinfected C:\RECYCLER\NPROTECT\00028093.TXT
Spyware:Cookie/QkSrv Not disinfected C:\RECYCLER\NPROTECT\00028094.TXT
Spyware:Cookie/2o7.net Not disinfected C:\RECYCLER\NPROTECT\00028095.TXT
Spyware:Cookie/2o7.net Not disinfected C:\RECYCLER\NPROTECT\00028096.TXT
Spyware:Cookie/2o7.net Not disinfected C:\RECYCLER\NPROTECT\00028097.TXT
Spyware:Cookie/2o7.net Not disinfected C:\RECYCLER\NPROTECT\00028098.TXT
Spyware:Cookie/2o7.net Not disinfected C:\RECYCLER\NPROTECT\00028099.TXT
Spyware:Cookie/2o7.net Not disinfected C:\RECYCLER\NPROTECT\00028100.TXT
Spyware:Cookie/2o7.net Not disinfected C:\RECYCLER\NPROTECT\00028107.TXT
Spyware:Cookie/2o7.net Not disinfected C:\RECYCLER\NPROTECT\00028108.TXT
Spyware:Cookie/2o7.net Not disinfected C:\RECYCLER\NPROTECT\00028109.TXT
Spyware:Cookie/2o7.net Not disinfected C:\RECYCLER\NPROTECT\00028110.TXT
Spyware:Cookie/Tradedoubler Not disinfected C:\RECYCLER\NPROTECT\00028164.TXT
Spyware:Cookie/2o7.net Not disinfected C:\RECYCLER\NPROTECT\00028204.TXT
Spyware:Cookie/Zedo Not disinfected C:\RECYCLER\NPROTECT\00028205.TXT
Spyware:Cookie/Zedo Not disinfected C:\RECYCLER\NPROTECT\00028206.TXT
Spyware:Cookie/2o7.net Not disinfected C:\RECYCLER\NPROTECT\00028208.TXT
Spyware:Cookie/2o7.net Not disinfected C:\RECYCLER\NPROTECT\00028209.TXT
Spyware:Cookie/2o7.net Not disinfected C:\RECYCLER\NPROTECT\00028210.TXT
Spyware:Cookie/2o7.net Not disinfected C:\RECYCLER\NPROTECT\00028211.TXT
Spyware:Cookie/2o7.net Not disinfected C:\RECYCLER\NPROTECT\00028212.TXT
Spyware:Cookie/2o7.net Not disinfected C:\RECYCLER\NPROTECT\00028213.TXT
Spyware:Cookie/2o7.net Not disinfected C:\RECYCLER\NPROTECT\00028214.TXT
Spyware:Cookie/Tradedoubler Not disinfected C:\RECYCLER\NPROTECT\00028222.TXT
Spyware:Cookie/2o7.net Not disinfected C:\RECYCLER\NPROTECT\00028268.TXT
Spyware:Cookie/2o7.net Not disinfected C:\RECYCLER\NPROTECT\00028269.TXT
Spyware:Cookie/Apmebf Not disinfected C:\RECYCLER\NPROTECT\00028296.TXT
Spyware:Cookie/QkSrv Not disinfected C:\RECYCLER\NPROTECT\00028297.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028306.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028307.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028308.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028309.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028310.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028311.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028312.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028313.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028314.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028315.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028316.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028317.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028318.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028319.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028320.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028321.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028322.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028323.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028324.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028325.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028326.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028327.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028328.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028329.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028330.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028331.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028332.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028333.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028334.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028335.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028336.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028337.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028338.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028339.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028340.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028341.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028342.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028343.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028344.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028345.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028346.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028347.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028348.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028349.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028350.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028351.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028352.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028353.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028354.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028355.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028356.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028357.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028358.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028359.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028360.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028361.TXT
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00028367.TXT
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00028371.TXT
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00028373.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028382.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028383.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028406.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028408.TXT
Spyware:Cookie/NewMedia Not disinfected C:\RECYCLER\NPROTECT\00028418.TXT
Spyware:Cookie/Tradedoubler Not disinfected C:\RECYCLER\NPROTECT\00028419.TXT
Spyware:Cookie/Tradedoubler Not disinfected C:\RECYCLER\NPROTECT\00028420.TXT
Spyware:Cookie/Bs.serving-sys Not disinfected C:\RECYCLER\NPROTECT\00028427.TXT
Spyware:Cookie/Serving-sys Not disinfected C:\RECYCLER\NPROTECT\00028428.TXT
Spyware:Cookie/Serving-sys Not disinfected C:\RECYCLER\NPROTECT\00028429.TXT
Spyware:Cookie/Serving-sys Not disinfected C:\RECYCLER\NPROTECT\00028430.TXT
Spyware:Cookie/Serving-sys Not disinfected C:\RECYCLER\NPROTECT\00028431.TXT
Spyware:Cookie/Hitbox Not disinfected C:\RECYCLER\NPROTECT\00028589.TXT
Spyware:Cookie/Hitbox Not disinfected C:\RECYCLER\NPROTECT\00028591.TXT
Spyware:Cookie/Hitbox Not disinfected C:\RECYCLER\NPROTECT\00028592.TXT
Spyware:Cookie/Hitbox Not disinfected C:\RECYCLER\NPROTECT\00028600.TXT
Spyware:Cookie/Hitbox Not disinfected C:\RECYCLER\NPROTECT\00028601.TXT
Spyware:Cookie/WebtrendsLive Not disinfected C:\RECYCLER\NPROTECT\00028687.TXT
Spyware:Cookie/Tradedoubler Not disinfected C:\RECYCLER\NPROTECT\00028692.TXT
Spyware:Cookie/Apmebf Not disinfected C:\RECYCLER\NPROTECT\00028870.TXT
Spyware:Cookie/QkSrv Not disinfected C:\RECYCLER\NPROTECT\00028871.TXT
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00028887.TXT
Spyware:Cookie/Server.iad.Liveperson Not disinfected C:\RECYCLER\NPROTECT\00028889.TXT
Spyware:Cookie/Apmebf Not disinfected C:\RECYCLER\NPROTECT\00029176.TXT
Spyware:Cookie/QkSrv Not disinfected C:\RECYCLER\NPROTECT\00029177.TXT
Adware:Adware/Antivirus-gold Not disinfected C:\RECYCLER\NPROTECT\00037117.exe
Adware:Adware/SBSoft Not disinfected C:\WINDOWS\Downloaded Program Files\webdlg32.inf
Adware:Adware/WurldMedia Not disinfected C:\WINDOWS\system32\MSCStat2.exe
amateur
February 26, 2006, 4:44 PM UTC
Hi Ianr,

Your log is clean. :D

Please delete the following files, using Windows Explorer (Press Windows key and E key at the same time to bring up Windows Explorer), in Safe Mode

Adware:Adware/SBSoft Not disinfected C:\WINDOWS\Downloaded Program Files\webdlg32.inf
Adware:Adware/WurldMedia Not disinfected C:\WINDOWS\system32\MSCStat2.exe


You have an old version of Spybot Search and Destroy. Please remove it via Start>Control Panel>Add/Remove Programs. Then, download version 1.4 and set it as follows:

Spybot S & D

Remember to "immunize" after updating so that the latest definitions can be enabled.

a. In the Menu Bar at the top of the Spybot window you will see 'Mode'. Make certain that 'default mode' has a check mark beside it.
b. Close ALL windows except Spybot S&D
c. Click the button to 'Search for Updates' then download and install the Updates.
d. Next click the button 'Check for Problems'
e. When Spybot is complete, it will be showing RED entries, BLACK entries and GREEN entries in the window.
f. Make sure that there is a check mark beside all of the RED entries ONLY.
g. Choose Fix Selected Problems and allow Spybot to fix the RED entries.

The rest are simply cookies in the Norton Protected recycle bin.
Click/right click on recycle bin and see if you have an option to delete Norton Protected cookies, and delete them. You can use your ATF cleaner on a regular base to clean your cookies in other accounts as well.

Now that you are clean, or seem to be, please follow these simple steps in order to keep your computer clean and secure.

Remember to hide your system files again.

Start>My Computer>Tools>Folder Options>View
Under the Hidden files and Folders heading uncheck Show hidden files and folders.
check the Hide protected operating system files (recommended) option.
Click Yes to confirm.
check the Hide file extensions for known file types.
Click OK.

Disable and Enable System Restore If you are using Windows ME or XP then you should disable and re-enable system restore to make sure there are no infected files found in a restore point. Because Windows regularly sets restorepoints, it's very possible that the malware, you have removed, is still present in the System Restore. If you put Windows back to such a restorepoint, this malware will be put back, as well.

This is the only way to clean these files: (You will lose all previous restore points which are likely to be infected.)
1. Right-click My Computer, and then click Properties.
2. On the System Restore tab, put a check mark in the 'Turn Off System Restore' check box.
3. Click OK, and then click Yes.

4. Restart the computer.
5. Repeat steps 1 - 2, this time clearing the box beside 'Turn Off System Restore', click 'OK'.

Reboot normally.

You can also find instructions on how to disable and re enable system restore here:
Windows XP System Restore Guide

And that's all. But to help protect you against further infections, and also to help prevent criminals using your computer to infect other people's computers on the web, I recommend the following: (You may already have some of the items)

Make your Internet Explorer more secure - This can be done by following these simple instructions:

From within Internet Explorer click on the Tools menu and then click on Options.
Click once on the Security tab
Click once on the Internet icon so it becomes highlighted.
Click once on the Custom Level button.
Change the Download signed ActiveX controls to Prompt
Change the Download unsigned ActiveX controls to Disable
Change the Initialise and script ActiveX controls not marked as safe to Disable
Change the Installation of desktop items to Prompt
Change the Launching programs and files in an IFRAME to Prompt
Change the Navigate sub-frames across different domains to Prompt
When all these settings have been made, click on the OK button.
If it prompts you as to whether or not you want to save the settings, press the Yes button.
Next press the Apply button and then the OK to exit the Internet Properties page.

Avoid illegal sites, because that's where most malware is present.

* Don't click on links inside popups.
* Don't click on links in spam messages claiming to offer anti-spyware software; because most of these so called removers ARE spyware.
* Download free software only from sites you know and trust. Because a lot of free software can bundle other software, including spyware.

Keep your antivirus-program up-to-date and do regular scans with it. Please make sure that you have only one active antivirus program on your system.
If you haven't got a antivirus, you can download and install one of the following free ones: Make sure that you have only ONE antivirus running on your computer as more than one would cause conflict and render the computer vulnerable.

AVG Free here
AntiVir here
Avast here

It is essential to keep the anti-virus program fully updated. New virus infections are being produced all the time, and unless the program downloads the latest 'definitions', it cannot protect you against the newer versions. If you want to check for updates manually I'd recommended doing so at least once a week. However, a better option is to set the program to download and install updates automatically every time you are connected to the Internet. The first time you use it, please set it to perform a full system scan.
IMPORTANT: You Need to Update Windows and Internet Explorer to protect your computer from the malware that is around on the Internet. Please go to the windows update site <http://windowsupdate.microsoft.com/> to get the critical updates.

If you are running Microsoft Office, or any portion thereof, go to the Microsoft's Office Update site <http://office.microsoft.com/officeupdate/maincatalog.aspx?lc=en-us> and make sure you have at least all the critical updates installed (Free) Microsoft Office Update.

Keep your pestware-scanners up-to-date and do regular scans with them.

To keep your computer free of Spyware, Adware, Hijackers etc., download and install the following free pestware-scanners (if you haven't installed them allready):
AdAware here
Spybot here Remember to "immunize" after each update
Microsoft Antispyware here

Install realtime pestware-scanners and keep them up-to-date.

The following free realtime pestscanners prevent a number of malware-variants from entering your computer, in the first place:

SpywareBlaster here Remember to "enable all protection" after each update.
SpywareGuard here

If you haven't got one, already, install a firewall and keep it up-to-date. Please make sure that you have only one active firewall on your system.

A firewall will prevent unauthorized contact between your computer and internet.
If there is no firewall installed on your computer, you can download and install one of the following free firewalls:
ZoneAlarm here
Sygate here
Kerio Personal Firewall here
Outpost here
Important: (Windows XP only) If you install a firewall, be sure to turn off the WinXP-firewall!

Test your firewall here to make sure that it's working properly

Install these programs, to make surfing with Internet Explorer safer:

A popup-blocker, f.e. Google Toolbar here: A popup-blocker prevents popup-windows from opening, when you come along a websites that uses them, during internet-surfing.

IE-SPYAD here: This utility adds a long list of known bad sites to Internet Explorer's Restricted Sites zone. This prevents those sites from executing their malicious programs on your computer.

SiteHound by Firetrust
here:

Firetrust introduces the SiteHound Toolbar - the safe way to browse the Internet. With SiteHound, when you browse the Internet, you're shown a warning page every time you go to a site which is a known scam, potentially loads viruses or spyware on to your computer, has questionable content or anything you would not consider reasonable. You are shown a warning page with information about that site. From there you can choose to enter the site or go back. SiteHound is a free add-on to Internet Explorer. (Users of Firefox - a version for you is coming soon.) SiteHound's comprehensive database gathers the knowledge from other users and respected experts from the online security community to tell you which sites are real and which are bogus.

SiteHound will alert you when you enter a site which is known to contain:
· Fraudulent claims or scams
· Offensive material
· Security vulnerabilities
· Spyware or Adware
· Spam related material
· or other content deemed to be unsafe
Specifically, SiteHound blocks these categories:

• Adult • Spyware • Spam Advertising • Phishing • Possible scam or fraud • Misleading or False Advertising
• Pharming • Rogue or Suspect Product • Adware • Malware or Virus

System Requirements:
Internet Explorer 5.5+ and Windows 95/98/NT 4/ME/2000/XP

Install and use an alternative browser to surf on the internet.

Because Internet Explorer is the most-used browser on the planet, most of the hijackers, adware and spyware are made to abuse your computer thru Internet Explorer.
Here are some good alternative browsers:
Mozilla Suite here
Mozilla Firefox here
Opera here
Netscape here
Important: You can not uninstall Internet Explorer.
First of all, it's part of Windows and you'll need it to download and install Windows Updates.
Secondly, There are some sites that are only accessable with Internet Explorer, e.g. most of the Online Malware-scanners.

But above all, keep all your software UP-TO-DATE at all time!!

Also, I would recommend reading the excellent advice by Tony Klein: So how did I get infected in the first place

Happy and safe surfing. ;)
ianr
February 26, 2006, 7:13 PM UTC
I will work my way through this lot tomorrow night.
Thank you very much for your time & info,i try to keep everything upto date but every now & again something springs up.

Thanks again amateur you have been a great help



Ian
NonSuch
March 1, 2006, 8:47 PM UTC
Glad we could be of assistance.

This topic is now closed. If you wish it reopened, please send us an email to 'admin at malwareremoval.com' with a link to your thread.

You can help support this site from this link :
Donations For Malware Removal

Do not bother contacting us if you are not the topic starter. A valid, working link to the closed topic is required along with the user name used. If the user name does not match the one in the thread linked, the email will be deleted.