Welcome guest. Before posting on our computer help forum, you must register. Click here it's easy and free.

« previous next »
Pages: [1]   Go Down

Author Topic: Need help removing malware  (Read 10486 times)

0 Members and 1 Guest are viewing this topic.

pims

    Topic Starter


    Rookie

    Need help removing malware
    « on: April 02, 2010, 05:05:23 PM »
    Hi everyone

    I have been infected with "System Security 2009" virus/malware.  everything i click gives me a message "the application cannot executed.  File xxx.exe is infected"

    I tried downloading rkill to stop it so i could run other removal tools but it isnt working.

    Please help
    Logged

    evilfantasy

    • Malware Removal Specialist


      • Genius
    • Calm like a bomb
      • Thanked: 493
    • Experience: Experienced
    • OS: Windows 11
    Re: Need help removing malware
    « Reply #1 on: April 02, 2010, 07:29:40 PM »
    Welcome to CH.

    What happened when you tried to run Rkill?
    Logged

    pims

      Topic Starter


      Rookie

      Re: Need help removing malware
      « Reply #2 on: April 02, 2010, 07:36:54 PM »
      I think I may have gotten rid of it.

      Initially when I would run rkill it would just bring up the dos window and immediately close.  I ended up rebooting in safe mode.   Then was able to run malwarebytes anti malware and so far it seems good.

      At least all the pop ups are gone

      Thanks
      Logged

      evilfantasy

      • Malware Removal Specialist


        • Genius
      • Calm like a bomb
        • Thanked: 493
      • Experience: Experienced
      • OS: Windows 11
      Re: Need help removing malware
      « Reply #3 on: April 02, 2010, 07:42:57 PM »
      Can you post the Malwarebytes log please. It can be found under the Logs tab in Malwarebytes.

      Also run this please and post that log also.

      Download TrendMicro HijackThis.exe (HJT) to the desktop.

      * Double-click on HJTInstall.
      * Click on the Install button.
      * It will automatically place HJT in C:\Program Files\TrendMicro\HijackThis\HijackThis.exe.
      * Upon install, HijackThis should open for you.
      * Important! If using Windows Vista or Windows 7, close HijackThis. Now right-click HijackThis and Run As Administrator
      * Click on the Do a system scan and save a log file button
      * HijackThis will scan and then a log will open in notepad.
      * Copy and then paste the entire contents of the log in your post.
      * Do not have HijackThis fix anything yet. Most of what it finds will be harmless or even required.
      Logged

      pims

        Topic Starter


        Rookie

        Re: Need help removing malware
        « Reply #4 on: April 03, 2010, 06:23:17 AM »
        Here is the latest log from Malware

        Malwarebytes' Anti-Malware 1.45
        www.malwarebytes.org

        Database version: 3947

        Windows 5.1.2600 Service Pack 2
        Internet Explorer 6.0.2900.2180

        4/03/10 8:18:51 AM
        mbam-log-2010-04-03 (08-18-51).txt

        Scan type: Full scan (C:\|D:\|)
        Objects scanned: 261840
        Time elapsed: 1 hour(s), 26 minute(s), 58 second(s)

        Memory Processes Infected: 0
        Memory Modules Infected: 0
        Registry Keys Infected: 0
        Registry Values Infected: 0
        Registry Data Items Infected: 0
        Folders Infected: 0
        Files Infected: 1

        Memory Processes Infected:
        (No malicious items detected)

        Memory Modules Infected:
        (No malicious items detected)

        Registry Keys Infected:
        (No malicious items detected)

        Registry Values Infected:
        (No malicious items detected)

        Registry Data Items Infected:
        (No malicious items detected)

        Folders Infected:
        (No malicious items detected)

        Files Infected:
        D:\System Volume Information\_restore{8BF12CBB-EDE1-467A-A6D7-54AE8CBDDA81}\RP568\A0968703.exe (Trojan.Agent) -> Quarantined and deleted successfully.



        Hijack this log:

        Logfile of Trend Micro HijackThis v2.0.2
        Scan saved at 8:23:39 AM, on 4/03/10
        Platform: Windows XP SP2 (WinNT 5.01.2600)
        MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
        Boot mode: Normal

        Running processes:
        C:\WINDOWS\System32\smss.exe
        C:\WINDOWS\system32\winlogon.exe
        C:\WINDOWS\system32\services.exe
        C:\WINDOWS\system32\lsass.exe
        C:\WINDOWS\system32\svchost.exe
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
        C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
        C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
        C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
        C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
        C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
        C:\WINDOWS\system32\spoolsv.exe
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
        C:\Program Files\CheckPoint\SSL Network Extender\slimsvc.exe
        C:\Program Files\Symantec AntiVirus\DefWatch.exe
        C:\WINDOWS\system32\DVDRAMSV.exe
        C:\WINDOWS\system32\Hummingbird\Connectivity\9.00\Inetd\inetd32.exe
        C:\Program Files\Hummingbird\Connectivity\9.00\Exceed\HumDisplayServer.exe
        C:\WINDOWS\system32\lxcfcoms.exe
        C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
        C:\WINDOWS\system32\nvsvc32.exe
        C:\Oracle9i\bin\omtsreco.exe
        C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
        C:\Program Files\Symantec AntiVirus\SavRoam.exe
        C:\WINDOWS\system32\svchost.exe
        C:\Program Files\Symantec AntiVirus\Rtvscan.exe
        C:\WINDOWS\system32\ThpSrv.exe
        C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe
        C:\Program Files\TOSHIBA\TME3\Tmesrv31.exe
        C:\WINDOWS\system32\CCM\CLICOMP\RemCtrl\Wuser32.exe
        C:\WINDOWS\system32\CCM\CcmExec.exe
        C:\WINDOWS\Explorer.EXE
        C:\Program Files\TOSHIBA\TME3\TMEEJME.EXE
        C:\WINDOWS\system32\00THotkey.exe
        C:\WINDOWS\system32\rundll32.exe
        C:\Program Files\Apoint2K\Apoint.exe
        C:\Program Files\TOSHIBA\DualPointUtility\TEDTray.exe
        C:\WINDOWS\AGRSMMSG.exe
        C:\WINDOWS\system32\thpsrv.exe
        C:\WINDOWS\system32\TFNF5.exe
        C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
        C:\WINDOWS\system32\TPSMain.exe
        C:\WINDOWS\system32\rundll32.exe
        C:\WINDOWS\system32\TPSODDCtl.exe
        C:\Program Files\TOSHIBA\TME3\TMERzCtl.EXE
        C:\Program Files\TOSHIBA\TME3\TMESBS32.EXE
        C:\Program Files\Apoint2K\Apntex.exe
        C:\WINDOWS\System32\svchost.exe
        C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe
        C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
        C:\Program Files\TOSHIBA\TAudEffect\TAudEff.exe
        C:\WINDOWS\system32\TPSBattM.exe
        C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
        C:\WINDOWS\System32\DLA\DLACTRLW.EXE
        C:\Program Files\ltmoh\Ltmoh.exe
        C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
        C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
        C:\Program Files\Common Files\Symantec Shared\ccApp.exe
        C:\PROGRA~1\SYMANT~1\VPTray.exe
        C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
        C:\Program Files\QuickTime\qttask.exe
        C:\Program Files\iTunes\iTunesHelper.exe
        C:\WINDOWS\vVX6000.exe
        C:\Program Files\Common Files\Real\Update_OB\realsched.exe
        C:\WINDOWS\system32\ctfmon.exe
        C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
        C:\Program Files\DAEMON Tools Lite\DTLite.exe
        C:\WINDOWS\system32\RAMASST.exe
        C:\Program Files\iPod\bin\iPodService.exe
        C:\Program Files\Mozilla Firefox\firefox.exe
        C:\Documents and Settings\gtsou\Desktop\Malwarebytes' Anti-Malware\mbam.exe
        C:\WINDOWS\system32\NOTEPAD.EXE
        C:\WINDOWS\system32\NOTEPAD.EXE
        C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

        R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.daemon-search.com/startpage
        R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5555
        O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
        O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
        O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
        O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Documents and Settings\All Users\Application Data\Real\RealPlayer\BrowserRecordPlugin\IE\rpbrowserrecordplugin.dll
        O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
        O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
        O4 - HKLM\..\Run: [00THotkey] C:\WINDOWS\system32\00THotkey.exe
        O4 - HKLM\..\Run: [000StTHK] 000StTHK.exe
        O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
        O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
        O4 - HKLM\..\Run: [NVRotateSysTray] rundll32.exe C:\WINDOWS\system32\nvsysrot.dll,Enable
        O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
        O4 - HKLM\..\Run: [DpUtil] C:\Program Files\TOSHIBA\DualPointUtility\TEDTray.exe
        O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
        O4 - HKLM\..\Run: [ThpSrv] thpsrv /logon
        O4 - HKLM\..\Run: [TFNF5] TFNF5.exe
        O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
        O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
        O4 - HKLM\..\Run: [TPSODDCtl] TPSODDCtl.exe
        O4 - HKLM\..\Run: [TMESRV.EXE] C:\Program Files\TOSHIBA\TME3\TMESRV31.EXE /Logon
        O4 - HKLM\..\Run: [TMERzCtl.EXE] C:\Program Files\TOSHIBA\TME3\TMERzCtl.EXE /Service
        O4 - HKLM\..\Run: [TMESBS.EXE] C:\Program Files\TOSHIBA\TME3\TMESBS32.EXE /Client
        O4 - HKLM\..\Run: [TOSDCR] TOSDCR.EXE
        O4 - HKLM\..\Run: [TosHKCW.exe] "C:\Program Files\TOSHIBA\Wireless Hotkey\TosHKCW.exe"
        O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
        O4 - HKLM\..\Run: [TAudEffect] C:\Program Files\TOSHIBA\TAudEffect\TAudEff.exe /run
        O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
        O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
        O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
        O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe"
        O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
        O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
        O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\VPTray.exe
        O4 - HKLM\..\Run: [HumMeteringClient] rundll32.exe "C:\Program Files\Hummingbird\Connectivity\9.00\Accessories\MeteringClient.dll",RegisterProduct
        O4 - HKLM\..\Run: [VERITAS NetBackup Client Job Tracker] \NetBackup\bin\tracker.exe
        O4 - HKLM\..\Run: [LXCFCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCFtime.dll,_RunDLLEntry@16
        O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
        O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
        O4 - HKLM\..\Run: [UnlockerAssistant] "C:\Program Files\Unlocker\UnlockerAssistant.exe"
        O4 - HKLM\..\Run: [VX6000] C:\WINDOWS\vVX6000.exe
        O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
        O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe"  -osboot
        O4 - HKLM\..\Run: [cftmon] C:\WINDOWS\system32\qgxb.exe
        O4 - HKLM\..\Run: [Eqezo] rundll32.exe "C:\WINDOWS\epuyiyoh.dll",Startup
        O4 - HKLM\..\Run: [Malwarebytes Anti-Malware (reboot)] "C:\Documents and Settings\gtsou\Desktop\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
        O4 - HKCU\..\Run: [updateMgr] "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
        O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
        O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
        O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
        O4 - S-1-5-18 Startup: IEHOME.LNK = C:\Documents and Settings\Default User\Local Settings\Temp\iehome.bat (User 'SYSTEM')
        O4 - .DEFAULT Startup: IEHOME.LNK = C:\Documents and Settings\Default User\Local Settings\Temp\iehome.bat (User 'Default user')
        O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
        O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
        O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
        O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
        O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
        O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
        O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
        O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
        O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
        O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
        O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
        O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
        O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
        O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe (file missing)
        O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} (Office Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=67633
        O16 - DPF: {05D44720-58E3-49E6-BDF6-D00330E511D3} (MSN Games – Matchmaking) - http://zone.msn.com/binFrameWork/v10/StagingUI.cab55579.cab
        O16 - DPF: {149E45D8-163E-4189-86FC-45022AB2B6C9} (SpinTop DRM Control) - file://C:\Program Files\Monopoly Here and Now\Images\stg_drm.ocx
        O16 - DPF: {2DE0C501-4D2A-11D4-BA31-0008C7F472F4} (EposOperations Control) - http://lclntfl1/encore/ActiveX/eposOperations.cab
        O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
        O16 - DPF: {32998E04-50FF-11D4-BA34-0008C7F472F4} (EposReports Control) - http://lclntfl1/encore/ActiveX/eposReports.cab
        O16 - DPF: {399CB6C4-7312-11D2-B4D9-00105A0422DF} (HHComponentActivator Class) - http://lclntfl1/encore/ActiveX/HHActiveX.cab
        O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (CDownloadCtrl Object) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.6.108.cab
        O16 - DPF: {3BB54395-5982-4788-8AF4-B5388FFDD0D8} (MSN Games – Buddy Invite) - http://zone.msn.com/BinFrameWork/v10/ZBuddy.cab55579.cab
        O16 - DPF: {40C52972-E535-42A0-9D3B-BC76217E63D9} (eposVerCtl Class) - http://lclntfl1/encore/ActiveX/eposVersionCtl.cab
        O16 - DPF: {47D39363-D193-47EA-8A75-41144B099491} (EposHostView Control) - http://lclntfl1/encore/ActiveX/eposHostView.cab
        O16 - DPF: {4BFD075D-C36E-4F28-BB0A-5D472795197A} (PowerLoader Class) - http://www.powerchallenge.com/applet/PowerLoader.cab
        O16 - DPF: {5736C456-EA94-4AAC-BB08-917ABDD035B3} (MSN Games – Game Chat) - http://zone.msn.com/binframework/v10/ZPAChat.cab55579.cab
        O16 - DPF: {594EF4A4-50F2-11D4-BA34-0008C7F472F4} (EposLogTrace Control) - http://lclntfl1/encore/ActiveX/eposLogTrace.cab
        O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1206581879859
        O16 - DPF: {6715D12F-213F-4C6E-ACE1-8A363F550B96} (CPlayFirstDoggieDashControl Object) - http://aolsvc.aol.com/onlinegames/free-trial-doggie-dash/DoggieDash.1.0.0.6.cab
        O16 - DPF: {6FE79ACA-A498-45E5-8BC4-1B9F380CE468} (Abx(gh) Control) - http://aolsvc.aol.com/onlinegames/ghadventureball/abxgh.cab
        O16 - DPF: {7BEA4D18-62F2-11D4-9917-00010233DC97} (EposEDBFormCtl Control) - http://lclntfl1/encore/ActiveX/eposEDBFormCtl.cab
        O16 - DPF: {7D492D61-303A-45C3-8A55-63449339943D} (CPlayFirstNightShiftControl Object) - http://aolsvc.aol.com/onlinegames/free-trial-the-nightshift-code/NightShiftCodeWeb.1.0.0.5.cab
        O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl.sun.com/webapps/download/AutoDL?BundleId=19588
        O16 - DPF: {94811A83-D5BA-46D3-96AF-BC94B9C311EB} (EposHelpMenu Control) - http://lclntfl1/encore/ActiveX/EposHelpMenu.cab
        O16 - DPF: {96556AA0-4325-11d5-8AA7-006008A71E67} (ROAM Help) - http://lclntfl1/encore/ActiveX/ROAMUser.cab
        O16 - DPF: {97A789C6-8C70-11D3-B390-006008A71FAA} (EposACCA Control) - http://lclntfl1/encore/ActiveX/eposACCA.cab
        O16 - DPF: {9BDF4724-10AA-43D5-BD15-AEA0D2287303} (MSN Games – Texas Holdem Poker) - http://zone.msn.com/bingame/zpagames/zpa_txhe.cab79352.cab
        O16 - DPF: {A44B2DE3-7AD0-42A8-B428-E44283B3973E} (EposDisplay Control) - http://lclntfl1/encore/ActiveX/eposDisplay.cab
        O16 - DPF: {A9699323-B893-4DE4-8A77-35167ECFFDD7} (EposMaintenance Control) - http://lclntfl1/encore/ActiveX/EposMaintenance.cab
        O16 - DPF: {AE3E8210-B33F-49C1-B4E2-860F5F4D732F} (Avocent DSView Session Launcher Control) - https://vwhqdsvp2/dsview/applets/viewerLauncher.cab
        O16 - DPF: {B213E7A3-9E5D-4B42-9091-7A913D2D7A59} (EposFileDown Control) - http://lclntfl1/encore/ActiveX/EposFileDown.cab
        O16 - DPF: {B4CB50E4-0309-4906-86EA-10B6641C8392} (SlimClient Class) - https://lclvpn1.loblaw.ca/SNX/CSHELL/extender.cab
        O16 - DPF: {B516CA4E-A5BA-405C-AFCF-A97F08CC7429} (GoBit Games Player) - http://aolsvc.aol.com/onlinegames/free-trial-burger-shop/GoBitGamesPlayer_v4.cab
        O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://cdn2.zone.msn.com/binFramework/v10/ZPAFramework.cab102118.cab
        O16 - DPF: {BAC761D3-DFFD-4DB4-A01D-173346E090A7} (CPlayFirstzenerchiControl Object) - http://aolsvc.aol.com/onlinegames/free-trial-zenerchi/ZenerchiWeb.1.0.0.10.cab
        O16 - DPF: {BAE1D8DF-0B35-47E3-A1E7-EEB3FF2ECD19} (CPlayFirstddfotgControl Object) - http://aolsvc.aol.com/onlinegames/free-trial-diner-dash-flo-on-the-go/ddfotg.1.0.0.33.cab
        O16 - DPF: {BFF1950D-B1B4-4AE8-B842-B2CCF06D9A1B} (Zylom Games Player) - http://aolsvc.aol.com/onlinegames/free-trial-yahtzee/zylomplayer.cab
        O16 - DPF: {C0C0CB9B-BFEB-47C2-90FA-BE9692875ADB} (CPlayFirstPetShopHopControl Object) - http://aolsvc.aol.com/onlinegames/free-trial-pet-shop-hop/petshophopweb.1.0.0.16.cab
        O16 - DPF: {C3CBFE35-9BE8-11D1-B31B-006008948294} (OrgPublisher PluginX) - http://www.aquire.com/codebase81/OrgPubX.cab
        O16 - DPF: {C55910F4-2EC6-404F-8545-476CA94E7503} (eposHelpViewer Class) - http://lclntfl1/encore/ActiveX/eposHelpView.cab
        O16 - DPF: {C7442243-FAEC-46AF-8157-E1736636C037} (eposDBMaintenance Control) - http://lclntfl1/encore/ActiveX/eposDBMaintenance.cab
        O16 - DPF: {C8671BE3-53EA-4460-A830-4C508F09EA19} (EposLog Control) - http://lclntfl1/encore/ActiveX/eposLog.cab
        O16 - DPF: {CAC181B0-4D70-402D-B571-C596A47D0CE0} (CBankshotZoneCtrl Class) - http://zone.msn.com/bingame/zpagames/zpa_pool.cab56649.cab
        O16 - DPF: {CC450D71-CC90-424C-8638-1F2DBAC87A54} (ArmHelper Control) - file://C:\Program Files\Monopoly\Images\armhelper.ocx
        O16 - DPF: {D2BBE042-8152-4B0B-9674-9A7292B83355} (EncSetupCtl Class) - http://lclntfl1/encore/ActiveX/eposActiveSetup.cab
        O16 - DPF: {D77EF652-9A6B-40C8-A4B9-1C0697C6CF41} (TikGames Online Control) - http://zone.msn.com/bingame/cnma/default/ct.cab
        O16 - DPF: {DA2AA6CF-5C7A-4B71-BC3B-C771BB369937} (MSN Games – Game Communicator) - http://zone.msn.com/binframework/v10/StProxy.cab55579.cab
        O16 - DPF: {DCEA263C-75E9-4029-F6AA-37F011CC4EF1} (IM2Webconference) - http://dialcom.com/spontania/download/SpontaniaVideoCollaboration.cab
        O16 - DPF: {E06E2E99-0AA1-11D4-ABA6-0060082AA75C} (GpcContainer Class) - https://loblaw.webex.com/client/T26L/webex/ieatgpc.cab
        O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} - http://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab
        O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = ngco.com
        O17 - HKLM\Software\..\Telephony: DomainName = ngco.com
        O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = ngco.com
        O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = ngco.com,westfair.,ngco.com;westfair.ca
        O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = ngco.com
        O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = ngco.com,westfair.,ngco.com;westfair.ca
        O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = ngco.com,westfair.,ngco.com;westfair.ca
        O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
        O18 - Filter hijack: text/html - {fdf9c98e-dbff-4f19-bc8b-cd3a3e0772a2} - C:\WINDOWS\system32\mst122.dll
        O20 - Winlogon Notify: TosBtNP - C:\WINDOWS\SYSTEM32\TosBtNP.dll
        O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
        O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
        O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
        O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
        O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
        O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
        O23 - Service: Check Point SSL Network Extender (cpextender) - Check Point Software Technologies - C:\Program Files\CheckPoint\SSL Network Extender\slimsvc.exe
        O23 - Service: Symantec AntiVirus Definition Watcher (DefWatch) - Symantec Corporation - C:\Program Files\Symantec AntiVirus\DefWatch.exe
        O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
        O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
        O23 - Service: Google Update Service (gupdate1cac195f179d7e4) (gupdate1cac195f179d7e4) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe
        O23 - Service: Hummingbird InetD (HCLInetd) - Hummingbird Ltd. - C:\WINDOWS\system32\Hummingbird\Connectivity\9.00\Inetd\inetd32.exe
        O23 - Service: Hummingbird Exceed Display Management (HumDisplayServer) - Hummingbird Ltd. - C:\Program Files\Hummingbird\Connectivity\9.00\Exceed\HumDisplayServer.exe
        O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
        O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
        O23 - Service: lxcf_device -   - C:\WINDOWS\system32\lxcfcoms.exe
        O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
        O23 - Service: OracleMTSRecoveryService - Oracle Corporation - C:\Oracle9i\bin\omtsreco.exe
        O23 - Service: OracleOracle9iClientCache - Unknown owner - C:\Oracle9i\BIN\ONRSD.EXE
        O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
        O23 - Service: LiveShare P2P Server 9 (RoxLiveShare9) - Unknown owner - C:\Program Files\Common Files\Roxio Shared\9.0\SharedCOM\RoxLiveShare9.exe (file missing)
        O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation  - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
        O23 - Service: SAVRoam (SavRoam) - symantec - C:\Program Files\Symantec AntiVirus\SavRoam.exe
        O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
        O23 - Service: Symantec SPBBCSvc (SPBBCSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
        O23 - Service: Symantec AntiVirus - Symantec Corporation - C:\Program Files\Symantec AntiVirus\Rtvscan.exe
        O23 - Service: TOSHIBA HDD Protection (Thpsrv) - TOSHIBA Corporation - C:\WINDOWS\system32\ThpSrv.exe
        O23 - Service: Tmesbs32 (Tmesbs) - TOSHIBA Corporation - C:\Program Files\TOSHIBA\TME3\Tmesbs32.exe
        O23 - Service: Tmesrv3 (Tmesrv) - TOSHIBA - C:\Program Files\TOSHIBA\TME3\Tmesrv31.exe

        --
        End of file - 20871 bytes

        Logged

        evilfantasy

        • Malware Removal Specialist


          • Genius
        • Calm like a bomb
          • Thanked: 493
        • Experience: Experienced
        • OS: Windows 11
        Re: Need help removing malware
        « Reply #5 on: April 03, 2010, 07:23:53 AM »
        The malware was not completely removed.

        Open HijackThis and select Do a system scan only

        Place a check mark next to the following entries: (if there)

        • R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=127.0.0.1:5555
        • O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
        • O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
        • O18 - Filter hijack: text/html - {fdf9c98e-dbff-4f19-bc8b-cd3a3e0772a2} - C:\WINDOWS\system32\mst122.dll
        .
        Important: Close all open windows except for HijackThis and then click Fix checked.

        Once completed, exit HijackThis.

        ----------

        Download Disable/Remove Windows Messenger to the desktop to remove Windows Messenger.

        Do not confuse Windows Messenger with MSN Messenger or Windows Live Messenger because they are not the same. Windows Messenger is a frequent cause of popups.

        Unzip the file on the desktop. Open the MessengerDisable.exe and choose the bottom box - Uninstall Windows Messenger and click Apply.

        Exit out of MessengerDisable then delete the two files that were put on the desktop.

        ----------
        Logged

        pims

          Topic Starter


          Rookie

          Re: Need help removing malware
          « Reply #6 on: April 03, 2010, 07:40:44 AM »
          Removed the 4 malware entries and disabled windows messaging.

          Thanks for all your help
          Logged

          evilfantasy

          • Malware Removal Specialist


            • Genius
          • Calm like a bomb
            • Thanked: 493
          • Experience: Experienced
          • OS: Windows 11
          Re: Need help removing malware
          « Reply #7 on: April 03, 2010, 08:47:30 PM »
          Sorry I meant to add more to that post. The computer is still infected.   :-\


          If you already have ComboFix be sure to delete it and download a new copy.

          Download ComboFix© by sUBs from one of the below links. Be sure to save it to the Desktop.

          Link #1
          Link #2

          **Note:  It is important that it is saved directly to your Desktop

          Close any open Web browsers. (Firefox, Internet Explorer, etc) before starting ComboFix.

          Temporarily disable your antivirus and any antispyware real time protection before performing a scan. Click this link to see a list of security programs that should be disabled and how to disable them.
           
          Double click combofix.exe & follow the prompts.
          Vista users Right-Click on ComboFix.exe and select Run as administrator (you will receive a UAC prompt, please allow it)
          When finished ComboFix will produce a log for you.
          Post the ComboFix log in your next reply.

          Important: Do not mouseclick ComboFix's window while it is running. That may cause it to stall.

          Remember to re-enable your antivirus and antispyware protection when ComboFix is complete.

          If you have problems with ComboFix usage, see How to use ComboFix


          Logged
          Pages: [1]   Go Up
          « previous next »