chasdean

Members
 View Profile  See their activity

  • Content Count

    1

  • Joined

  • Last visited

 Content Type 

Posts posted by chasdean

  1. Spyware Since System Restore[INACTIVE]

    in Malware Removal

    Posted

    I had a tragic experience with system restore - loosing documents, contacts, etc. Having to recover and reassemble ...that's done. But all my spyware protection has been lost and I've been plagued with pop ups etc. since this happened. I've run Spybot and Ad-Aware frequently in normal and safe mode - I've also turned off system restore and reun them both.

    Here's my Hijack this Log:

    Logfile of HijackThis v1.99.1

    Scan saved at 9:57:07 AM, on 2/28/2006

    Platform: Windows XP SP2 (WinNT 5.01.2600)

    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

    Running processes:

    C:\WINNT\System32\smss.exe

    C:\WINNT\system32\winlogon.exe

    C:\WINNT\system32\services.exe

    C:\WINNT\system32\lsass.exe

    C:\WINNT\system32\svchost.exe

    C:\WINNT\System32\svchost.exe

    C:\WINNT\system32\spoolsv.exe

    C:\WINNT\Explorer.EXE

    C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe

    C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

    C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

    C:\Program Files\Common Files\AOL\ACS\AOLDial.exe

    C:\Program Files\Yahoo!\Yahoo! Music Engine\ymetray.exe

    C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe

    C:\PROGRA~1\COMMON~1\AOL\111415~1\EE\AOLHOS~1.EXE

    C:\Program Files\Brother\ControlCenter2\brctrcen.exe

    C:\Program Files\iTunes\iTunesHelper.exe

    C:\Program Files\Common Files\Real\Update_OB\realsched.exe

    C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

    C:\Program Files\QuickTime\qttask.exe

    C:\Program Files\Daily Weather Forecast\weather.exe

    C:\PROGRA~1\COMMON~1\AOL\111415~1\EE\AOLServiceHost.exe

    C:\DOCUME~1\OWNERC~1.009\APPLIC~1\ASEMBL~1\regedit.exe

    C:\WINNT\system32\l?gonui.exe

    C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe

    C:\Documents and Settings\All Users\Application Data\U3\U3Launcher\LaunchU3.exe

    C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe

    C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe

    C:\WINNT\system32\Brmfrmps.exe

    C:\WINNT\system32\drivers\KodakCCS.exe

    C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe

    C:\WINNT\System32\svchost.exe

    C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe

    C:\WINNT\system32\BRMFRSMG.EXE

    C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe

    C:\Program Files\Brother\Brmfl04e\FAXRX.exe

    C:\Program Files\iPod\bin\iPodService.exe

    C:\Program Files\ScanSoft\PaperPort\PaprPort.exe

    C:\Program Files\ScanSoft\PaperPort\pplinks.exe

    C:\Program Files\ScanSoft\PaperPort\ppscanmg.exe

    C:\PROGRA~1\MI1933~1\Office\OUTLOOK.EXE

    C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

    C:\Program Files\Internet Explorer\iexplore.exe

    C:\Documents and Settings\Owner.CHARLESDT.009\Desktop\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.bloomberg.com/markets/index.html?Intro=intro

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://red.clientapps.yahoo.com/customize/...rch/search.html

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://red.clientapps.yahoo.com/customize/...//www.yahoo.com

    R3 - URLSearchHook: (no name) - {FBE44EA9-D368-FA9F-4FF0-855A6C3F12E3} - C:\WINNT\system32\hmyivdj.dll

    O1 - Hosts: 66.195.127.98 www.escrow.com

    O1 - Hosts: 66.195.127.98 my.escrow.com

    O1 - Hosts: 66.195.127.98 escrow.com

    O1 - Hosts: 66.195.127.98 ww.escrow.com

    O1 - Hosts: 66.195.127.98 wwww.escrow.com

    O1 - Hosts: 66.195.127.98 www.escrow.com

    O1 - Hosts: 66.195.127.98 my.escrow.com

    O1 - Hosts: 66.195.127.98 escrow.com

    O1 - Hosts: 66.195.127.98 ww.escrow.com

    O1 - Hosts: 66.195.127.98 wwww.escrow.com

    O1 - Hosts: 66.195.127.98 www.escrow.com

    O1 - Hosts: 66.195.127.98 my.escrow.com

    O1 - Hosts: 66.195.127.98 escrow.com

    O1 - Hosts: 66.195.127.98 ww.escrow.com

    O1 - Hosts: 66.195.127.98 wwww.escrow.com

    O1 - Hosts: 66.195.127.98 www.escrow.com

    O1 - Hosts: 66.195.127.98 my.escrow.com

    O1 - Hosts: 66.195.127.98 escrow.com

    O1 - Hosts: 66.195.127.98 ww.escrow.com

    O1 - Hosts: 66.195.127.98 wwww.escrow.com

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

    O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll

    O2 - BHO: (no name) - {549B5CA7-4A86-11D7-A4DF-000874180BB3} - (no file)

    O2 - BHO: (no name) - {724d43a9-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll

    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

    O2 - BHO: (no name) - {FBE44EA9-D368-FA9F-4FF0-855A6C3F12E3} - C:\WINNT\system32\hmyivdj.dll

    O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

    O3 - Toolbar: &RoboForm - {724d43a0-0d85-11d4-9908-00400523e39a} - C:\Program Files\Siber Systems\AI RoboForm\roboform.dll

    O4 - HKLM\..\Run: [pccguide.exe] "C:\Program Files\Trend Micro\Internet Security 2005\pccguide.exe"

    O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

    O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

    O4 - HKLM\..\Run: [HostManager] C:\Program Files\Common Files\AOL\1114150098\EE\AOLHostManager.exe

    O4 - HKLM\..\Run: [AOLDialer] C:\Program Files\Common Files\AOL\ACS\AOLDial.exe

    O4 - HKLM\..\Run: [ymetray] "C:\Program Files\Yahoo!\Yahoo! Music Engine\ymetray.exe"

    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k

    O4 - HKLM\..\Run: [sSBkgdUpdate] "C:\Program Files\Common Files\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot

    O4 - HKLM\..\Run: [PaperPort PTD] C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe

    O4 - HKLM\..\Run: [indexSearch] C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe

    O4 - HKLM\..\Run: [setDefPrt] C:\Program Files\Brother\Brmfl04e\BrStDvPt.exe

    O4 - HKLM\..\Run: [ControlCenter2.0] C:\Program Files\Brother\ControlCenter2\brctrcen.exe /autorun

    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

    O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

    O4 - HKLM\..\Run: [Daily Weather Forecast] C:\Program Files\Daily Weather Forecast\weather.exe

    O4 - HKCU\..\Run: [Earu] "C:\DOCUME~1\OWNERC~1.009\APPLIC~1\ASEMBL~1\regedit.exe" -vt yazb

    O4 - HKCU\..\Run: [Ymfik] C:\WINNT\system32\l?gonui.exe

    O4 - HKCU\..\Run: [RoboForm] "C:\Program Files\Siber Systems\AI RoboForm\RoboTaskBarIcon.exe"

    O4 - Startup: LaunchU3.exe.lnk = ?

    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe

    O4 - Global Startup: Desktop Manager.lnk = C:\Program Files\Research In Motion\BlackBerry\DesktopMgr.exe

    O4 - Global Startup: eFax DllCmd 3.5.lnk = C:\Program Files\eFax Messenger 3.5\J2GDllCmd.exe

    O4 - Global Startup: eFax Tray Menu 3.5.lnk = C:\Program Files\eFax Messenger 3.5\J2GTray.exe

    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE

    O8 - Extra context menu item: Customize Menu - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComCustomizeIEMenu.html

    O8 - Extra context menu item: Fill Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html

    O8 - Extra context menu item: RoboForm Toolbar - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html

    O8 - Extra context menu item: Save Forms - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html

    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

    O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll

    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll

    O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Program Files\Microsoft ActiveSync\inetrepl.dll

    O9 - Extra button: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html

    O9 - Extra 'Tools' menuitem: Fill Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F46} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComFillForms.html

    O9 - Extra button: Save - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html

    O9 - Extra 'Tools' menuitem: Save Forms - {320AF880-6646-11D3-ABEE-C5DBF3571F49} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComSavePass.html

    O9 - Extra button: RoboForm - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html

    O9 - Extra 'Tools' menuitem: RoboForm Toolbar - {724d43aa-0d85-11d4-9908-00400523e39a} - file://C:\Program Files\Siber Systems\AI RoboForm\RoboFormComShowToolbar.html

    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINNT\System32\Shdocvw.dll

    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

    O16 - DPF: {1239CC52-59EF-4DFA-8C61-90FFA846DF7E} (Musicnotes Viewer) - http://www.musicnotes.com/download/mnviewer.cab

    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204

    O16 - DPF: {196C0CF5-6C4E-43C5-98BB-86DE44D44B88} (ByteClickLoanWF Control) - https://ilnet.wellsfargo.com/ilonline/crs/h...clickloanwf.cab

    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/...b?1120669920468

    O16 - DPF: {6F750200-1362-4815-A476-88533DE61D0C} (Ofoto Upload Manager Class) - http://www.kodakgallery.com/downloads/BUM/..._1/axofupld.cab

    O16 - DPF: {7DD62E58-5FA8-11D2-AFB7-00104B64F126} (Sview Control) - http://www.swiftview.com/product/current/l...all_a_green.exe

    O16 - DPF: {A8683C98-5341-421B-B23C-8514C05354F1} (FujifilmUploader Class) - http://photo.walmart.com/photo/uploads/Fuj...ploadClient.cab

    O16 - DPF: {DF05D910-DC8E-403A-93B0-5C866F3200D1} (PtClickLoan Control) - https://www.clickloan.com/CAB/PtClickLoan/1...PtClickLoan.cab

    O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = aamortg.local

    O17 - HKLM\Software\..\Telephony: DomainName = aamortg.local

    O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = aamortg.local

    O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = aamortg.local

    O23 - Service: AOL Connectivity Service (AOL ACS) - America Online - C:\Program Files\Common Files\AOL\ACS\AOLAcsd.exe

    O23 - Service: AOL TopSpeed Monitor (AOL TopSpeedMonitor) - America Online, Inc - C:\Program Files\Common Files\AOL\TopSpeed\2.0\aoltsmon.exe

    O23 - Service: Brother Popup Suspend service for Resource manager (brmfrmps) - Unknown owner - C:\WINNT\system32\Brmfrmps.exe" -service (file missing)

    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe

    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe

    O23 - Service: Kodak Camera Connection Software (KodakCCS) - Eastman Kodak Company - C:\WINNT\system32\drivers\KodakCCS.exe

    O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe

    O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - Unknown owner - %ProgramFiles%\WinPcap\rpcapd.exe" -d -f "%ProgramFiles%\WinPcap\rpcapd.ini (file missing)

    O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Incorporated. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe

    O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe

    O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe

    Thanks for your help