magnolia25

June 24, 2006

here's my homework-Steamhead

Logfile of HijackThis v1.99.1

Scan saved at 5:39:56 PM, on 6/24/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\LEXPPS.EXE

C:\WINDOWS\system32\cisvc.exe

C:\Program Files\ewido anti-malware\ewidoctrl.exe

c:\program files\mcafee.com\agent\mcdetect.exe

c:\PROGRA~1\mcafee.com\agent\mctskshd.exe

C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\Explorer.EXE

C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

C:\WINDOWS\BCMSMMSG.exe

C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Logitech\MouseWare\system\em_exec.exe

C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe

C:\WINDOWS\system32\wuauclt.exe

C:\HJT\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/home.html

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.comcast.net/

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Microsoft Internet Explorer presented by Comcast

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = :0

O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll

O2 - BHO: McBrwHelper Class - {227B8AA8-DAF2-4892-BD1D-73F568BCB24E} - c:\PROGRA~1\mcafee.com\mps\mcbrhlpr.dll

O2 - BHO: (no name) - {243B17DE-77C7-46BF-B94B-0B5F309A0E64} - C:\Program Files\Microsoft Money\System\mnyside.dll

O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll

O2 - BHO: (no name) - {FDD3B846-8D59-4ffb-8758-209B6AD74ACC} - (no file)

O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll

O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\System32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [nwiz] nwiz.exe /install

O4 - HKLM\..\Run: [MMTray] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

O4 - HKLM\..\Run: [sunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_06\bin\jusched.exe

O4 - HKLM\..\Run: [bCMSMMSG] BCMSMMSG.exe

O4 - HKLM\..\Run: [Microsoft Works Update Detection] C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

O4 - HKLM\..\Run: [MCAgentExe] c:\PROGRA~1\mcafee.com\agent\mcagent.exe

O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\mcupdate.exe

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime

O4 - HKLM\..\Run: [userFaultCheck] %systemroot%\system32\dumprep 0 -u

O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot

O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe

O4 - HKLM\..\Run: [mmtask] C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe

O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide

O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background

O4 - HKCU\..\Run: [Yahoo! Pager] C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet

O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe

O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar1.dll/cmsearch.html

O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar1.dll/cmbacklinks.html

O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar1.dll/cmcache.html

O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar1.dll/cmsimilar.html

O8 - Extra context menu item: Translate into English - res://c:\program files\google\GoogleToolbar1.dll/cmtrans.html

O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll

O9 - Extra button: ComcastHSI - {669B269B-0D4E-41FB-A3D8-FD67CA94F646} - http://www.comcast.net/ (file missing)

O9 - Extra button: Support - {8828075D-D097-4055-AA02-2DBFA9D85E8A} - http://www.comcastsupport.com/ (file missing)

O9 - Extra button: Help - {97809617-3937-4F84-B335-9BB05EF1A8D4} - http://online.comcast.net/help/ (file missing)

O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll

O9 - Extra button: MoneySide - {E023F504-0C5A-4750-A1E7-A9046DEA8A21} - C:\Program Files\Microsoft Money\System\mnyside.dll

O9 - Extra button: eBay - Homepage - {EF79EAC5-3452-4E02-B8BD-BA4C89F1AC7A} - C:\Program Files\IrfanView\Ebay\Ebay.htm (file missing)

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe

O16 - DPF: {11260943-421B-11D0-8EAC-0000C07D88CF} (iPIX ActiveX Control) - http://www.ipix.com/viewers/ipixx.cab

O16 - DPF: {288C5F13-7E52-4ADA-A32E-F5BF9D125F99} (CR64Loader Object) - http://www.miniclip.com/supergerball/miniclipGameLoader.dll

O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab

O16 - DPF: {D54160C3-DB7B-4534-9B65-190EE4A9C7F7} (SproutLauncherCtrl Class) - http://real.gamehouse.com/real/games/SproutLauncher.cab

O16 - DPF: {DA8484DE-52DB-4860-A986-61A8682E298A} (LiveX_v7.0.2.0) - https://www.childrenview.net/rooms/intercoa...hecker_6110.cab

O23 - Service: ewido security suite control - ewido networks - C:\Program Files\ewido anti-malware\ewidoctrl.exe

O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE

O23 - Service: McAfee WSC Integration (McDetect.exe) - McAfee, Inc - c:\program files\mcafee.com\agent\mcdetect.exe

O23 - Service: McAfee Task Scheduler (McTskshd.exe) - McAfee, Inc - c:\PROGRA~1\mcafee.com\agent\mctskshd.exe

O23 - Service: McAfee SecurityCenter Update Manager (mcupdmgr.exe) - McAfee, Inc - C:\PROGRA~1\McAfee.com\Agent\mcupdmgr.exe

O23 - Service: McAfee.com Personal Firewall Service (MpfService) - McAfee.com Corporation - C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe

O23 - Service: Intel® NMS (NMSSvc) - Intel Corporation - C:\WINDOWS\System32\NMSSvc.exe

O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\System32\nvsvc32.exe

---------------------------------------------------------

ewido anti-malware - Scan report

---------------------------------------------------------

+ Created on: 11:20:54 PM, 6/23/2006

+ Report-Checksum: 374AF8A6

+ Scan result:

C:\Documents and Settings\Cameron\Cookies\cameron@advertising[1].txt -> TrackingCookie.Advertising : Cleaned with backup

C:\Documents and Settings\Cameron\Cookies\[email protected][2].txt -> TrackingCookie.Casalemedia : Cleaned with backup

C:\Documents and Settings\Cameron\Cookies\cameron@atdmt[2].txt -> TrackingCookie.Atdmt : Cleaned with backup

C:\Documents and Settings\Cameron\Cookies\cameron@casalemedia[1].txt -> TrackingCookie.Casalemedia : Cleaned with backup

C:\Documents and Settings\Cameron\Cookies\cameron@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned with backup

C:\Documents and Settings\Cameron\Cookies\cameron@fastclick[1].txt -> TrackingCookie.Fastclick : Cleaned with backup

C:\Documents and Settings\Cameron\Cookies\[email protected][2].txt -> TrackingCookie.Fastclick : Cleaned with backup

C:\Documents and Settings\Cameron\Cookies\cameron@mediaplex[1].txt -> TrackingCookie.Mediaplex : Cleaned with backup

C:\Documents and Settings\Cameron\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Cleaned with backup

C:\Documents and Settings\Cameron\Cookies\cameron@serving-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned with backup

C:\Documents and Settings\Patricia\Cookies\patricia@doubleclick[1].txt -> TrackingCookie.Doubleclick : Cleaned with backup

C:\Documents and Settings\Stephanie\Cookies\stephanie@247realmedia[1].txt -> TrackingCookie.247realmedia : Cleaned with backup

C:\Documents and Settings\Stephanie\Cookies\stephanie@2o7[1].txt -> TrackingCookie.2o7 : Cleaned with backup

C:\Documents and Settings\Stephanie\Cookies\[email protected][2].txt -> TrackingCookie.Yieldmanager : Cleaned with backup

C:\Documents and Settings\Stephanie\Cookies\[email protected][1].txt -> TrackingCookie.Addynamix : Cleaned with backup

C:\Documents and Settings\Stephanie\Cookies\[email protected][2].txt -> TrackingCookie.Pointroll : Cleaned with backup

C:\Documents and Settings\Stephanie\Cookies\[email protected][1].txt -> TrackingCookie.Falkag : Cleaned with backup

C:\Documents and Settings\Stephanie\Cookies\[email protected][1].txt -> TrackingCookie.2o7 : Cleaned with backup

C:\Documents and Settings\Stephanie\Cookies\stephanie@overture[1].txt -> TrackingCookie.Overture : Cleaned with backup

C:\Documents and Settings\Stephanie\Cookies\[email protected][1].txt -> TrackingCookie.Overture : Cleaned with backup

C:\Documents and Settings\Stephanie\Cookies\stephanie@questionmarket[2].txt -> TrackingCookie.Questionmarket : Cleaned with backup

C:\Documents and Settings\Stephanie\Cookies\stephanie@serving-sys[2].txt -> TrackingCookie.Serving-sys : Cleaned with backup

C:\Documents and Settings\Stephanie\Cookies\stephanie@tacoda[1].txt -> TrackingCookie.Tacoda : Cleaned with backup

C:\Documents and Settings\Stephanie\Cookies\stephanie@trafficmp[2].txt -> TrackingCookie.Trafficmp : Cleaned with backup

C:\Documents and Settings\Stephanie\Cookies\stephanie@tribalfusion[2].txt -> TrackingCookie.Tribalfusion : Cleaned with backup

C:\Documents and Settings\Stephanie\Cookies\[email protected][1].txt -> TrackingCookie.Realtracker : Cleaned with backup

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP689\A0074061.exe -> Adware.Trymedia : Cleaned with backup

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP689\A0074062.exe -> Adware.Trymedia : Cleaned with backup

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP689\A0074063.dll -> Adware.Aws : Cleaned with backup

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP689\A0074064.exe -> Downloader.Agent.wp : Cleaned with backup

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP689\A0074065.exe -> Adware.180Solutions : Cleaned with backup

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP689\A0074066.dll -> Adware.Zango : Cleaned with backup

C:\System Volume Information\_restore{B37680B2-BA0A-4E5D-BF30-83E44C588624}\RP689\A0074113.exe -> Downloader.Dluca.ci : Cleaned with backup

::Report End

Incident Status Location

Adware:adware/cws Not disinfected C:\Documents and Settings\Stephanie\Favorites\Going Places

Adware:adware/limeshop Not disinfected Windows Registry

Spyware:spyware/dluca Not disinfected Windows Registry

Potentially unwanted tool:application/seekmo Not disinfected hkey_current_user\software\seekmo

Adware:adware/safesearch Not disinfected Windows Registry

Adware:adware/ncase Not disinfected Windows Registry

Adware:adware/navhelper Not disinfected Windows Registry

Spyware:spyware/apropos Not disinfected Windows Registry

Spyware:Cookie/Advertising Not disinfected C:\Documents and Settings\Cameron\Cookies\cameron@advertising[1].txt

Spyware:Cookie/Atlas DMT Not disinfected C:\Documents and Settings\Cameron\Cookies\cameron@atdmt[2].txt

Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Cameron\Cookies\cameron@belnk[1].txt

Spyware:Cookie/Casalemedia Not disinfected C:\Documents and Settings\Cameron\Cookies\cameron@casalemedia[1].txt

Spyware:Cookie/Cgi-bin Not disinfected C:\Documents and Settings\Cameron\Cookies\cameron@cgi-bin[1].txt

Spyware:Cookie/Belnk Not disinfected C:\Documents and Settings\Cameron\Cookies\[email protected][2].txt

Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Cameron\Cookies\cameron@doubleclick[1].txt

Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Cameron\Cookies\cameron@fastclick[1].txt

Spyware:Cookie/FastClick Not disinfected C:\Documents and Settings\Cameron\Cookies\[email protected][2].txt

Spyware:Cookie/Mediaplex Not disinfected C:\Documents and Settings\Cameron\Cookies\cameron@mediaplex[1].txt

Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Cameron\Cookies\cameron@serving-sys[2].txt

Spyware:Cookie/Doubleclick Not disinfected C:\Documents and Settings\Patricia\Cookies\patricia@doubleclick[1].txt

Adware:Adware/CWS Not disinfected C:\Documents and Settings\Stephanie\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\file\SecurityClassLoader.class-7c728-1c6288ef.class

Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Stephanie\Cookies\stephanie@247realmedia[1].txt

Spyware:Cookie/2o7 Not disinfected C:\Documents and Settings\Stephanie\Cookies\stephanie@2o7[1].txt

Spyware:Cookie/YieldManager Not disinfected C:\Documents and Settings\Stephanie\Cookies\[email protected][2].txt

Spyware:Cookie/PointRoll Not disinfected C:\Documents and Settings\Stephanie\Cookies\[email protected][2].txt

Spyware:Cookie/Apmebf Not disinfected C:\Documents and Settings\Stephanie\Cookies\stephanie@apmebf[1].txt

Spyware:Cookie/Falkag Not disinfected C:\Documents and Settings\Stephanie\Cookies\[email protected][1].txt

Spyware:Cookie/Go Not disinfected C:\Documents and Settings\Stephanie\Cookies\stephanie@go[2].txt

Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Stephanie\Cookies\stephanie@overture[1].txt

Spyware:Cookie/Overture Not disinfected C:\Documents and Settings\Stephanie\Cookies\[email protected][1].txt

Spyware:Cookie/QuestionMarket Not disinfected C:\Documents and Settings\Stephanie\Cookies\stephanie@questionmarket[2].txt

Spyware:Cookie/RealMedia Not disinfected C:\Documents and Settings\Stephanie\Cookies\stephanie@realmedia[1].txt

Spyware:Cookie/Serving-sys Not disinfected C:\Documents and Settings\Stephanie\Cookies\stephanie@serving-sys[2].txt

Spyware:Cookie/Traffic Marketplace Not disinfected C:\Documents and Settings\Stephanie\Cookies\stephanie@trafficmp[2].txt

Spyware:Cookie/Tribalfusion Not disinfected C:\Documents and Settings\Stephanie\Cookies\stephanie@tribalfusion[2].txt

Adware:Adware/Exact.BargainBuddy Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\106D6BE6-E8A3-44AE-A97F-1FA756\24B86B79-F0FE-4ECF-A5E0-CFF667

Adware:Adware/Exact.BargainBuddy Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\106D6BE6-E8A3-44AE-A97F-1FA756\BFCDFE5A-D81D-4927-A27C-6511C5

Spyware:Spyware/Apropos Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\ABF2AC78-66AC-4A90-A377-562B58\06654036-9F76-47F8-9B3D-85A507

Spyware:Spyware/Apropos Not disinfected C:\Program Files\Microsoft AntiSpyware\Quarantine\ABF2AC78-66AC-4A90-A377-562B58\9D5AE127-F8C9-4B9B-8D17-F7160F

Adware:Adware/SAHAgent Not disinfected C:\WINDOWS\prlltpvg.exe

Spyware:Spyware/Dluca Not disinfected C:\WINDOWS\SYSTEM32\cd1.exe

June 20, 2006

Steamhead

did the clean up, and now I can't remove limeshop. I get an error msg "ERROR: could not execute Main: the system cannot find the file specified. Do you want me to just continue anyways with the safe mode thing?

June 14, 2006

Here's the biz

Logfile of HijackThis v1.99.1

Scan saved at 2:35:42 PM, on 6/14/2006

Platform: Windows XP SP2 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\svchost.exe

C:\Program Files\Windows Defender\MsMpEng.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\LEXBCES.EXE

C:\WINDOWS\system32\spoolsv.exe

C:\WINDOWS\system32\LEXPPS.EXE

C:\WINDOWS\Explorer.EXE

C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mm_tray.exe

C:\Program Files\Java\j2re1.4.2_04\bin\jusched.exe

C:\WINDOWS\BCMSMMSG.exe

C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind.exe

C:\Program Files\QuickTime\qttask.exe

C:\Program Files\Java\j2re1.4.2_04\bin\jucheck.exe

C:\Program Files\Common Files\Real\Update_OB\realsched.exe

C:\Program Files\MUSICMATCH\MUSICMATCH Jukebox\mmtask.exe

C:\Program Files\support.com\bin\tgcmd.exe

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\Messenger\msmsgs.exe

C:\Program Files\Logitech\MouseWare\system\em_exec.exe

C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe

C:\WINDOWS\system32\cisvc.exe

C:\Program Files\ewido anti-malware\ewidoctrl.exe

c:\program files\mcafee.com\agent\mcdetect.exe

c:\PROGRA~1\mcafee.com\agent\mctskshd.exe

C:\PROGRA~1\McAfee.com\PERSON~1\MPFSERVICE.exe

C:\WINDOWS\System32\nvsvc32.exe

C:\WINDOWS\System32\svchost.exe

C:\WINDOWS\system32\wscntfy.exe

C:\PROGRA~1\McAfee.com\PERSON~1\MpfAgent.exe

C:\WINDOWS\system32\cidaemon.exe

C:\Program Files\Internet Explorer\iexplore.exe