NEWS
PARASITES
SOFTWARE
FORUM
DIRECTORY
 
 
 
 
 
 
  
Register   FAQ   Login  

please HELLPP MEEEE! TROJAN WIN32 ZLOB





AddThis Social Bookmark Button AddThis Feed Button

       2-spyware forum index -> HijackThis log analysis
Author Message
icasti



Joined: 22 Oct 2006
Posts: 3
Post Post subject: please HELLPP MEEEE! TROJAN WIN32 ZLOB Reply with quote
this is my hijack this log file. Hope you can help me..

Logfile of HijackThis v1.99.1
Scan saved at 16.48.48, on 22/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programmi\Net Nanny\nnsvc.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\VEXPLITE\viritsvc.exe
C:\WINDOWS\Explorer.EXE
C:\Programmi\VideoCompressionCodec\isamonitor.exe
C:\Programmi\VideoCompressionCodec\pmsngr.exe
C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
C:\Programmi\QuickTime\qttask.exe
C:\Programmi\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\Programmi\ATI Technologies\ATI HYDRAVISION\HydraDM.exe
C:\Programmi\VideoCompressionCodec\pmmon.exe
C:\Programmi\VideoCompressionCodec\isamini.exe
C:\Programmi\Trend Micro\Internet Security 2007\pccguide.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe
C:\Programmi\Net Nanny\nntray.exe
C:\Programmi\ADSL\StarModem ADSL USB MODEM\dslmon.exe
C:\Programmi\iPod\bin\iPodService.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\downloads\hijackttthiss\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7b4d79df-9ef0-429d-a0e9-d9b138c6a53b} - C:\Programmi\VideoCompressionCodec\isaddon.dll
O4 - HKLM\..\Run: [9xadiras] 9xadiras.exe
O4 - HKLM\..\Run: [2kadiras] 2kadiras.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [HydraVisionDesktopManager] C:\Programmi\ATI Technologies\ATI HYDRAVISION\HydraDM.exe
O4 - HKLM\..\Run: [NNLL] C:\Programmi\Net Nanny\nnll.exe
O4 - HKLM\..\Run: [NNTray] C:\Programmi\Net Nanny\nnstart.exe
O4 - HKLM\..\Run: [MSMalwareKit] C:\WINDOWS\system32\MalwareRemover.exe
O4 - HKLM\..\Run: [errorkiller] "C:\Program Files\errorkiller\errorkiller.exe" -boot
O4 - HKLM\..\Run: [pccguide.exe] "C:\Programmi\Trend Micro\Internet Security 2007\pccguide.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [preferiti] c:\windows\system32\preferiti.exe
O4 - HKCU\..\Run: [OE] "C:\Programmi\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe"
O4 - Startup: ATI Tray Tools.lnk = C:\Programmi\Ray Adams\ATI Tray Tools\atitray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: DSLMON.lnk = ?
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O15 - Trusted Zone: www. A:link { color: red }
O15 - Trusted Zone: www. A:visited { color: maroon }
O15 - Trusted Zone: www. BODY { font: 8pt/12pt verdana }
O15 - Trusted Zone: www. H1 { font: 13pt/15pt verdana }
O15 - Trusted Zone: www. H2 { font: 8pt/12pt verdana }
O15 - Trusted Zone: www. and search for topics titled <b>Web Site Setup</b>, <b>Common Administrative Tasks</b>, and <b>About Custom Error Messages</b>.</li>
O15 - Trusted Zone: www. the Web site administrator to alert them that the link is incorrectly formatted.
O15 - Trusted Zone: www.<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
O15 - Trusted Zone: www.</HEAD><BODY><TABLE width=500 border=0 cellspacing=10><TR><TD>
O15 - Trusted Zone: www.</li>
O15 - Trusted Zone: www.</STYLE>
O15 - Trusted Zone: www.</TD></TR></TABLE></BODY></HTML>
O15 - Trusted Zone: www.</ul>
O15 - Trusted Zone: www.<h1>The page cannot be found</h1>
O15 - Trusted Zone: www.<h2>HTTP Error 404 - File or directory not found.<br>Internet Information Services (IIS)</h2>
O15 - Trusted Zone: www.<hr>
O15 - Trusted Zone: www.<HTML><HEAD><TITLE>The page cannot be found</TITLE>
O15 - Trusted Zone: www.<li>Click the <a href="javascript:history.back(1)">Back</a> button to try another link.</li>
O15 - Trusted Zone: www.<li>Go to <a href="http://go.microsoft.com/fwlink/?linkid=8180">Microsoft Product Support Services</a> and perform a title search for the words <b>HTTP</b> and <b>404</b>.</li>
O15 - Trusted Zone: www.<li>If you reached this page by clicking a link, contact
O15 - Trusted Zone: www.<li>Make sure that the Web site address displayed in the address bar of your browser is spelled and formatted correctly.</li>
O15 - Trusted Zone: www.<li>Open <b>IIS Help</b>, which is accessible in IIS Manager (inetmgr),
O15 - Trusted Zone: www.<META HTTP-EQUIV="Content-Type" Content="text/html; charset=Windows-1252">
O15 - Trusted Zone: www.<p>Please try the following:</p>
O15 - Trusted Zone: www.<p>Technical Information (for support personnel)</p>
O15 - Trusted Zone: www.<STYLE type="text/css">
O15 - Trusted Zone: www.<ul>
O15 - Trusted Zone: www.acquadirose.biz
O15 - Trusted Zone: www.acquadirose.com
O15 - Trusted Zone: www.analcord.com
O15 - Trusted Zone: www.cisiamodibrutto.com
O15 - Trusted Zone: www.cisiamodibrutto.comcoppiastrana.com
O15 - Trusted Zone: www.coppiastrana.com
O15 - Trusted Zone: www.cywanstorage.biz
O15 - Trusted Zone: www.defaultbar.com
O15 - Trusted Zone: www.forteforte.com
O15 - Trusted Zone: www.gooogle.bz
O15 - Trusted Zone: www.phishingfix.biz
O15 - Trusted Zone: www.preferiti-windows.com
O15 - Trusted Zone: www.scalalap.com
O15 - Trusted Zone: www.sextriere.com
O15 - Trusted Zone: www.supermonica.biz
O15 - Trusted Zone: www.The page you are looking for might have been removed, had its name changed, or is temporarily unavailable.
O15 - Trusted Zone: www.tuttaqualita.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O16 - DPF: {3A4DCD02-A451-4799-9E1C-AC0D4F769A97} - http://www.cywanstorage.biz/PHFX/MSPhish.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://francymansu.spaces.live.com//PhotoUpload/MsnPUpld.cab
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = gformula.net
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = gformula.net
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = gformula.net
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: NNSvc - Looksmart, Ltd. - C:\Programmi\Net Nanny\nnsvc.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Protezione anti-spyware Trend Micro (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Programmi\SiSoftware\SiSoftware Sandra Lite 2007\Win32\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Programmi\SiSoftware\SiSoftware Sandra Lite 2007\RpcSandraSrv.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: Virit eXplorer Lite (viritsvclite) - TG Soft Sas www.tgsoft.it - C:\VEXPLITE\viritsvc.exe
Sun Oct 22, 2006 2:54 pm
Back to top
icasti View user's profile Send private message
 
HJT Analyzer



Joined: 15 Mar 2006
Posts: 611
Post Post subject: My HijackThis log Reply with quote
Hello, visitor!

The Hijack This log analyzer has analyzed your log. Please take a closer look on the results.

Your system seems to be infected with malicious parasites. Please follow the steps below in order to eliminate the infection and clean up your computer.

1. Download the Pocket KillBox utility. You will need it later to delete parasite-related files and folders.
2. Use HijackThis to fix the following entries:

O2 - BHO: (no name) - {7b4d79df-9ef0-429d-a0e9-d9b138c6a53b} - C:\Programmi\VideoCompressionCodec\isaddon.dll

3. The following entries are not malicious, but some of them are not used anymore. You may use HijackThis to fix a few of them. However, please keep in mind that some of the entries marked as Questionable or Not Needed are fully legitimate and might be required by installed software to work properly, while some others might be related to certain parasites. It is up to you to decide whether you need any of them, or not.
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Collegamenti
O4 - Global Startup: DSLMON.lnk = ?
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra ''Tools'' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O9 - Extra button: Ricerche - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O9 - Extra ''Tools'' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programmi\Messenger\msmsgs.exe
O15 - Trusted Zone: www. A:link { color: red }
O15 - Trusted Zone: www. A:visited { color: maroon }
O15 - Trusted Zone: www. BODY { font: 8pt/12pt verdana }
O15 - Trusted Zone: www. H1 { font: 13pt/15pt verdana }
O15 - Trusted Zone: www. H2 { font: 8pt/12pt verdana }
O15 - Trusted Zone: www. and search for topics titled <b>Web Site Setup</b>, <b>Common Administrative Tasks</b>, and <b>About Custom Error Messages</b>.</li>
O15 - Trusted Zone: www. the Web site administrator to alert them that the link is incorrectly formatted.
O15 - Trusted Zone: www.<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
O15 - Trusted Zone: www.</HEAD><BODY><TABLE width=500 border=0 cellspacing=10><TR><TD>
O15 - Trusted Zone: www.</li>
O15 - Trusted Zone: www.</STYLE>
O15 - Trusted Zone: www.</TD></TR></TABLE></BODY></HTML>
O15 - Trusted Zone: www.</ul>
O15 - Trusted Zone: www.<h1>The page cannot be found</h1>
O15 - Trusted Zone: www.<h2>HTTP Error 404 - File or directory not found.<br>Internet Information Services (IIS)</h2>
O15 - Trusted Zone: www.<hr>
O15 - Trusted Zone: www.<HTML><HEAD><TITLE>The page cannot be found</TITLE>
O15 - Trusted Zone: www.<li>Click the <a href="javascript:history.back(1)">Back</a> button to try another link.</li>
O15 - Trusted Zone: www.<li>Go to <a href="http://go.microsoft.com/fwlink/?linkid=8180">Microsoft Product Support Services</a> and perform a title search for the words <b>HTTP</b> and <b>404</b>.</li>
O15 - Trusted Zone: www.<li>If you reached this page by clicking a link, contact
O15 - Trusted Zone: www.<li>Make sure that the Web site address displayed in the address bar of your browser is spelled and formatted correctly.</li>
O15 - Trusted Zone: www.<li>Open <b>IIS Help</b>, which is accessible in IIS Manager (inetmgr),
O15 - Trusted Zone: www.<META HTTP-EQUIV="Content-Type" Content="text/html; charset=Windows-1252">
O15 - Trusted Zone: www.<p>Please try the following:</p>
O15 - Trusted Zone: www.<p>Technical Information (for support personnel)</p>
O15 - Trusted Zone: www.<STYLE type="text/css">
O15 - Trusted Zone: www.<ul>
O15 - Trusted Zone: www.acquadirose.biz
O15 - Trusted Zone: www.acquadirose.com
O15 - Trusted Zone: www.analcord.com
O15 - Trusted Zone: www.cisiamodibrutto.com
O15 - Trusted Zone: www.cisiamodibrutto.comcoppiastrana.com
O15 - Trusted Zone: www.coppiastrana.com
O15 - Trusted Zone: www.cywanstorage.biz
O15 - Trusted Zone: www.defaultbar.com
O15 - Trusted Zone: www.forteforte.com
O15 - Trusted Zone: www.gooogle.bz
O15 - Trusted Zone: www.phishingfix.biz
O15 - Trusted Zone: www.preferiti-windows.com
O15 - Trusted Zone: www.scalalap.com
O15 - Trusted Zone: www.sextriere.com
O15 - Trusted Zone: www.supermonica.biz
O15 - Trusted Zone: www.The page you are looking for might have been removed, had its name changed, or is temporarily unavailable.
O15 - Trusted Zone: www.tuttaqualita.com
O16 - DPF: {3A4DCD02-A451-4799-9E1C-AC0D4F769A97} - http://www.cywanstorage.biz/PHFX/MSPhish.exe
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://francymansu.spaces.live.com//PhotoUpload/MsnPUpld.cab
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = gformula.net
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = gformula.net
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = gformula.net
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL

4. Now restart your system in Safe Mode. This step is very important!
5. Use the Pocket KillBox utility to delete the following files:

C:\Programmi\VideoCompressionCodec\isamonitor.exe
C:\Programmi\VideoCompressionCodec\pmsngr.exe
C:\Programmi\VideoCompressionCodec\pmmon.exe
C:\Programmi\VideoCompressionCodec\isamini.exe
C:\Programmi\VideoCompressionCodec\isaddon.dll


The following files and Windows registry entries are marked as "unknown". Currently, the HijackThis Log Analyzer cannot provide required information on these items. The files and entries in the list below can be both malicious and fully legitimate. Because of this, please do not take any action! Wait for the forum responders or other forum users to provide you with necessary details and further instructions.
C:\Programmi\Net Nanny\nnsvc.exe
C:\VEXPLITE\viritsvc.exe
C:\Programmi\ATI Technologies\ATI HYDRAVISION\HydraDM.exe
C:\Programmi\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe
C:\Programmi\Net Nanny\nntray.exe
C:\Programmi\ADSL\StarModem ADSL USB MODEM\dslmon.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
O4 - HKLM\..\Run: [9xadiras] 9xadiras.exe
O4 - HKLM\..\Run: [2kadiras] 2kadiras.exe
O4 - HKLM\..\Run: [HydraVisionDesktopManager] C:\Programmi\ATI Technologies\ATI HYDRAVISION\HydraDM.exe
O4 - HKLM\..\Run: [NNLL] C:\Programmi\Net Nanny\nnll.exe
O4 - HKLM\..\Run: [NNTray] C:\Programmi\Net Nanny\nnstart.exe
O4 - HKLM\..\Run: [MSMalwareKit] C:\WINDOWS\system32\MalwareRemover.exe
O4 - HKLM\..\Run: [errorkiller] "C:\Program Files\errorkiller\errorkiller.exe" -boot
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [preferiti] c:\windows\system32\preferiti.exe
O4 - HKCU\..\Run: [OE] "C:\Programmi\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe"
O4 - Startup: ATI Tray Tools.lnk = C:\Programmi\Ray Adams\ATI Tray Tools\atitray.exe
O23 - Service: Protezione anti-spyware Trend Micro (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
O23 - Service: Virit eXplorer Lite (viritsvclite) - TG Soft Sas www.tgsoft.it - C:\VEXPLITE\viritsvc.exe
After going through all the steps, run another HijackThis scan and post a fresh log to the HijackThis analyzer. It is possible that some parasites your system was infected with were not removed completely and may restore themselves later.


If you want to see more detailed analysis of your log, click here.

Thank you for using the 2-Spyware.com HijackThis log analyzer!
Sun Oct 22, 2006 2:54 pm
Back to top
HJT Analyzer View user's profile Send private message
 
icasti



Joined: 22 Oct 2006
Posts: 3
Post Post subject: Reply with quote
this is my new log. I ddi all the steps.
I'm afraid the spyware is still there!!!!
what can I do?

Logfile of HijackThis v1.99.1
Scan saved at 17.23.55, on 22/10/2006
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
C:\VEXPLITE\viritsvc.exe
C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
C:\Programmi\QuickTime\qttask.exe
C:\Programmi\iTunes\iTunesHelper.exe
C:\WINDOWS\system32\atiptaxx.exe
C:\Programmi\ATI Technologies\ATI HYDRAVISION\HydraDM.exe
C:\Programmi\Trend Micro\Internet Security 2007\pccguide.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programmi\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe
C:\Programmi\ADSL\StarModem ADSL USB MODEM\dslmon.exe
C:\Programmi\iPod\bin\iPodService.exe
C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programmi\Mozilla Firefox\firefox.exe
C:\downloads\hijackttthiss\HijackThis.exe

O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programmi\Java\jre1.5.0_06\bin\ssv.dll
O2 - BHO: (no name) - {7b4d79df-9ef0-429d-a0e9-d9b138c6a53b} - C:\Programmi\VideoCompressionCodec\isaddon.dll (file missing)
O4 - HKLM\..\Run: [9xadiras] 9xadiras.exe
O4 - HKLM\..\Run: [2kadiras] 2kadiras.exe
O4 - HKLM\..\Run: [PinnacleDriverCheck] C:\WINDOWS\system32\PSDrvCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Programmi\Java\jre1.5.0_06\bin\jusched.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Programmi\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Programmi\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [AtiPTA] atiptaxx.exe
O4 - HKLM\..\Run: [HydraVisionDesktopManager] C:\Programmi\ATI Technologies\ATI HYDRAVISION\HydraDM.exe
O4 - HKLM\..\Run: [NNLL] C:\Programmi\Net Nanny\nnll.exe
O4 - HKLM\..\Run: [NNTray] C:\Programmi\Net Nanny\nnstart.exe
O4 - HKLM\..\Run: [MSMalwareKit] C:\WINDOWS\system32\MalwareRemover.exe
O4 - HKLM\..\Run: [errorkiller] "C:\Program Files\errorkiller\errorkiller.exe" -boot
O4 - HKLM\..\Run: [pccguide.exe] "C:\Programmi\Trend Micro\Internet Security 2007\pccguide.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] C:\Programmi\Google\GoogleToolbarNotifier\1.0.720.3640\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [preferiti] c:\windows\system32\preferiti.exe
O4 - HKCU\..\Run: [OE] "C:\Programmi\Trend Micro\Internet Security 2007\TMAS_OE\TMAS_OEMon.exe"
O4 - Startup: ATI Tray Tools.lnk = C:\Programmi\Ray Adams\ATI Tray Tools\atitray.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Programmi\File comuni\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: DSLMON.lnk = ?
O8 - Extra context menu item: E&sporta in Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O15 - Trusted Zone: www. A:link { color: red }
O15 - Trusted Zone: www. A:visited { color: maroon }
O15 - Trusted Zone: www. BODY { font: 8pt/12pt verdana }
O15 - Trusted Zone: www. H1 { font: 13pt/15pt verdana }
O15 - Trusted Zone: www. H2 { font: 8pt/12pt verdana }
O15 - Trusted Zone: www.<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
O15 - Trusted Zone: www.</HEAD><BODY><TABLE width=500 border=0 cellspacing=10><TR><TD>
O15 - Trusted Zone: www.</li>
O15 - Trusted Zone: www.</STYLE>
O15 - Trusted Zone: www.</TD></TR></TABLE></BODY></HTML>
O15 - Trusted Zone: www.</ul>
O15 - Trusted Zone: www.<h1>The page cannot be found</h1>
O15 - Trusted Zone: www.<hr>
O15 - Trusted Zone: www.<HTML><HEAD><TITLE>The page cannot be found</TITLE>
O15 - Trusted Zone: www.<li>Click the <a href="javascript:history.back(1)">Back</a> button to try another link.</li>
O15 - Trusted Zone: www.<li>Go to <a href="http://go.microsoft.com/fwlink/?linkid=8180">Microsoft Product Support Services</a> and perform a title search for the words <b>HTTP</b> and <b>404</b>.</li>
O15 - Trusted Zone: www.<li>If you reached this page by clicking a link, contact
O15 - Trusted Zone: www.<li>Open <b>IIS Help</b>, which is accessible in IIS Manager (inetmgr),
O15 - Trusted Zone: www.<META HTTP-EQUIV="Content-Type" Content="text/html; charset=Windows-1252">
O15 - Trusted Zone: www.<p>Please try the following:</p>
O15 - Trusted Zone: www.<p>Technical Information (for support personnel)</p>
O15 - Trusted Zone: www.<STYLE type="text/css">
O15 - Trusted Zone: www.<ul>
O15 - Trusted Zone: www.cisiamodibrutto.comcoppiastrana.com
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?LinkID=39204
O17 - HKLM\System\CCS\Services\Tcpip\..\{26C61E8F-272C-4570-BE89-17557EE98729}: NameServer = 193.70.152.15 193.70.152.25
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: SearchList = gformula.net
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: SearchList = gformula.net
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: SearchList = gformula.net
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programmi\File comuni\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPodService - Apple Computer, Inc. - C:\Programmi\iPod\bin\iPodService.exe
O23 - Service: Trend Micro Central Control Component (PcCtlCom) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcCtlCom.exe
O23 - Service: Protezione anti-spyware Trend Micro (PcScnSrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\PcScnSrv.exe
O23 - Service: Sandra Data Service (SandraDataSrv) - SiSoftware - C:\Programmi\SiSoftware\SiSoftware Sandra Lite 2007\Win32\RpcDataSrv.exe
O23 - Service: Sandra Service (SandraTheSrv) - SiSoftware - C:\Programmi\SiSoftware\SiSoftware Sandra Lite 2007\RpcSandraSrv.exe
O23 - Service: Trend Micro Real-time Service (Tmntsrv) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\Tmntsrv.exe
O23 - Service: Trend Micro Personal Firewall (TmPfw) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\TmPfw.exe
O23 - Service: Trend Micro Proxy Service (tmproxy) - Trend Micro Inc. - C:\PROGRA~1\TRENDM~1\INTERN~1\tmproxy.exe
O23 - Service: Virit eXplorer Lite (viritsvclite) - TG Soft Sas www.tgsoft.it - C:\VEXPLITE\viritsvc.exe
Sun Oct 22, 2006 3:26 pm
Back to top
icasti View user's profile Send private message
 
icasti



Joined: 22 Oct 2006
Posts: 3
Post Post subject: Reply with quote
Cleaning succeeded. I rebooted and there is no sign of virus/spyware anymore!!
Thanks!
Sun Oct 22, 2006 9:11 pm
Back to top
icasti View user's profile Send private message
 
GTO



Joined: 15 Nov 2005
Posts: 1519
Post Post subject: Reply with quote
Hi icasti. Welcome to the 2-Spyware.com forums!

Your system is still infected. Please follow these steps:

1. Download Pocket KillBox or KillBox utility.

2. Use HijackThis to fix the following entries:
O2 - BHO: (no name) - {7b4d79df-9ef0-429d-a0e9-d9b138c6a53b} - C:\Programmi\VideoCompressionCodec\isaddon.dll (file missing)
O4 - HKLM\..\Run: [MSMalwareKit] C:\WINDOWS\system32\MalwareRemover.exe
O15 - Trusted Zone: www. A:link { color: red }
O15 - Trusted Zone: www. A:visited { color: maroon }
O15 - Trusted Zone: www. BODY { font: 8pt/12pt verdana }
O15 - Trusted Zone: www. H1 { font: 13pt/15pt verdana }
O15 - Trusted Zone: www. H2 { font: 8pt/12pt verdana }
O15 - Trusted Zone: www.<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01//EN" "http://www.w3.org/TR/html4/strict.dtd">
O15 - Trusted Zone: www.</HEAD><BODY><TABLE width=500 border=0 cellspacing=10><TR><TD>
O15 - Trusted Zone: www.</li>
O15 - Trusted Zone: www.</STYLE>
O15 - Trusted Zone: www.</TD></TR></TABLE></BODY></HTML>
O15 - Trusted Zone: www.</ul>
O15 - Trusted Zone: www.<h1>The page cannot be found</h1>
O15 - Trusted Zone: www.<hr>
O15 - Trusted Zone: www.<HTML><HEAD><TITLE>The page cannot be found</TITLE>
O15 - Trusted Zone: www.<li>Click the <a href="javascript:history.back(1)">Back</a> button to try another link.</li>
O15 - Trusted Zone: www.<li>Go to <a href="http://go.microsoft.com/fwlink/?linkid=8180">Microsoft Product Support Services</a> and perform a title search for the words <b>HTTP</b> and <b>404</b>.</li>
O15 - Trusted Zone: www.<li>If you reached this page by clicking a link, contact
O15 - Trusted Zone: www.<li>Open <b>IIS Help</b>, which is accessible in IIS Manager (inetmgr),
O15 - Trusted Zone: www.<META HTTP-EQUIV="Content-Type" Content="text/html; charset=Windows-1252">
O15 - Trusted Zone: www.<p>Please try the following:</p>
O15 - Trusted Zone: www.<p>Technical Information (for support personnel)</p>
O15 - Trusted Zone: www.<STYLE type="text/css">
O15 - Trusted Zone: www.<ul>

3. Then use either Pocket KillBox or KillBox to delete the following file:
C:\WINDOWS\system32\MalwareRemover.exe

4. Download the trial version of AVG Anti-Spyware. Install the program, update its definitions and run a complete system scan. Remove all the threats the application will find.
Tue Oct 24, 2006 12:41 pm
Back to top
GTO View user's profile Send private message
 
       2-spyware forum index -> HijackThis log analysis All times are GMT
Page 1 of 1

 
 You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum




Recommended software:
Spyware Doctor
(91/100)
Spyware Doctor is a very powerful, but yet highly user-friendly spyware remover, made by PC Tools, reputable computer security experts. This product provides effective and easy-to-manage...
SUPERAntiSpyware
(89/100)
SUPERAntiSpyware is a powerful, highly effective spyware remover introducing advanced parasite detection and removal features along with reliable real-time protection. The program is not...
CounterSpy
(85/100)
CounterSpy is a powerful spyware remover based on revolutionary hybrid engine, which incorporates traditional anti-spyware and advanced antivirus engines. Such combination allows CounterSpy...
Malwarebytes Anti Malware
(75/100)
There are loads of malware removers on the net today and most of them are lightweight applications, which usually means they’re fast and don’t have many features. One such...
Windows Defender
(75/100)
Windows Defender is a free anti-spyware program made by the leading software company to add native spyware protection to its most popular product - the Microsoft Windows operating...
Encyclopedia of parasites:
Latest Spyware Threats: VirusProtect Pro | VirusLocker | SpyCrush | ContraVirus | SpyLocked | SpyDawn | AntiVerminser | SpywareQuake | VirusBurst | AntiVermins | AntiVermeans | Zlob | PopCorn.net | MovieLand | TagASaurus | BraveSentry | VirusBurster | SystemDoctor | VirusRescue | MalwareWipe | SpySheriff | CmdService | Smitfraud | SpywareStrike | WinFixer | WinHound | PestTrap | UnSpyPC
Agreement of Use | Privacy policy | Webmasters | Contact us | RSS Feeds
© 2001-2007 2-spyware.com All Rights Reserved. Reproduction in part or whole without written permission is prohibited. Powered by: eSolutions. Forum powered by phpBB