IE Critical Error - Free Antivirus Forum

IE Critical Error

BullGuard Antivirus Forum > Virus Removal > Removal Help > IE Critical Error

Forum Quick Jump

[ << Previous Thread | Next Thread >> ]

black.avanza
New Member

Date Joined Oct 2007
Total Posts : 45

Posted 12-1-2008 6:41 (GMT +1)

when i want to browse my windows explorer,it redirect me to my web browser and says IE Critical Error...here the logs...

Malwarebytes' Anti-Malware 1.30
Database version: 1439
Windows 5.1.2600 Service Pack 2

12/1/2008 12:12:03 PM
mbam-log-2008-12-01 (12-12-02).txt

Scan type: Full Scan (C:\|E:\|)
Objects scanned: 94133
Time elapsed: 33 minute(s), 37 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 1
Registry Keys Infected: 8
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 5

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
C:\WINDOWS\system32\sdsheol.dll (Trojan.FakeAlert) -> Delete on reboot.

Registry Keys Infected:
HKEY_CLASSES_ROOT\huyaka (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\TypeLib\{10026069-7a5f-4531-811e-c8df20643bee} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{8ae8a9ce-80de-4951-ad58-be6fc7a0e231} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\Interface\{bde8a95b-a98d-4928-adcb-c3c3d0afa449} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\CLSID\{0848225a-8181-42fc-8c68-f0a543b12967} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{0848225a-8181-42fc-8c68-f0a543b12967} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0848225a-8181-42fc-8c68-f0a543b12967} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKEY_CLASSES_ROOT\sjkgcr.bho (Trojan.FakeAlert) -> Quarantined and deleted successfully.

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
C:\WINDOWS\system32\sdsheol.dll (Trojan.FakeAlert) -> Delete on reboot.
E:\System Volume Information\_restore{F9E351A4-BF04-409E-9BA8-9FB0C2BC8E5C}\RP142\A0045177.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\WINDOWS\k.txt (Trojan.FakeAlert) -> Quarantined and deleted successfully.
C:\Documents and Settings\Wahyu\Favorites\Cheap Pharmacy Online.url (Rogue.Link) -> Quarantined and deleted successfully.
C:\Documents and Settings\Wahyu\Favorites\SMS TRAP.url (Rogue.Link) -> Quarantined and deleted successfully.

ComboFix 08-11-30.01 - Wahyu 2008-12-01 12:21:14.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.168 [GMT 7:00]
Running from: c:\documents and settings\Wahyu\Desktop\FIX\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((( Files Created from 2008-11-01 to 2008-12-01 )))))))))))))))))))))))))))))))
.

2008-12-01 11:36 . 2008-10-22 16:10 15,504 --a------ c:\windows\system32\drivers\mbam.sys
2008-12-01 11:35 . 2008-12-01 11:36 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-12-01 11:35 . 2008-10-22 16:10 38,496 --a------ c:\windows\system32\drivers\mbamswissarmy.sys
2008-12-01 11:33 . 2008-12-01 11:33 <DIR> d-------- c:\program files\CCleaner
2008-11-24 13:25 . 2008-11-24 13:25 <DIR> d-------- c:\program files\Common Files\Wise Installation Wizard
2008-11-24 11:46 . 2008-11-24 11:46 34,494 --a------ c:\windows\system32\m2.ico
2008-11-10 12:53 . 2008-11-10 12:53 <DIR> d-------- c:\documents and settings\Wahyu\Application Data\Malwarebytes
2008-11-10 12:53 . 2008-11-10 12:53 <DIR> d-------- c:\documents and settings\All Users\Application Data\Malwarebytes
2008-11-10 11:08 . 2008-11-10 11:08 <DIR> d-------- c:\program files\Common Files\xing shared
2008-11-06 14:29 . 2008-11-06 14:29 <DIR> d-------- c:\program files\MSECache
2008-11-06 14:20 . 2008-11-24 14:11 <DIR> d-------- c:\program files\SUPERAntiSpyware
2008-11-04 16:08 . 2008-11-04 16:08 <DIR> d-------- c:\program files\Common Files\PCSuite
2008-11-04 16:08 . 2008-11-04 16:08 <DIR> d-------- c:\program files\Common Files\Nokia
2008-11-04 15:53 . 2008-11-04 15:53 <DIR> d-------- c:\documents and settings\Wahyu\Application Data\Thinstall
2008-11-04 15:47 . 2008-11-04 15:47 <DIR> d-------- c:\documents and settings\All Users\Application Data\PC Suite
2008-11-04 15:19 . 2008-11-04 15:20 <DIR> d--h-c--- c:\windows\ie8
2008-11-04 14:52 . 2008-11-04 14:55 <DIR> d-a------ c:\documents and settings\All Users\Application Data\TEMP
2008-11-04 14:52 . 2008-11-06 13:14 <DIR> d-------- c:\documents and settings\All Users\Application Data\SpeedBit
2008-11-04 10:50 . 2008-11-04 10:50 <DIR> d-------- c:\program files\Yahoo!
2008-11-04 10:50 . 2008-11-04 13:17 <DIR> d-------- c:\documents and settings\All Users\Application Data\Yahoo!
2008-11-04 10:43 . 2008-11-04 10:54 <DIR> d-------- c:\program files\Windows Live Safety Center
2008-11-04 10:37 . 2008-11-04 10:37 <DIR> d-------- c:\program files\PC Connectivity Solution
2008-11-04 10:37 . 2008-11-04 10:37 <DIR> d-------- c:\program files\DIFX
2008-11-04 10:37 . 2007-09-17 15:53 21,632 --a------ c:\windows\system32\drivers\pccsmcfd.sys
2008-11-04 10:36 . 2008-11-04 16:08 <DIR> d-------- c:\program files\Nokia
2008-11-04 10:32 . 2008-11-04 16:03 <DIR> d-------- c:\documents and settings\All Users\Application Data\Installations
2008-11-04 10:18 . 2008-07-18 22:07 270,880 --a------ c:\windows\system32\mucltui.dll
2008-11-04 10:18 . 2008-07-18 22:07 210,976 --a------ c:\windows\system32\muweb.dll
2008-11-04 10:18 . 2008-07-18 22:07 29,728 --a------ c:\windows\system32\mucltui.dll.mui
2008-11-03 15:56 . 2008-11-03 15:56 <DIR> d-------- c:\program files\Microsoft CAPICOM 2.1.0.2
2008-11-03 15:54 . 2008-11-03 15:54 <DIR> d-------- c:\program files\MSXML 4.0
2008-11-03 14:33 . 2008-02-26 18:59 294,912 --a--c--- c:\windows\system32\dllcache\msctf.dll
2008-11-03 14:23 . 2008-11-03 14:57 <DIR> d-------- c:\documents and settings\Wahyu\Contacts
2008-11-03 14:22 . 2008-11-03 14:22 268 --ah----- C:\sqmdata00.sqm
2008-11-03 14:22 . 2008-11-03 14:22 244 --ah----- C:\sqmnoopt00.sqm
2008-11-03 14:04 . 2008-11-03 14:04 <DIR> d-------- c:\program files\Windows Media Connect 2
2008-11-03 14:02 . 2008-11-03 14:02 410,976 --a------ c:\windows\system32\deploytk.dll
2008-11-03 14:02 . 2008-11-03 14:02 73,728 --a------ c:\windows\system32\javacpl.cpl
2008-11-03 14:01 . 2008-11-03 14:01 <DIR> d-------- c:\windows\system32\LogFiles
2008-11-03 14:01 . 2008-11-03 14:03 <DIR> d-------- c:\windows\system32\drivers\UMDF
2008-11-03 13:53 . 2008-11-03 13:54 <DIR> d-------- c:\program files\QuickTime
2008-11-03 13:53 . 2008-11-03 13:53 <DIR> d-------- c:\program files\Common Files\Apple
2008-11-03 13:53 . 2008-11-03 13:53 <DIR> d-------- c:\documents and settings\All Users\Application Data\Apple Computer
2008-11-03 13:52 . 2008-11-03 13:52 <DIR> d-------- c:\program files\Apple Software Update
2008-11-03 13:52 . 2008-11-03 13:52 <DIR> d-------- c:\documents and settings\All Users\Application Data\Apple
2008-11-03 13:44 . 2008-09-16 07:14 120,056 --------- c:\windows\system32\pxcpyi64.exe
2008-11-03 13:44 . 2008-09-16 07:14 118,520 --------- c:\windows\system32\pxinsi64.exe
2008-11-03 13:43 . 2008-11-03 13:44 <DIR> d-------- c:\program files\DivX
2008-11-03 13:37 . 2008-11-03 13:37 <DIR> d-------- c:\program files\Real
2008-11-03 13:37 . 2008-11-03 13:37 <DIR> d-------- c:\program files\Google
2008-11-03 13:37 . 2008-11-10 11:07 <DIR> d-------- c:\program files\Common Files\Real
2008-11-03 13:28 . 2008-11-03 13:29 <DIR> d-------- c:\program files\Winamp
2008-11-03 13:28 . 2008-11-04 10:17 <DIR> d-------- c:\documents and settings\Wahyu\Application Data\Winamp
2008-11-03 13:28 . 2008-09-16 07:14 129,784 --------- c:\windows\system32\pxafs.dll
2008-11-03 13:28 . 2007-03-08 06:51 9,464 --------- c:\windows\system32\drivers\cdralw2k.sys
2008-11-03 13:28 . 2007-03-08 06:51 9,336 --------- c:\windows\system32\drivers\cdr4_xp.sys
2008-11-03 13:21 . 2008-11-03 13:21 <DIR> d-------- c:\program files\Codec Pack - All In 1
2008-11-03 13:21 . 2008-11-03 13:20 737,280 --a------ c:\windows\iun6002.exe
2008-11-03 13:05 . 2008-11-24 12:00 <DIR> d-------- c:\program files\SpeedFan
2008-11-03 13:05 . 2008-11-17 15:24 45 --a------ c:\windows\system32\initdebug.nfo
2008-11-03 12:35 . 2008-11-03 12:38 <DIR> d-------- c:\documents and settings\Wahyu\Application Data\Skype
2008-11-03 12:28 . 2008-11-03 12:28 <DIR> dr------- c:\program files\Skype
2008-11-03 12:28 . 2008-11-03 12:28 <DIR> d-------- c:\program files\Common Files\Skype
2008-11-03 12:28 . 2008-11-03 12:28 <DIR> d-------- c:\documents and settings\All Users\Application Data\Skype
2008-11-03 12:26 . 2008-11-11 11:09 <DIR> d-------- c:\documents and settings\Wahyu\Application Data\SUPERAntiSpyware.com
2008-11-03 12:26 . 2008-11-03 12:26 <DIR> d-------- c:\documents and settings\All Users\Application Data\SUPERAntiSpyware.com
2008-11-03 12:24 . 2008-11-03 12:24 <DIR> d-------- c:\program files\Common Files\Adobe AIR
2008-11-03 11:55 . 2008-11-03 14:22 <DIR> d--hsc--- c:\program files\Common Files\WindowsLiveInstaller
2008-11-03 11:54 . 2008-11-03 14:22 <DIR> d-------- c:\program files\Windows Live
2008-11-03 11:54 . 2008-11-03 14:08 <DIR> d-------- c:\documents and settings\All Users\Application Data\WLInstaller
2008-11-03 11:36 . 2008-11-03 11:42 <DIR> d-------- c:\program files\NetMeter
2008-11-03 11:18 . 2008-11-04 12:21 <DIR> d-------- c:\windows\system32\CatRoot_bak
2008-11-03 11:12 . 2008-08-14 17:00 2,180,352 -----c--- c:\windows\system32\dllcache\ntoskrnl.exe
2008-11-03 11:12 . 2008-08-14 16:58 2,136,064 -----c--- c:\windows\system32\dllcache\ntkrnlmp.exe
2008-11-03 11:12 . 2008-08-14 16:22 2,057,728 -----c--- c:\windows\system32\dllcache\ntkrnlpa.exe
2008-11-03 11:12 . 2008-08-14 16:22 2,015,744 -----c--- c:\windows\system32\dllcache\ntkrpamp.exe
2008-11-03 11:04 . 2008-06-13 20:10 272,128 --------- c:\windows\system32\drivers\bthport.sys
2008-11-03 11:04 . 2008-06-13 20:10 272,128 -----c--- c:\windows\system32\dllcache\bthport.sys
2008-11-03 11:04 . 2008-11-03 11:04 0 --a------ c:\windows\nsreg.dat
2008-11-03 11:03 . 2008-11-10 14:17 <DIR> d-------- c:\program files\FlashGet
2008-11-03 11:03 . 2004-08-04 19:00 359,040 --a------ c:\windows\system32\drivers\tcpip.sys.flg
2008-11-03 10:19 . 2008-10-16 14:09 31,768 --a------ c:\windows\system32\wucltui.dll.mui
2008-11-03 10:19 . 2008-10-16 14:07 23,576 --a------ c:\windows\system32\wuaucpl.cpl.mui
2008-11-03 10:19 . 2008-10-16 14:07 23,576 --a------ c:\windows\system32\wuapi.dll.mui
2008-11-03 10:19 . 2008-10-16 14:07 18,456 --a------ c:\windows\system32\wuaueng.dll.mui
2008-11-02 15:20 . 2008-11-02 15:20 <DIR> d-------- c:\documents and settings\Wahyu\Application Data\Bitdefender
2008-11-02 15:12 . 2008-12-01 12:33 81,984 --a------ c:\windows\system32\bdod.bin
2008-11-02 15:06 . 2008-11-02 15:06 <DIR> d-------- c:\program files\Softwin
2008-11-02 15:06 . 2008-11-02 15:07 <DIR> d-------- c:\documents and settings\All Users\Application Data\BitDefender
2008-11-02 15:05 . 2008-11-02 15:06 <DIR> d-------- c:\program files\Common Files\Softwin
2008-11-02 14:48 . 2008-11-02 14:48 <DIR> d-------- c:\documents and settings\All Users\Application Data\Avg7
2008-11-02 14:44 . 2008-06-12 11:27 26,144 --a------ c:\windows\system32\spupdsvc.exe
2008-11-02 14:43 . 2008-11-17 15:35 <DIR> d--h----- c:\windows\$hf_mig$

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-04 08:47 --------- d-----w c:\documents and settings\Wahyu\Application Data\PC Suite
2008-11-04 08:47 --------- d-----w c:\documents and settings\Wahyu\Application Data\Nokia
2008-11-03 07:01 --------- d-----w c:\program files\Java
2008-11-03 05:23 --------- d-----w c:\program files\Common Files\Adobe
2008-10-24 11:10 453,632 ----a-w c:\windows\system32\drivers\mrxsmb.sys
2008-10-24 07:29 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-10-24 07:18 --------- d-----w c:\documents and settings\All Users\Application Data\Symantec
2007-02-24 12:20 0 -c-ha-w c:\documents and settings\Wahyu\Application Data\hpothb07.dat
2003-11-28 03:02 27,981 ----a-w c:\program files\Readme.html
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
"c:\program files\NetMeter\NetMeter.exe"="c:\program files\NetMeter\NetMeter.exe" [2007-08-11 331264]
"Nokia.PCSync"="c:\program files\Nokia\Nokia PC Suite 7\PCSync2.exe" [2008-06-17 1249280]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2008-11-24 1805552]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-03 136600]
"NeroFilterCheck"="c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
"QuickTime Task"="c:\program files\QuickTime\QTTask.exe" [2008-09-06 413696]
"BDMCon"="c:\program files\Softwin\BitDefender10\bdmcon.exe" [2007-04-02 290816]
"BDAgent"="c:\program files\Softwin\BitDefender10\bdagent.exe" [2007-03-26 69632]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
"TkBellExe"="c:\program files\Common Files\Real\Update_OB\realsched.exe" [2008-11-10 185872]
"SoundMan"="SOUNDMAN.EXE" [2005-11-11 c:\windows\soundman.exe]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2004-08-04 15360]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"RunNarrator"="Narrator.exe" [2004-08-04 c:\windows\system32\narrator.exe]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= "c:\program files\SUPERAntiSpyware\SASSEH.DLL" [2008-05-13 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
2008-07-23 16:28 352256 c:\program files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ClocX]
--a------ 2004-01-21 21:42 103936 c:\program files\ClocX\ClocX.exe

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
"UpdatesDisableNotify"=dword:00000001
"FirewallOverride"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\FlashGet\\flashget.exe"=
"c:\\Program Files\\Skype\\Phone\\Skype.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"c:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=

R0 PzWDM;PzWDM;c:\windows\system32\Drivers\PzWDM.sys [2007-03-05 15172]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{6433ac16-be9d-11db-818a-00138fb1409a}]
\Shell\AutoRun\command - resu.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{b86d15d0-bf2a-11db-8190-00138fb1409a}]
\Shell\AutoRun\command - resu.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{be7ec510-aaaf-11dc-9710-00138fb1409a}]
\Shell\AutoRun\command - D:\Copy of Desktop.ini
\Shell\explore\Command - D:\Copy of Desktop.ini
\Shell\open\Command - D:\Copy of Desktop.ini

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{be7ec512-aaaf-11dc-9710-00138fb1409a}]
\Shell\AutoRun\command - H:\Copy of Desktop.ini
\Shell\explore\Command - H:\Copy of Desktop.ini
\Shell\open\Command - H:\Copy of Desktop.ini
.
Contents of the 'Scheduled Tasks' folder

2008-11-03 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-07-30 12:34]

2008-03-28 c:\windows\Tasks\FRU Task #Hewlett-Packard#hp officejet 6100 series#1193135347.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe [2002-11-26 20:00]

2008-03-28 c:\windows\Tasks\WebReg 20071029073627.job
- c:\program files\Hewlett-Packard\Digital Imaging\Bin\hpqwrg.exe [2002-10-16 15:39]
.
.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\Wahyu\Application Data\Mozilla\Firefox\Profiles\1ln3nddl.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - www.mail.yahoo.com
FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll
FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npjp2.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npdeploytk.dll
FF -: plugin - c:\program files\Yahoo!\Shared\npYState.dll
.

**************************************************************************

catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-12-01 12:29:52
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

- - - - - - - > 'winlogon.exe'(512)
c:\program files\SUPERAntiSpyware\SASWINLO.dll
.
Completion time: 2008-12-01 12:35:13
ComboFix-quarantined-files.txt 2008-12-01 05:35:10

Pre-Run: 11,052,400,640 bytes free
Post-Run: 11,147,251,712 bytes free

206 --- E O F --- 2008-11-19 02:02:51

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:39:46 PM, on 12/1/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18241)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Java\jre6\bin\jusched.exe
C:\Program Files\Softwin\BitDefender10\bdmcon.exe
C:\Program Files\Softwin\BitDefender10\bdagent.exe
C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\NetMeter\NetMeter.exe
C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpotdd01.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hposol08.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\bin\hpoevm08.exe
C:\Program Files\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe
C:\WINDOWS\system32\fxssvc.exe
C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
C:\Program Files\Softwin\BitDefender10\vsserv.exe
C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
C:\WINDOWS\system32\HPZipm12.exe
C:\Program Files\Common Files\Nokia\MPAPI\MPAPI3s.exe
C:\Program Files\PC Connectivity Solution\Transports\NclUSBSrv.exe
C:\Program Files\PC Connectivity Solution\Transports\NclRSSrv.exe
C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpoSTS08.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Documents and Settings\Wahyu\Desktop\FIX\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://search.speedbit.com/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://192.168.0.100/
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: flashget urlcatch - {2F364306-AA45-47B5-9F9D-39A8B94E7EF7} - C:\Program Files\FlashGet\jccatch.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: AcroIEToolbarHelper Class - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: FlashGet GetFlash Class - {F156768E-81EF-470C-9057-481BA8380DBA} - C:\Program Files\FlashGet\getflash.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 6.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
O4 - HKLM\..\Run: [BDMCon] "C:\Program Files\Softwin\BitDefender10\bdmcon.exe" /reg
O4 - HKLM\..\Run: [BDAgent] "C:\Program Files\Softwin\BitDefender10\bdagent.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [C:\Program Files\NetMeter\NetMeter.exe] C:\Program Files\NetMeter\NetMeter.exe
O4 - HKCU\..\Run: [Nokia.PCSync] "C:\Program Files\Nokia\Nokia PC Suite 7\PCSync2.exe" /NoDialog
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\S-1-5-18\..\RunOnce: [RunNarrator] Narrator.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - HKUS\.DEFAULT\..\RunOnce: [RunNarrator] Narrator.exe (User 'Default user')
O4 - Global Startup: 701Server.lnk = C:\Program Files\701Server\McuServer.exe
O4 - Global Startup: Acrobat Assistant.lnk = C:\Program Files\Adobe\Acrobat 6.0\Distillr\acrotray.exe
O4 - Global Startup: hpoddt01.exe.lnk = ?
O4 - Global Startup: officejet 6100.lnk = ?
O8 - Extra context menu item: &Download All with FlashGet - C:\Program Files\FlashGet\jc_all.htm
O8 - Extra context menu item: &Download with FlashGet - C:\Program Files\FlashGet\jc_link.htm
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O9 - Extra 'Tools' menuitem: FlashGet - {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} - C:\Program Files\FlashGet\FlashGet.exe
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: BitDefender Scan Server (bdss) - Unknown owner - C:\Program Files\Common Files\Softwin\BitDefender Scan Server\bdss.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
O23 - Service: BitDefender Desktop Update Service (LIVESRV) - SOFTWIN S.R.L. - C:\Program Files\Common Files\Softwin\BitDefender Update Service\livesrv.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
O23 - Service: BitDefender Virus Shield (VSSERV) - SOFTWIN S.R.L. - C:\Program Files\Softwin\BitDefender10\vsserv.exe
O23 - Service: BitDefender Communicator (XCOMM) - SOFTWIN S.R.L - C:\Program Files\Common Files\Softwin\BitDefender Communicator\xcommsvr.exe

--
End of file - 7451 bytes

Touch
Forum Moderator

Date Joined Jun 2004
Total Posts : 14325

Posted 12-1-2008 8:05 (GMT +1)

Hello.

It looks like malwarebyte removed the infections ?

Do NOT post your problem in someone elses thread.

Member of - Alliance of Security Analysis Professionals

A non-profit, volunteer network.

black.avanza
New Member

Date Joined Oct 2007
Total Posts : 45

Posted 12-10-2008 6:34 (GMT +1)

sorry...yes,now it's clean again...great softwares..:)

Forum Information

Currently it is Friday, January 09, 2009 3:25 AM (GMT +1)
There are a total of 65.964 posts in 16.185 threads.
In the last 3 days there were 23 new threads and 96 reply posts. View Active Threads