Possible Virus, Hijack this analysis

Discussion in 'Malware Help (A Specialist Will Reply)' started by thadoctrizin, Apr 27, 2005.

  1. thadoctrizin

    thadoctrizin Private E-2

    Oh where to start!?!
    2 weeks ago the family comp started to act up. Started with periodic loss of the DSL connection than noticed failure of CD/CD-RW drives ability to read or copy any CD's (audio or data). Boot-up of comp began taking longer also. During this time I started noticing increased numbers of popups and shortcut icons being added to my desktop without my knowledge. Virus i ask?

    About Comp:
    Intel Pent 4 2.20 Ghz 256Mb RAM
    Verizon DSL service with a Westell model 2200 modem

    Boot-up symptoms:
    Bootup seems to be taking about twice the time as it used to. During the boot-up the light on the CD drive is blinking and the drive is making quite a ruckous of noise.
    Screen 1: Black screen with underscore in top left corner (CD light blinking)~30 seconds'
    Screen 2: WinXP screen with "knight rider" bar (CD light not blinking) ~20sec.
    Screen3: Completely black screen (CD light blinking) ~45 sec
    Screen 4: Welcome screen (CD light blinking) ~30 sec
    Screen 5: Desktop background (without any icons or toolbar) (CD light blinking) ~75 seconds...this is when the CD drive is making noises like it is trying to read a CD.

    CD problems:
    CD drive will not open any files on CD's. When trying to open a audio file from CD thru windows media player, it completely freezes the program. Makes sounds like it is continously trying to begin reading the CD. When in "device manager" the CD/CDRW drive says it is working properly and enabled. the only device that is open showing an error is 'Network Adapters' with the sub file Broadcom 440x 10/100 Integrated Controller "X'd" out.

    DSL connection symptoms:
    DSL will function normally for most of the day, certain times the connection will be lost. the lights on the modem are green like usual, just no connection. unplugging the modem for 30 seconds and plugging it in again, fixes the problem, but this is quite tedious. also when the connection is to be re-established, it asks me which dialer to use and XXXDialer is located as one of the choices. i've gone into the 'connections' tab in 'internet options' and deleted the XXXDialer several times, but it keeps reappearing. I have also simultaneously noticed the icon "Adult Chat" reappearing on my desktop....i am sure this is a virus...now what to do is the question.

    Adware/Spyware programs:
    I have run the following programs to try to alleviate the problem but none have worked.
    Ad-Aware SE, Spy-bot, and CWShredder....no luck

    here is the logs from the ad-aware, and Hijack This programs:

    Edit by chaslang: Unrequested inline log removed. Please do not post any logs (including Ad-Aware logs) inline.



    Ad-Aware SE
    Ad-Aware SE Build 1.05
    Logfile Created on:Wednesday, April 27, 2005 10:33:10 AM
    Created with Ad-Aware SE Personal, free for private use.
    Using definitions file:SE1R40 20.04.2005
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

    References detected during the scan:
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    MRU List(TAC index:0):27 total references
    Tracking Cookie(TAC index:3):11 total references
    Windows(TAC index:3):1 total references
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»








    Ad-Aware SE Log file
    ===========================
    Set : Search for negligible risk entries
    Set : Safe mode (always request confirmation)
    Set : Scan active processes
    Set : Scan registry
    Set : Deep-scan registry
    Set : Scan my IE Favorites for banned URLs
    Set : Scan my Hosts file

    Extended Ad-Aware SE Settings
    ===========================
    Set : Unload recognized processes & modules during scan
    Set : Scan registry for all users instead of current user only
    Set : Always try to unload modules before deletion
    Set : During removal, unload Explorer and IE if necessary
    Set : Let Windows remove files in use at next reboot
    Set : Delete quarantined objects after restoring
    Set : Include basic Ad-Aware settings in log file
    Set : Include additional Ad-Aware settings in log file
    Set : Include reference summary in log file
    Set : Include alternate data stream details in log file
    Set : Play sound at scan completion if scan locates critical objects


    4-27-2005 10:33:10 AM - Scan started. (Smart mode)

    Listing running processes
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

    #:1 [smss.exe]
    FilePath : \SystemRoot\System32\
    ProcessID : 504
    ThreadCreationTime : 4-27-2005 2:02:53 PM
    BasePriority : Normal


    #:2 [csrss.exe]
    FilePath : \??\C:\WINDOWS\system32\
    ProcessID : 620
    ThreadCreationTime : 4-27-2005 2:04:05 PM
    BasePriority : Normal


    #:3 [winlogon.exe]
    FilePath : \??\C:\WINDOWS\system32\
    ProcessID : 644
    ThreadCreationTime : 4-27-2005 2:04:05 PM
    BasePriority : High


    #:4 [services.exe]
    FilePath : C:\WINDOWS\system32\
    ProcessID : 688
    ThreadCreationTime : 4-27-2005 2:04:06 PM
    BasePriority : Normal
    FileVersion : 5.1.2600.0 (xpclient.010817-1148)
    ProductVersion : 5.1.2600.0
    ProductName : Microsoft® Windows® Operating System
    CompanyName : Microsoft Corporation
    FileDescription : Services and Controller app
    InternalName : services.exe
    LegalCopyright : © Microsoft Corporation. All rights reserved.
    OriginalFilename : services.exe

    #:5 [lsass.exe]
    FilePath : C:\WINDOWS\system32\
    ProcessID : 700
    ThreadCreationTime : 4-27-2005 2:04:06 PM
    BasePriority : Normal
    FileVersion : 5.1.2600.0 (xpclient.010817-1148)
    ProductVersion : 5.1.2600.0
    ProductName : Microsoft® Windows® Operating System
    CompanyName : Microsoft Corporation
    FileDescription : LSA Shell (Export Version)
    InternalName : lsass.exe
    LegalCopyright : © Microsoft Corporation. All rights reserved.
    OriginalFilename : lsass.exe

    #:6 [svchost.exe]
    FilePath : C:\WINDOWS\system32\
    ProcessID : 860
    ThreadCreationTime : 4-27-2005 2:04:06 PM
    BasePriority : Normal
    FileVersion : 5.1.2600.0 (xpclient.010817-1148)
    ProductVersion : 5.1.2600.0
    ProductName : Microsoft® Windows® Operating System
    CompanyName : Microsoft Corporation
    FileDescription : Generic Host Process for Win32 Services
    InternalName : svchost.exe
    LegalCopyright : © Microsoft Corporation. All rights reserved.
    OriginalFilename : svchost.exe

    #:7 [svchost.exe]
    FilePath : C:\WINDOWS\System32\
    ProcessID : 952
    ThreadCreationTime : 4-27-2005 2:04:06 PM
    BasePriority : Normal
    FileVersion : 5.1.2600.0 (xpclient.010817-1148)
    ProductVersion : 5.1.2600.0
    ProductName : Microsoft® Windows® Operating System
    CompanyName : Microsoft Corporation
    FileDescription : Generic Host Process for Win32 Services
    InternalName : svchost.exe
    LegalCopyright : © Microsoft Corporation. All rights reserved.
    OriginalFilename : svchost.exe

    #:8 [svchost.exe]
    FilePath : C:\WINDOWS\System32\
    ProcessID : 1120
    ThreadCreationTime : 4-27-2005 2:04:07 PM
    BasePriority : Normal
    FileVersion : 5.1.2600.0 (xpclient.010817-1148)
    ProductVersion : 5.1.2600.0
    ProductName : Microsoft® Windows® Operating System
    CompanyName : Microsoft Corporation
    FileDescription : Generic Host Process for Win32 Services
    InternalName : svchost.exe
    LegalCopyright : © Microsoft Corporation. All rights reserved.
    OriginalFilename : svchost.exe

    #:9 [svchost.exe]
    FilePath : C:\WINDOWS\System32\
    ProcessID : 1192
    ThreadCreationTime : 4-27-2005 2:04:07 PM
    BasePriority : Normal
    FileVersion : 5.1.2600.0 (xpclient.010817-1148)
    ProductVersion : 5.1.2600.0
    ProductName : Microsoft® Windows® Operating System
    CompanyName : Microsoft Corporation
    FileDescription : Generic Host Process for Win32 Services
    InternalName : svchost.exe
    LegalCopyright : © Microsoft Corporation. All rights reserved.
    OriginalFilename : svchost.exe

    #:10 [explorer.exe]
    FilePath : C:\WINDOWS\
    ProcessID : 1368
    ThreadCreationTime : 4-27-2005 2:04:08 PM
    BasePriority : Normal
    FileVersion : 6.00.2600.0000 (xpclient.010817-1148)
    ProductVersion : 6.00.2600.0000
    ProductName : Microsoft® Windows® Operating System
    CompanyName : Microsoft Corporation
    FileDescription : Windows Explorer
    InternalName : explorer
    LegalCopyright : © Microsoft Corporation. All rights reserved.
    OriginalFilename : EXPLORER.EXE

    #:11 [brsvc01a.exe]
    FilePath : C:\WINDOWS\System32\
    ProcessID : 1480
    ThreadCreationTime : 4-27-2005 2:04:09 PM
    BasePriority : Normal
    FileVersion : 1, 0, 0, 2
    ProductVersion : 1, 0, 0, 2
    ProductName : brother Industries Ltd brsvc01a
    CompanyName : brother Industries Ltd
    FileDescription : brsvc01a
    InternalName : brsvc01a
    LegalCopyright : Copyright © Brother Industries, Ltd 2001
    OriginalFilename : brsvc01a.exe

    #:12 [spoolsv.exe]
    FilePath : C:\WINDOWS\system32\
    ProcessID : 1500
    ThreadCreationTime : 4-27-2005 2:04:09 PM
    BasePriority : Normal
    FileVersion : 5.1.2600.0 (XPClient.010817-1148)
    ProductVersion : 5.1.2600.0
    ProductName : Microsoft® Windows® Operating System
    CompanyName : Microsoft Corporation
    FileDescription : Spooler SubSystem App
    InternalName : spoolsv.exe
    LegalCopyright : © Microsoft Corporation. All rights reserved.
    OriginalFilename : spoolsv.exe

    #:13 [brss01a.exe]
    FilePath : C:\WINDOWS\System32\
    ProcessID : 1512
    ThreadCreationTime : 4-27-2005 2:04:09 PM
    BasePriority : Normal
    FileVersion : 1.004
    ProductVersion : 1, 0, 0, 4
    ProductName : brother Industries Ltd brss01a.exe
    CompanyName : brother Industries Ltd
    FileDescription : brss01a.exe
    InternalName : brss01a.exe
    LegalCopyright : Copyright ? 2001
    OriginalFilename : brss01a.exe
    Comments : Brsplproc XP wrapper

    #:14 [svchost.exe]
    FilePath : C:\WINDOWS\System32\
    ProcessID : 1800
    ThreadCreationTime : 4-27-2005 2:04:16 PM
    BasePriority : Normal
    FileVersion : 5.1.2600.0 (xpclient.010817-1148)
    ProductVersion : 5.1.2600.0
    ProductName : Microsoft® Windows® Operating System
    CompanyName : Microsoft Corporation
    FileDescription : Generic Host Process for Win32 Services
    InternalName : svchost.exe
    LegalCopyright : © Microsoft Corporation. All rights reserved.
    OriginalFilename : svchost.exe

    #:15 [hkcmd.exe]
    FilePath : C:\WINDOWS\System32\
    ProcessID : 1084
    ThreadCreationTime : 4-27-2005 2:06:38 PM
    BasePriority : Normal
    FileVersion : 3.0.0.3762
    ProductVersion : 7.0.0.3762
    ProductName : Intel(R) Common User Interface
    CompanyName : Intel Corporation
    FileDescription : hkcmd Module
    InternalName : HKCMD
    LegalCopyright : Copyright 1999-2002, Intel Corporation
    OriginalFilename : HKCMD.EXE

    #:16 [directcd.exe]
    FilePath : C:\Program Files\Roxio\Easy CD Creator 5\DirectCD\
    ProcessID : 1080
    ThreadCreationTime : 4-27-2005 2:06:38 PM
    BasePriority : Normal
    FileVersion : 5.3.4.21
    ProductVersion : 5.3.4.21
    ProductName : DirectCD
    CompanyName : Roxio
    FileDescription : DirectCD Application
    InternalName : DirectCD
    LegalCopyright : Copyright (c) 2001,2002, Roxio, Inc.
    OriginalFilename : Directcd.exe

    #:17 [instan~1.exe]
    FilePath : C:\PROGRA~1\CANONC~1\TEXTBR~1\Bin\
    ProcessID : 692
    ThreadCreationTime : 4-27-2005 2:06:38 PM
    BasePriority : Normal


    #:18 [motivesb.exe]
    FilePath : C:\PROGRA~1\VERIZO~1\SUPPOR~1\SMARTB~1\
    ProcessID : 1816
    ThreadCreationTime : 4-27-2005 2:06:39 PM
    BasePriority : Normal
    FileVersion : 5.6.11.asst_classic.smartbridge.0
    ProductVersion : 5.6.11.asst_classic.smartbridge
    ProductName : Motive System
    CompanyName : Motive Communications, Inc.
    FileDescription : Motive SmartBridge
    InternalName : version
    LegalCopyright : Copyright 1998-2003
    OriginalFilename : version

    #:19 [qttask.exe]
    FilePath : C:\Program Files\QuickTime\
    ProcessID : 192
    ThreadCreationTime : 4-27-2005 2:06:39 PM
    BasePriority : Normal
    FileVersion : 6.4
    ProductVersion : QuickTime 6.4
    ProductName : QuickTime
    CompanyName : Apple Computer, Inc.
    InternalName : QuickTime Task
    LegalCopyright : © Apple Computer, Inc. 2001-2003
    OriginalFilename : QTTask.exe

    #:20 [msmsgrxp.exe]
    FilePath : C:\WINDOWS\
    ProcessID : 312
    ThreadCreationTime : 4-27-2005 2:06:39 PM
    BasePriority : Normal


    #:21 [aim.exe]
    FilePath : C:\Program Files\AIM\
    ProcessID : 416
    ThreadCreationTime : 4-27-2005 2:06:39 PM
    BasePriority : Normal
    FileVersion : 5.9.3690
    ProductVersion : 5.9.3690
    ProductName : AOL Instant Messenger
    CompanyName : America Online, Inc.
    FileDescription : AOL Instant Messenger
    InternalName : AIM
    LegalCopyright : Copyright © 1996-2004 America Online, Inc.
    OriginalFilename : AIM.EXE

    #:22 [vvnmju.exe]
    FilePath : c:\windows\system32\
    ProcessID : 468
    ThreadCreationTime : 4-27-2005 2:06:39 PM
    BasePriority : Normal
    FileVersion : 1, 0, 7, 1
    ProductVersion : 0, 0, 7, 0
    ProductName : TODO: <Product name>
    CompanyName : TODO: <Company name>
    FileDescription : TODO: <File description>
    LegalCopyright : TODO: (c) <Company name>. All rights reserved.

    #:23 [mpbtn.exe]
    FilePath : C:\Program Files\Verizon Online\SupportCenter\bin\
    ProcessID : 2136
    ThreadCreationTime : 4-27-2005 2:06:45 PM
    BasePriority : Normal
    FileVersion : 5.0.2.4.asst_classic.asst_mpbtn.20020806_105000
    ProductVersion : 5.0.2.4.asst_classic.asst_mpbtn
    ProductName : Motive System
    CompanyName : Motive Communications, Inc.
    FileDescription : Motive Chorus System Tray Button
    InternalName : mpbtn
    LegalCopyright : Copyright 1998, 1999, 2000
    OriginalFilename : mpbtn

    #:24 [__p9hepqkbj.exe]
    FilePath : C:\WINDOWS\
    ProcessID : 1920
    ThreadCreationTime : 4-27-2005 2:09:58 PM
    BasePriority : Normal


    #:25 [adult_chat.exe]
    FilePath : C:\Documents and Settings\All Users\
    ProcessID : 3536
    ThreadCreationTime : 4-27-2005 2:09:58 PM
    BasePriority : Normal


    #:26 [wow32.exe]
    FilePath : C:\WINDOWS\System32\
    ProcessID : 2440
    ThreadCreationTime : 4-27-2005 2:31:39 PM
    BasePriority : Normal


    #:27 [ad-aware.exe]
    FilePath : C:\Program Files\Lavasoft\Ad-Aware SE Personal\
    ProcessID : 3860
    ThreadCreationTime : 4-27-2005 2:33:01 PM
    BasePriority : Normal
    FileVersion : 6.2.0.206
    ProductVersion : VI.Second Edition
    ProductName : Lavasoft Ad-Aware SE
    CompanyName : Lavasoft Sweden
    FileDescription : Ad-Aware SE Core application
    InternalName : Ad-Aware.exe
    LegalCopyright : Copyright © Lavasoft Sweden
    OriginalFilename : Ad-Aware.exe
    Comments : All Rights Reserved

    Memory scan result:
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    New critical objects: 0
    Objects found so far: 0


    Started registry scan
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

    Windows Object Recognized!
    Type : RegData
    Data : explorer.exe c:\windows\nail.exe
    Category : Vulnerability
    Comment : Shell Possibly Compromised
    Rootkey : HKEY_LOCAL_MACHINE
    Object : software\microsoft\windows nt\currentversion\winlogon
    Value : Shell
    Data : explorer.exe c:\windows\nail.exe

    Registry Scan result:
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    New critical objects: 1
    Objects found so far: 1


    Started deep registry scan
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

    Deep registry scan result:
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    New critical objects: 0
    Objects found so far: 1


    Started Tracking Cookie scan
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»


    Tracking Cookie Object Recognized!
    Type : IECache Entry
    Data : administrator@apmebf[1].txt
    Category : Data Miner
    Comment : Hits:9
    Value : Cookie:administrator@apmebf.com/
    Expires : 4-26-2010 10:25:50 AM
    LastSync : Hits:9
    UseCount : 0
    Hits : 9

    Tracking Cookie Object Recognized!
    Type : IECache Entry
    Data : administrator@z1.adserver[1].txt
    Category : Data Miner
    Comment : Hits:3
    Value : Cookie:administrator@z1.adserver.com/
    Expires : 4-26-2006 11:16:06 PM
    LastSync : Hits:3
    UseCount : 0
    Hits : 3

    Tracking Cookie Object Recognized!
    Type : IECache Entry
    Data : administrator@adrevolver[2].txt
    Category : Data Miner
    Comment : Hits:5
    Value : Cookie:administrator@media.adrevolver.com/adrevolver/
    Expires : 1-21-2008 6:08:46 PM
    LastSync : Hits:5
    UseCount : 0
    Hits : 5

    Tracking Cookie Object Recognized!
    Type : IECache Entry
    Data : administrator@2o7[1].txt
    Category : Data Miner
    Comment : Hits:4
    Value : Cookie:administrator@2o7.net/
    Expires : 4-26-2010 10:07:12 AM
    LastSync : Hits:4
    UseCount : 0
    Hits : 4

    Tracking Cookie Object Recognized!
    Type : IECache Entry
    Data : administrator@tribalfusion[1].txt
    Category : Data Miner
    Comment : Hits:11
    Value : Cookie:administrator@tribalfusion.com/
    Expires : 12-31-2037 8:00:00 PM
    LastSync : Hits:11
    UseCount : 0
    Hits : 11

    Tracking Cookie Object Recognized!
    Type : IECache Entry
    Data : administrator@qksrv[2].txt
    Category : Data Miner
    Comment : Hits:10
    Value : Cookie:administrator@qksrv.net/
    Expires : 4-26-2010 10:25:50 AM
    LastSync : Hits:10
    UseCount : 0
    Hits : 10

    Tracking Cookie Object Recognized!
    Type : IECache Entry
    Data : administrator@edge.ru4[2].txt
    Category : Data Miner
    Comment : Hits:2
    Value : Cookie:administrator@edge.ru4.com/
    Expires : 4-20-2035 12:04:38 AM
    LastSync : Hits:2
    UseCount : 0
    Hits : 2

    Tracking Cookie Object Recognized!
    Type : IECache Entry
    Data : administrator@cs.sexcounter[2].txt
    Category : Data Miner
    Comment : Hits:2
    Value : Cookie:administrator@cs.sexcounter.com/
    Expires : 5-12-2024 2:07:28 PM
    LastSync : Hits:2
    UseCount : 0
    Hits : 2

    Tracking Cookie Object Recognized!
    Type : IECache Entry
    Data : administrator@questionmarket[1].txt
    Category : Data Miner
    Comment : Hits:1
    Value : Cookie:administrator@questionmarket.com/
    Expires : 6-17-2006 4:04:40 PM
    LastSync : Hits:1
    UseCount : 0
    Hits : 1

    Tracking Cookie Object Recognized!
    Type : IECache Entry
    Data : administrator@paycounter[1].txt
    Category : Data Miner
    Comment : Hits:1
    Value : Cookie:administrator@paycounter.com/
    Expires : 12-30-2030 9:00:00 PM
    LastSync : Hits:1
    UseCount : 0
    Hits : 1

    Tracking Cookie Object Recognized!
    Type : IECache Entry
    Data : administrator@ads.pointroll[2].txt
    Category : Data Miner
    Comment : Hits:4
    Value : Cookie:administrator@ads.pointroll.com/
    Expires : 12-31-2009 8:00:00 PM
    LastSync : Hits:4
    UseCount : 0
    Hits : 4

    Tracking cookie scan result:
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    New critical objects: 11
    Objects found so far: 12



    Deep scanning and examining files...
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

    Disk Scan Result for C:\WINDOWS
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    New critical objects: 0
    Objects found so far: 12

    Disk Scan Result for C:\WINDOWS\System32
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    New critical objects: 0
    Objects found so far: 12

    Disk Scan Result for C:\DOCUME~1\ADMINI~1\LOCALS~1\Temp\
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    New critical objects: 0
    Objects found so far: 12

    Hosts file scan result:
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    0 entries scanned.
    New critical objects:0
    Objects found so far: 12



    MRU List Object Recognized!
    Location: : C:\Documents and Settings\Administrator\recent
    Description : list of recently opened documents


    MRU List Object Recognized!
    Location: : S-1-5-21-842925246-1177238915-839522115-500\software\microsoft\windows\currentversion\applets\wordpad\recent file list
    Description : list of recent files opened using wordpad


    MRU List Object Recognized!
    Location: : S-1-5-21-842925246-1177238915-839522115-500\software\microsoft\search assistant\acmru
    Description : list of recent search terms used with the search assistant


    MRU List Object Recognized!
    Location: : S-1-5-21-842925246-1177238915-839522115-500\software\microsoft\windows\currentversion\explorer\comdlg32\opensavemru
    Description : list of recently saved files, stored according to file extension


    MRU List Object Recognized!
    Location: : S-1-5-21-842925246-1177238915-839522115-500\software\microsoft\windows\currentversion\explorer\comdlg32\lastvisitedmru
    Description : list of recent programs opened


    MRU List Object Recognized!
    Location: : S-1-5-21-842925246-1177238915-839522115-500\software\microsoft\windows\currentversion\explorer\recentdocs
    Description : list of recent documents opened


    MRU List Object Recognized!
    Location: : S-1-5-21-842925246-1177238915-839522115-500\software\microsoft\internet explorer
    Description : last download directory used in microsoft internet explorer


    MRU List Object Recognized!
    Location: : software\microsoft\directdraw\mostrecentapplication
    Description : most recent application to use microsoft directdraw


    MRU List Object Recognized!
    Location: : S-1-5-21-842925246-1177238915-839522115-500\software\microsoft\microsoft management console\recent file list
    Description : list of recent snap-ins used in the microsoft management console


    MRU List Object Recognized!
    Location: : S-1-5-21-842925246-1177238915-839522115-500\software\google\navclient\1.1\history
    Description : list of recently used search terms in the google toolbar


    MRU List Object Recognized!
    Location: : S-1-5-21-842925246-1177238915-839522115-500\software\microsoft\mediaplayer\preferences
    Description : last cd record path used in microsoft windows media player


    MRU List Object Recognized!
    Location: : S-1-5-21-842925246-1177238915-839522115-500\software\microsoft\internet explorer\typedurls
    Description : list of recently entered addresses in microsoft internet explorer


    MRU List Object Recognized!
    Location: : S-1-5-21-842925246-1177238915-839522115-500\software\adobe\acrobat reader\6.0\avgeneral\crecentfiles
    Description : list of recently used files in adobe reader


    MRU List Object Recognized!
    Location: : S-1-5-21-842925246-1177238915-839522115-500\software\microsoft\directinput\mostrecentapplication
    Description : most recent application to use microsoft directinput


    MRU List Object Recognized!
    Location: : S-1-5-21-842925246-1177238915-839522115-500\software\microsoft\mediaplayer\player\settings
    Description : last open directory used in jasc paint shop pro


    MRU List Object Recognized!
    Location: : software\microsoft\direct3d\mostrecentapplication
    Description : most recent application to use microsoft direct3d


    MRU List Object Recognized!
    Location: : S-1-5-21-842925246-1177238915-839522115-500\software\microsoft\mediaplayer\preferences
    Description : last playlist index loaded in microsoft windows media player


    MRU List Object Recognized!
    Location: : S-1-5-21-842925246-1177238915-839522115-500\software\microsoft\directinput\mostrecentapplication
    Description : most recent application to use microsoft directinput


    MRU List Object Recognized!
    Location: : .DEFAULT\software\microsoft\mediaplayer\preferences
    Description : last playlist loaded in microsoft windows media player


    MRU List Object Recognized!
    Location: : S-1-5-18\software\microsoft\mediaplayer\preferences
    Description : last playlist loaded in microsoft windows media player


    MRU List Object Recognized!
    Location: : S-1-5-19\software\microsoft\mediaplayer\preferences
    Description : last playlist loaded in microsoft windows media player


    MRU List Object Recognized!
    Location: : S-1-5-20\software\microsoft\mediaplayer\preferences
    Description : last playlist loaded in microsoft windows media player


    MRU List Object Recognized!
    Location: : S-1-5-21-842925246-1177238915-839522115-500\software\microsoft\mediaplayer\preferences
    Description : last playlist loaded in microsoft windows media player


    MRU List Object Recognized!
    Location: : S-1-5-21-842925246-1177238915-839522115-500\software\microsoft\mediaplayer\preferences
    Description : last search path used in microsoft windows media player


    MRU List Object Recognized!
    Location: : S-1-5-21-842925246-1177238915-839522115-500\software\microsoft\mediaplayer\medialibraryui
    Description : last selected node in the microsoft windows media player media library


    MRU List Object Recognized!
    Location: : software\microsoft\direct3d\mostrecentapplication
    Description : most recent application to use microsoft direct X


    MRU List Object Recognized!
    Location: : S-1-5-21-842925246-1177238915-839522115-500\software\microsoft\windows media\wmsdk\general
    Description : windows media sdk



    Performing conditional scans...
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»

    Conditional scan result:
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    New critical objects: 0
    Objects found so far: 39

    10:34:42 AM Scan Complete

    Summary Of This Scan
    »»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»»
    Total scanning time:00:01:31.844
    Objects scanned:61108
    Objects identified:12
    Objects ignored:0
    New critical objects:12

    Some questions:
    What virus has infected my comp? Is there a program i can download/purchase to fix the problem? How much damage (financially) has this XXXDialer thing done? Is the virus linked to the malfunctioning of the CD ROM?


    Thanks for any help, I'm not a really computer literate person so any help would be appreciated as long as its in laypersons terms!!!! Thanks so much!
    Nate
    nlaubach@hotmail.com
     
    Last edited by a moderator: Apr 28, 2005
  2. thadoctrizin

    thadoctrizin Private E-2

    Just read the "how to" on posting...my b

    plz don't punish me too bad :)
     
  3. thadoctrizin

    thadoctrizin Private E-2

    just followed the read me on basic spyware removal...so far so good.

    if there are any other retarded, impatient, computer illiterate, ppl out there, read the basic first!!!
     
  4. chaslang

    chaslang MajorGeeks Admin - Master Malware Expert Staff Member

    Based on what I had seen in your previous unrequested HJT log, I don't think you are going to be clean yet. Now it is time to post one legally.

    If you have completed all the steps in the READ ME, follow the steps below.

    - Download HijackThis 1.99.1

    - Unzip the hijackthis.exe file to a folder you create named C:\Program Files\HJT

    - Do NOT run Hijack This from the Desktop, a temp folder, or a sub-folder of C:\Documents and Settings, or choose to run it directly from the downloaded ZIP file.

    - Before running HijackThis: You must close each of the following:your web browser, e-mail client, instant messenger, and programs like notepad, wordpad, MS Word etc. And any other unnecessary running programs.

    - Run HijackThis and save your log file.

    - Post your log as an ATTACHMENT to your next message. (Do NOT copy/paste the log into your post).
     

MajorGeeks.Com Menu

Downloads All In One Tweaks \ Android \ Anti-Malware \ Anti-Virus \ Appearance \ Backup \ Browsers \ CD\DVD\Blu-Ray \ Covert Ops \ Drive Utilities \ Drivers \ Graphics \ Internet Tools \ Multimedia \ Networking \ Office Tools \ PC Games \ System Tools \ Mac/Apple/Ipad Downloads

Other News: Top Downloads \ News (Tech) \ Off Base (Other Websites News) \ Way Off Base (Offbeat Stories and Pics)

Social: Facebook \ YouTube \ Twitter \ Tumblr \ Pintrest \ RSS Feeds