- This topic has 2 replies, 2 voices, and was last updated 20 years, 7 months ago by
.
-
Posts
-
Hello,
Yesterday I ran Spyware Doctore and it detected 2 things:
CWS and eBlaster e-mail record & keylogger of spectorsoft.
I also ran the following scans which found absolutely nothing: Spycop, Ad-Aware, Spy Sweeper, Microsoft Anti Spyware, Xoftspy, spybot, Pest Patrol, CWShredder, BPS Spyware remover, norton anti virus and online scans like trendmicro and panda scan.
I would have thought at least CWSherdder and Spybot would detect CWS one but nothing. only spyware doctore detected the two but I cant remove them, plus if you look at the processes in the pic above, they look like needed legit files that I shouldnt delete.
I ran Spyware doctor just 2-3 days ago which came out clean so it cant be longer than a few days on my PC. the problem though is that these last few days I used a credit card online and now I’m worried that they got the number and all necessary details.
Any ideas on how to remove it? is it possible that it is a false alert?
Here is the HJT log I took just now, if anyone could look through it and tell me if there are any infections I would really appreciate it.
Logfile of HijackThis v1.99.1
Scan saved at 12:20:31 PM, on 6/16/2005
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)Running processes:
C:WINDOWSSystem32smss.exe
C:WINDOWSsystem32csrss.exe
C:WINDOWSsystem32winlogon.exe
C:WINDOWSsystem32services.exe
C:WINDOWSsystem32lsass.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSSystem32svchost.exe
C:WINDOWSsystem32svchost.exe
C:WINDOWSExplorer.EXE
C:Program FilesCommon FilesSymantec SharedccProxy.exe
C:Program FilesCommon FilesSymantec SharedccSetMgr.exe
C:Program FilesNorton Internet SecurityISSVC.exe
C:Program FilesCommon FilesSymantec SharedSNDSrvc.exe
C:Program FilesCommon FilesSymantec SharedSPBBCSPBBCSvc.exe
C:Program FilesCommon FilesSymantec SharedccEvtMgr.exe
C:WINDOWSsystem32spoolsv.exe
C:WINDOWSSystem32GEARSec.exe
C:Program FilesNorton Internet SecurityNorton AntiVirusnavapsvc.exe
C:Program FilesNorton SystemWorksNorton GhostAgentPQV2iSvc.exe
C:PROGRA~1NORTON~2NORTON~1NPROTECT.EXE
C:WINDOWSsystem32nvsvc32.exe
C:Program FilesNorton Internet SecurityNorton AntiVirusSAVScan.exe
C:PROGRA~1NORTON~2NORTON~1SPEEDD~1NOPDB.EXE
C:WINDOWSsystem32svchost.exe
C:Program FilesWebrootSpy SweeperWRSSSDK.exe
C:Program FilesCommon FilesSymantec SharedCCPD-LCsymlcsvc.exe
C:WINDOWSsystem32wdfmgr.exe
C:Program FilesUPSMONUPSMON_Service.Exe
C:WINDOWSsystem32WFXSVC.EXE
C:Program FilesWinFaxWFXMOD32.EXE
C:WINDOWSSystem32alg.exe
C:Program FilesCommon FilesSymantec SharedccApp.exe
C:Program FilesUPSMONUPSMON.exe
C:Program FilesMessengerPlus! 3MsgPlus.exe
C:WINDOWSsystem32wfxsnt40.exe
C:WINDOWSsystem32ctfmon.exe
C:Program FilesMSGTAGMSGTAG.exe
C:Program FilesMessengermsmsgs.exe
C:Program FilesMSN Messengermsnmsgr.exe
C:Program FilesNetscapeCommunicatorProgramnetscape.exe
C:PROGRA~1ALURIA~1ASEASE.exe
C:Documents and SettingsAdministratorDesktophijackthisHijackThis.exeR3 – Default URLSearchHook is missing
N1 – Netscape 4: user_pref(“browser.startup.homepage”, “”); (C:Program FilesNetscapeUserssaritprefs.js)
O2 – BHO: AcroIEHlprObj Class – {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} – C:Program FilesAdobeAcrobat 6.0AcrobatActiveXAcroIEHelper.dll
O2 – BHO: (no name) – {53707962-6F74-2D53-2644-206D7942484F} – C:Program FilesSpybot – Search & DestroySDHelper.dll
O2 – BHO: Norton Internet Security – {9ECB9560-04F9-4bbc-943D-298DDF1699E1} – C:Program FilesCommon FilesSymantec SharedAdBlockingNISShExt.dll
O2 – BHO: AcroIEToolbarHelper Class – {AE7CD045-E861-484f-8273-0445EE161910} – C:Program FilesAdobeAcrobat 6.0AcrobatAcroIEFavClient.dll
O2 – BHO: NAV Helper – {BDF3E430-B101-42AD-A544-FADC6B084872} – C:Program FilesNorton Internet SecurityNorton AntiVirusNavShExt.dll
O2 – BHO: FlashFXP Helper for Internet Explorer – {E5A1691B-D188-4419-AD02-90002030B8EE} – C:PROGRA~1FlashFXPIEFlash.dll
O3 – Toolbar: Norton Internet Security – {0B53EAC3-8D69-4b9e-9B19-A37C9A5676A7} – C:Program FilesCommon FilesSymantec SharedAdBlockingNISShExt.dll
O3 – Toolbar: Norton AntiVirus – {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} – C:Program FilesNorton Internet SecurityNorton AntiVirusNavShExt.dll
O3 – Toolbar: Adobe PDF – {47833539-D0C5-4125-9FA8-0819E2EAAC93} – C:Program FilesAdobeAcrobat 6.0AcrobatAcroIEFavClient.dll
O3 – Toolbar: FlashGet Bar – {E0E899AB-F487-11D5-8D29-0050BA6940E3} – C:PROGRA~1FlashGetfgiebar.dll
O4 – HKLM..Run: [NvCplDaemon] RUNDLL32.EXE C:WINDOWSsystem32NvCpl.dll,NvStartup
O4 – HKLM..Run: [nwiz] nwiz.exe /install
O4 – HKLM..Run: [NvMediaCenter] RUNDLL32.EXE C:WINDOWSsystem32NvMcTray.dll,NvTaskbarInit
O4 – HKLM..Run: [ccApp] “C:Program FilesCommon FilesSymantec SharedccApp.exe”
O4 – HKLM..Run: [Symantec NetDriver Monitor] C:PROGRA~1SYMNET~1SNDMon.exe /Consumer
O4 – HKLM..Run: [UPSMON] C:Program FilesUPSMONUPSMON.exe
O4 – HKLM..Run: [MessengerPlus3] “C:Program FilesMessengerPlus! 3MsgPlus.exe”
O4 – HKLM..Run: [WinFaxAppPortStarter] wfxsnt40.exe
O4 – HKLM..Run: [SpyCop ScanCheck] C:Program FilesCommon FilesMicrosoft SharedMAIN.EXE /LASTSCAN
O4 – HKCU..Run: [ctfmon.exe] C:WINDOWSsystem32ctfmon.exe
O4 – HKCU..Run: [MSGTAG] “C:Program FilesMSGTAGMSGTAG.exe” /startup
O4 – HKCU..Run: [Spyware Doctor] “C:Program FilesSpyware Doctorswdoctor.exe” /Q
O4 – HKCU..Run: [MSMSGS] “C:Program FilesMessengermsmsgs.exe” /background
O4 – Startup: ASE Scheduler.lnk = C:Program FilesAluria SoftwareASEASE Scheduler.exe
O8 – Extra context menu item: &יצא ל- Microsoft Excel – res://C:PROGRA~1MICROS~1Office10EXCEL.EXE/3000
O8 – Extra context menu item: Download All by FlashGet – C:Program FilesFlashGetjc_all.htm
O8 – Extra context menu item: Download using FlashGet – C:Program FilesFlashGetjc_link.htm
O9 – Extra button: (no name) – {08B0E5C0-4FCB-11CF-AAA5-00401C608501} – C:Program FilesJavajre1.5.0_02binnpjpi150_02.dll
O9 – Extra ‘Tools’ menuitem: Sun Java Console – {08B0E5C0-4FCB-11CF-AAA5-00401C608501} – C:Program FilesJavajre1.5.0_02binnpjpi150_02.dll
O9 – Extra button: FlashGet – {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} – C:PROGRA~1FlashGetflashget.exe
O9 – Extra ‘Tools’ menuitem: &FlashGet – {D6E814A0-E0C5-11d4-8D29-0050BA6940E3} – C:PROGRA~1FlashGetflashget.exe
O9 – Extra button: Messenger – {FB5F1910-F110-11d2-BB9E-00C04F795683} – C:Program FilesMessengermsmsgs.exe
O9 – Extra ‘Tools’ menuitem: Windows Messenger – {FB5F1910-F110-11d2-BB9E-00C04F795683} – C:Program FilesMessengermsmsgs.exe
O16 – DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) – http://v5.windowsupdate.microsoft.com/v5co…b?1117803974951
O16 – DPF: {74D05D43-3236-11D4-BDCD-00C04F9A3B61} (HouseCall Control) – http://a840.g.akamai.net/7/840/537/2004061…all/xscan53.cab
O16 – DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) – http://www.pandasoftware.com/activescan/as5/asinst.cab
O16 – DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) – http://messenger.msn.com/download/MsnMesse…pDownloader.cab
O16 – DPF: {CBF2C04B-50B5-4C7B-8D49-ACB62582F8E6} (LauncherV1 Class) – http://chat-basic.nana.co.il/Cabs/launcher.cab
O17 – HKLMSystemCCSServicesTcpip..{9F47A89C-0683-48CE-9764-958B0D275F56}: NameServer = 212.143.212.143 194.90.1.5
O23 – Service: Symantec Event Manager (ccEvtMgr) – Symantec Corporation – C:Program FilesCommon FilesSymantec SharedccEvtMgr.exe
O23 – Service: Symantec Network Proxy (ccProxy) – Symantec Corporation – C:Program FilesCommon FilesSymantec SharedccProxy.exe
O23 – Service: Symantec Password Validation (ccPwdSvc) – Symantec Corporation – C:Program FilesCommon FilesSymantec SharedccPwdSvc.exe
O23 – Service: Symantec Settings Manager (ccSetMgr) – Symantec Corporation – C:Program FilesCommon FilesSymantec SharedccSetMgr.exe
O23 – Service: GEARSecurity – GEAR Software – C:WINDOWSSystem32GEARSec.exe
O23 – Service: ISSvc (ISSVC) – Symantec Corporation – C:Program FilesNorton Internet SecurityISSVC.exe
O23 – Service: Norton AntiVirus Auto-Protect Service (navapsvc) – Symantec Corporation – C:Program FilesNorton Internet SecurityNorton AntiVirusnavapsvc.exe
O23 – Service: Norton Ghost – Symantec Corporation – C:Program FilesNorton SystemWorksNorton GhostAgentPQV2iSvc.exe
O23 – Service: Norton Unerase Protection (NProtectService) – Symantec Corporation – C:PROGRA~1NORTON~2NORTON~1NPROTECT.EXE
O23 – Service: NVIDIA Display Driver Service (NVSvc) – NVIDIA Corporation – C:WINDOWSsystem32nvsvc32.exe
O23 – Service: Pml Driver HPZ12 – HP – C:WINDOWSsystem32HPZipm12.exe
O23 – Service: SAVScan – Symantec Corporation – C:Program FilesNorton Internet SecurityNorton AntiVirusSAVScan.exe
O23 – Service: ScriptBlocking Service (SBService) – Symantec Corporation – C:PROGRA~1COMMON~1SYMANT~1SCRIPT~1SBServ.exe
O23 – Service: Symantec Network Drivers Service (SNDSrvc) – Symantec Corporation – C:Program FilesCommon FilesSymantec SharedSNDSrvc.exe
O23 – Service: Symantec SPBBCSvc (SPBBCSvc) – Symantec Corporation – C:Program FilesCommon FilesSymantec SharedSPBBCSPBBCSvc.exe
O23 – Service: Speed Disk service – Symantec Corporation – C:PROGRA~1NORTON~2NORTON~1SPEEDD~1NOPDB.EXE
O23 – Service: Webroot Spy Sweeper Engine (svcWRSSSDK) – Webroot Software, Inc. – C:Program FilesWebrootSpy SweeperWRSSSDK.exe
O23 – Service: Symantec Core LC – Symantec Corporation – C:Program FilesCommon FilesSymantec SharedCCPD-LCsymlcsvc.exe
O23 – Service: TuneUp WinStyler Theme Service (TUWinStylerThemeSvc) – TuneUp Software GmbH – C:Program FilesTuneUp Utilities 2004WinStylerThemeSvc.exe
O23 – Service: UPSMONService – Unknown owner – C:Program FilesUPSMONUPSMON_Service.Exe
O23 – Service: WinFax PRO (wfxsvc) – Symantec Corporation – C:WINDOWSsystem32WFXSVC.EXE
- You must be logged in to reply to this topic.