« previous next »
Pages: 1 [2] 3 4   Go Down

Author Topic: Win32:Agent-HOP [Wrm] ..Avast cannot delete file  (Read 32564 times)

0 Members and 1 Guest are viewing this topic.

extreme_21

  • Guest
Re: Win32:Agent-HOP [Wrm] ..Avast cannot delete file
« Reply #15 on: July 12, 2007, 04:58:46 AM »
ComboFix 07-06-13.3 - C:\Documents and Settings\Chris\Desktop\AntiVirus Tools\ComboFix.exe
"Chris" - 2007-07-11 22:31:11 - Service Pack 2  NTFS 


(((((((((((((((((((((((((   Files Created from 2007-06-12 to 2007-07-12  )))))))))))))))))))))))))))))))


2007-07-10 23:06   53,760   --a------   C:\WINDOWS\system32\vfwwdm32.dll
2007-07-03 22:31   374,752   --a------   C:\WINDOWS\system32\WUSBGXP.sys
2007-07-03 22:31   339,488   --a------   C:\WINDOWS\system32\WUSB20XP.sys
2007-07-03 22:31   245,376   --a------   C:\WINDOWS\system32\rt2500usb.sys
2007-07-03 22:31   20,747   --a------   C:\WINDOWS\system32\drivers\AegisP.sys
2007-07-03 22:31   <DIR>   d--------   C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor
2007-06-30 18:03   24,576   --a------   C:\WINDOWS\system32\VundoFixSVC.exe
2007-06-28 21:53   <DIR>   d--hs----   C:\WINDOWS\CSC
2007-06-25 23:37   10,872   --a------   C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-06-25 22:11   178,688   --a------   C:\DOCUME~1\Colleen\gold.exe
2007-06-25 17:59   178,688   --a------   C:\DOCUME~1\Steph\gold.exe
2007-06-25 17:09   178,688   --a------   C:\WINDOWS\system32\gold.exe
2007-06-25 15:56   <DIR>   d--------   C:\Program Files\SpeedFan
2007-06-25 15:41   <DIR>   d--h-----   C:\WINDOWS\system32\GroupPolicy
2007-06-25 11:36   1,448,219   ---hs----   C:\WINDOWS\system32\ghkmp.bak2
2007-06-24 23:35   6,409   ---hs----   C:\WINDOWS\system32\ghkmp.bak1
2007-06-24 14:08   3,968   --a------   C:\WINDOWS\system32\drivers\AvgArCln.sys
2007-06-24 13:23   <DIR>   d--------   C:\Program Files\RogueRemover
2007-06-24 10:34   <DIR>   d--------   C:\WINDOWS\system32\appmgmt
2007-06-24 10:27   <DIR>   d--------   C:\DOCUME~1\ADMINI~1\APPLIC~1\MySpace
2007-06-24 10:26   786,432   --ah-----   C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-06-23 10:31   4,672   --a------   C:\WINDOWS\system32\petaccnj.exe
2007-06-23 09:22   30,220   --a------   C:\DOCUME~1\Steph\iop.exe
2007-06-22 19:54   4,672   --a------   C:\WINDOWS\system32\fpkjbpgm.exe
2007-06-22 19:53   1,242,081   --ahs----   C:\WINDOWS\system32\rtstv.bak2
2007-06-22 19:50   4,672   --a------   C:\WINDOWS\system32\exujklqs.exe
2007-06-21 20:07   7,386   --ahs----   C:\WINDOWS\system32\rtstv.ini2
2007-06-21 18:01   6,570   --ahs----   C:\WINDOWS\system32\rtstv.bak1
2007-06-19 17:58   <DIR>   d--------   C:\!KillBox
2007-06-16 22:55   49,152   --a------   C:\WINDOWS\nircmd.exe
2007-06-15 20:49   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com
2007-06-15 20:48   <DIR>   d--------   C:\Program Files\SUPERAntiSpyware
2007-06-15 20:48   <DIR>   d--------   C:\Program Files\Common Files\Wise Installation Wizard
2007-06-15 20:48   <DIR>   d--------   C:\DOCUME~1\Chris\APPLIC~1\SUPERAntiSpyware.com
2007-06-15 20:23   <DIR>   d--------   C:\VundoFix Backups
2007-06-15 19:02   <DIR>   d--------   C:\WINDOWS\system32\Kaspersky Lab
2007-06-15 19:02   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-06-13 17:57   <DIR>   d--------   C:\Program Files\NoAdware5.0


((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-09 01:32:47   --------   d-----w   C:\Program Files\MSN Messenger
2007-06-03 15:36:39   --------   d-----w   C:\DOCUME~1\Chris\APPLIC~1\LimeWire
2007-06-01 04:06:55   --------   d-----w   C:\Program Files\Audacity
2007-06-01 03:12:49   --------   d-----w   C:\DOCUME~1\Chris\APPLIC~1\SonyEricsson
2007-06-01 03:12:41   --------   d-----w   C:\Program Files\Sony Ericsson
2007-05-30 23:26:45   --------   d-----w   C:\Program Files\MySpace
2007-05-26 20:33:28   --------   d-----w   C:\Program Files\QuickTime
2007-05-20 01:56:28   --------   d-----w   C:\DOCUME~1\Chris\APPLIC~1\uTorrent
2007-05-19 19:56:50   --------   d-----w   C:\Program Files\TGTSoft
2007-05-16 15:12:02   683,520   ----a-w   C:\WINDOWS\system32\inetcomm.dll
2007-05-15 23:38:28   --------   d-----w   C:\Program Files\Google
2007-04-30 15:46:10   745,600   ----a-w   C:\WINDOWS\system32\aswBoot.exe
2007-04-30 15:35:28   95,872   ----a-w   C:\WINDOWS\system32\AVASTSS.scr
2007-04-25 14:21:15   144,896   ----a-w   C:\WINDOWS\system32\schannel.dll
2007-04-18 16:12:23   2,854,400   ----a-w   C:\WINDOWS\system32\msi.dll
2007-04-17 02:47:36   33,624   ----a-w   C:\WINDOWS\system32\wups.dll
2007-04-17 02:45:54   1,710,936   ----a-w   C:\WINDOWS\system32\wuaueng.dll
2007-04-17 02:45:48   549,720   ----a-w   C:\WINDOWS\system32\wuapi.dll
2007-04-17 02:45:42   325,976   ----a-w   C:\WINDOWS\system32\wucltui.dll
2007-04-17 02:45:36   203,096   ----a-w   C:\WINDOWS\system32\wuweb.dll
2007-04-17 02:45:28   92,504   ----a-w   C:\WINDOWS\system32\cdm.dll
2007-04-17 02:45:20   53,080   ----a-w   C:\WINDOWS\system32\wuauclt.exe
2007-04-17 02:45:20   43,352   ----a-w   C:\WINDOWS\system32\wups2.dll
2007-04-17 02:44:20   271,224   ----a-w   C:\WINDOWS\system32\mucltui.dll
2007-04-17 02:44:18   208,248   ----a-w   C:\WINDOWS\system32\muweb.dll


(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
 
 
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-23 00:08]
{72853161-30C5-4D22-B7F9-0BBC1D38A37E}=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 00:48]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll [2007-03-14 03:43]
{9030D464-4C02-4ABF-8ECC-5164760863C6}=C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2006-08-31 21:33]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-04-30 11:42]
"@"="" []
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
"AudioDeck"="C:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe" [2006-11-02 16:57]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 05:25]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:00]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"="C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [2006-10-27 00:48]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"="C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 13:55]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2007-05-30 08:29]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware]
"C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
"C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
"C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe


Contents of the 'Scheduled Tasks' folder
2007-06-30 20:16:03  C:\WINDOWS\tasks\AppleSoftwareUpdate.job

**************************************************************************

catchme 0.3.721 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-11 22:36:05
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-11 22:37:32
C:\ComboFix-quarantined-files.txt ... 2007-07-11 22:37
C:\ComboFix2.txt ... 2007-06-24 23:34

   --- E O F ---
Logged

extreme_21

  • Guest
Re: Win32:Agent-HOP [Wrm] ..Avast cannot delete file
« Reply #16 on: July 12, 2007, 04:59:20 AM »
Logfile of HijackThis v1.99.1
Scan saved at 10:39:41 PM, on 7/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe
C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WUSB54Gv42.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\vsnpstd3.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Chris\Desktop\AntiVirus Tools\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by108w.bay108.mail.live.com/mail/resources/MsnPUpld.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1177258613250
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1171083299846
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\shybxtje.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: VundoFix Service (VundoFixSvc) - Atribune.org - C:\WINDOWS\SYSTEM32\VundoFixSVC.exe
O23 - Service: WUSB54Gv42SVC - Unknown owner - C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe" "WUSB54Gv42.exe (file missing)

Logged

extreme_21

  • Guest
Re: Win32:Agent-HOP [Wrm] ..Avast cannot delete file
« Reply #17 on: July 12, 2007, 05:02:30 AM »
WinPFind3 logfile created on: 7/11/2007 10:47:30 PM
WinPFind3U by OldTimer - Version 1.0.39   Folder = C:\Documents and Settings\Chris\Desktop\AntiVirus Tools\wipfind3u\WinPFind3u\
Microsoft Windows XP Service Pack 2 (Version = 5.1.2600)
Internet Explorer (Version = 7.0.5730.11)
 
750.73 Mb Total Physical Memory | 452.95 Mb Available Physical Memory | 60.33% Memory free
1.07 Gb Paging File | 0.79 Gb Available in Paging File | 74.42% Paging File free
Paging file location(s): c:\pagefile.sys 384 768;
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 189.92 Gb Total Space | 162.40 Gb Free Space | 85.51% Space Free
Drive D: | 4.01 Gb Total Space | 2.01 Gb Free Space | 50.10% Space Free
E: Drive not present or media not loaded
F: Drive not present or media not loaded

Computer Name: FAMILY-5B125E0A
Current User Name: Chris
Logged in as Administrator.
Current Boot Mode: Normal


[Processes - Non-Microsoft Only]
adeck.exe -> %ProgramFiles%\VIA\VIAudioi\SBADeck\ADeck.exe -> VIA Technologies, Inc. [Ver = 6, 3, 4, 0 | Size = 528384 bytes | Modified Date = 11/2/2006 4:57:56 PM | Attr =    ]
ashdisp.exe -> %ProgramFiles%\Alwil Software\Avast4\ashDisp.exe -> ALWIL Software [Ver = 4, 7, 997, 0 | Size = 75392 bytes | Modified Date = 4/30/2007 11:42:48 AM | Attr =    ]
ashmaisv.exe -> %ProgramFiles%\Alwil Software\Avast4\ashMaiSv.exe -> ALWIL Software [Ver = 4, 7, 997, 0 | Size = 243328 bytes | Modified Date = 4/30/2007 12:04:38 PM | Attr =    ]
ashserv.exe -> %ProgramFiles%\Alwil Software\Avast4\ashServ.exe -> ALWIL Software [Ver = 4, 7, 997, 0 | Size = 132736 bytes | Modified Date = 4/30/2007 11:42:40 AM | Attr =    ]
ashwebsv.exe -> %ProgramFiles%\Alwil Software\Avast4\ashWebSv.exe -> ALWIL Software [Ver = 4, 7, 997, 0 | Size = 345728 bytes | Modified Date = 4/30/2007 11:41:28 AM | Attr =    ]
aswupdsv.exe -> %ProgramFiles%\Alwil Software\Avast4\aswUpdSv.exe -> ALWIL Software [Ver = 4, 7, 997, 0 | Size = 16512 bytes | Modified Date = 4/30/2007 11:29:56 AM | Attr =    ]
avgas.exe -> %ProgramFiles%\GRISOFT\AVG Anti-Spyware 7.5\avgas.exe -> GRISOFT s.r.o. [Ver = 7, 5, 1, 43 | Size = 6731312 bytes | Modified Date = 6/11/2007 5:25:42 AM | Attr =    ]
guard.exe -> %ProgramFiles%\GRISOFT\AVG Anti-Spyware 7.5\guard.exe -> GRISOFT s.r.o. [Ver = 7, 5, 1, 22 | Size = 312880 bytes | Modified Date = 5/30/2007 8:31:10 AM | Attr =    ]
jusched.exe -> %ProgramFiles%\Java\jre1.6.0_01\bin\jusched.exe -> Sun Microsystems, Inc. [Ver = 6.0.10.6 | Size = 83608 bytes | Modified Date = 3/14/2007 3:43:44 AM | Attr =    ]
vsnpstd3.exe -> %SystemRoot%\vsnpstd3.exe ->  [Ver = 1, 0, 5, 0 | Size = 827392 bytes | Modified Date = 9/19/2006 9:07:28 AM | Attr =    ]
winpfind3u.exe -> %UserDesktop%\AntiVirus Tools\wipfind3u\WinPFind3u\WinPFind3U.exe -> OldTimer Tools [Ver = 1.0.38.0 | Size = 322048 bytes | Modified Date = 6/23/2007 3:15:54 PM | Attr =    ]
wlservice.exe -> %ProgramFiles%\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe -> GEMTEKS [Ver = 1, 0, 0, 9 | Size = 53307 bytes | Modified Date = 7/4/2005 4:46:04 PM | Attr =    ]
wusb54gv42.exe -> %ProgramFiles%\Linksys Wireless-G USB Wireless Network Monitor\WUSB54Gv42.exe -> Linksys [Ver = 1.0.3.0 | Size = 5264384 bytes | Modified Date = 11/9/2005 2:33:42 AM | Attr =    ]

[Win32 Services - Non-Microsoft Only]
(aswUpdSv) avast! iAVS4 Control Service [Win32_Own | Auto | Running] -> %ProgramFiles%\Alwil Software\Avast4\aswUpdSv.exe -> ALWIL Software [Ver = 4, 7, 997, 0 | Size = 16512 bytes | Modified Date = 4/30/2007 11:29:56 AM | Attr =    ]
(avast! Antivirus) avast! Antivirus [Win32_Own | Auto | Running] -> %ProgramFiles%\Alwil Software\Avast4\ashServ.exe -> ALWIL Software [Ver = 4, 7, 997, 0 | Size = 132736 bytes | Modified Date = 4/30/2007 11:42:40 AM | Attr =    ]
(avast! Mail Scanner) avast! Mail Scanner [Win32_Own | On_Demand | Running] -> %ProgramFiles%\Alwil Software\Avast4\ashMaiSv.exe -> ALWIL Software [Ver = 4, 7, 997, 0 | Size = 243328 bytes | Modified Date = 4/30/2007 12:04:38 PM | Attr =    ]
(avast! Web Scanner) avast! Web Scanner [Win32_Own | On_Demand | Running] -> %ProgramFiles%\Alwil Software\Avast4\ashWebSv.exe -> ALWIL Software [Ver = 4, 7, 997, 0 | Size = 345728 bytes | Modified Date = 4/30/2007 11:41:28 AM | Attr =    ]
(AVG Anti-Spyware Guard) AVG Anti-Spyware Guard [Win32_Own | Auto | Running] -> %ProgramFiles%\GRISOFT\AVG Anti-Spyware 7.5\guard.exe -> GRISOFT s.r.o. [Ver = 7, 5, 1, 22 | Size = 312880 bytes | Modified Date = 5/30/2007 8:31:10 AM | Attr =    ]
(dmadmin) Logical Disk Manager Administrative Service [Win32_Shared | On_Demand | Stopped] -> %System32%\dmadmin.exe -> Microsoft Corp., Veritas Software [Ver = 2600.2180.503.0 | Size = 224768 bytes | Modified Date = 8/4/2004 8:00:00 AM | Attr =    ]
(DomainService) DomainService [Win32_Own | Auto | Stopped] -> %System32%\shybxtje.exe -> File not found
(iPod Service) iPod Service [Win32_Own | On_Demand | Stopped] -> %ProgramFiles%\iPod\bin\iPodService.exe -> Apple Inc. [Ver = 7.1.1.5 | Size = 500800 bytes | Modified Date = 3/14/2007 7:05:42 PM | Attr =    ]
(VundoFixSvc) VundoFix Service [Win32_Own | On_Demand | Stopped] -> %System32%\VundoFixSVC.exe -> Atribune.org [Ver = 1.00.0002 | Size = 24576 bytes | Modified Date = 6/30/2007 6:03:24 PM | Attr =    ]
(WUSB54Gv42SVC) WUSB54Gv42SVC [Win32_Own | Auto | Running] -> %ProgramFiles%\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe -> GEMTEKS [Ver = 1, 0, 0, 9 | Size = 53307 bytes | Modified Date = 7/4/2005 4:46:04 PM | Attr =    ]
Logged

extreme_21

  • Guest
Re: Win32:Agent-HOP [Wrm] ..Avast cannot delete file
« Reply #18 on: July 12, 2007, 05:03:17 AM »

[Registry - Non-Microsoft Only]
< Run [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ->
 ->  -> File not found
!AVG Anti-Spyware -> %ProgramFiles%\GRISOFT\AVG Anti-Spyware 7.5\avgas.exe -> GRISOFT s.r.o. [Ver = 7, 5, 1, 43 | Size = 6731312 bytes | Modified Date = 6/11/2007 5:25:42 AM | Attr =    ]
AudioDeck -> %ProgramFiles%\VIA\VIAudioi\SBADeck\ADeck.exe -> VIA Technologies, Inc. [Ver = 6, 3, 4, 0 | Size = 528384 bytes | Modified Date = 11/2/2006 4:57:56 PM | Attr =    ]
avast! -> %ProgramFiles%\Alwil Software\Avast4\ashDisp.exe -> ALWIL Software [Ver = 4, 7, 997, 0 | Size = 75392 bytes | Modified Date = 4/30/2007 11:42:48 AM | Attr =    ]
SunJavaUpdateSched -> %ProgramFiles%\Java\jre1.6.0_01\bin\jusched.exe -> Sun Microsystems, Inc. [Ver = 6.0.10.6 | Size = 83608 bytes | Modified Date = 3/14/2007 3:43:44 AM | Attr =    ]
< ShellExecuteHooks [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks ->
{57B86673-276A-48B2-BAE7-C6DBB3020EB8} [HKLM] -> %ProgramFiles%\GRISOFT\AVG Anti-Spyware 7.5\shellexecutehook.dll [AVG Anti-Spyware 7.5] -> GRISOFT s.r.o. [Ver = 7, 5, 1, 36 | Size = 79408 bytes | Modified Date = 5/30/2007 8:29:58 AM | Attr =    ]
{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} [HKLM] -> %ProgramFiles%\SUPERAntiSpyware\SASSEH.DLL [] -> SuperAdBlocker.com [Ver = 1, 0, 0, 1008 | Size = 77824 bytes | Modified Date = 12/20/2006 1:55:48 PM | Attr =    ]
{674DDFA6-BB3D-427B-961F-E9EEEF293004} [HKLM] -> Reg Data - Key not found [] -> File not found
{7C24493F-3D23-4258-9426-42C5FC3B8211} [HKLM] -> Reg Data - Key not found [] -> File not found
< SecurityProviders [HKLM] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders ->
< Winlogon settings [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ->
< Winlogon settings [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon ->
< Winlogon\Notify settings [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\ ->
!SASWinLogon -> %ProgramFiles%\SUPERAntiSpyware\SASWINLO.dll -> SUPERAntiSpyware.com [Ver = 1, 0, 0, 1046 | Size = 294912 bytes | Modified Date = 4/19/2007 1:41:36 PM | Attr =    ]
< CurrentVersion Policy Settings [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ ->  ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ ->  ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\ ->  ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\ ->  ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\\{BDEADF00-C265-11D0-BCED-00A0C90AB50F} -> 1 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\\{6DFD7C5C-2451-11d3-A299-00C04F8EF6AF} -> 1073741857 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\NonEnum\\{0DF44EAA-FF21-4412-828E-260A8728E7F1} -> 32 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\ ->  ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\dontdisplaylastusername -> 0 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\legalnoticecaption ->  ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\legalnoticetext ->  ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\shutdownwithoutlogon -> 1 ->
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\\undockwithoutlogon -> 1 ->
< CurrentVersion Policy Settings [HKCU] > -> HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ ->  ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\ActiveDesktop\ ->  ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Associations\ ->  ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\ ->  ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun -> 145 ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run\ ->  ->
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\system\ ->  ->
< HOSTS File > (27 bytes) -> C:\WINDOWS\System32\drivers\etc\Hosts ->
Logged

extreme_21

  • Guest
Re: Win32:Agent-HOP [Wrm] ..Avast cannot delete file
« Reply #19 on: July 12, 2007, 05:03:44 AM »

127.0.0.1       localhost ->  ->
< Internet Explorer Settings > ->  ->
HKLM: Default_Page_URL -> http://go.microsoft.com/fwlink/?LinkId=69157 ->
HKLM: Main\\Default_Search_URL -> http://go.microsoft.com/fwlink/?LinkId=54896 ->
HKLM: Local Page -> %SystemRoot%\system32\blank.htm ->
HKLM: Search Page -> http://go.microsoft.com/fwlink/?LinkId=54896 ->
HKLM: Start Page -> about:blank ->
HKLM: CustomizeSearch -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchcust.htm ->
HKLM: Search\\Default_Search_URL -> http://www.google.com/ie ->
HKLM: SearchAssistant -> http://ie.search.msn.com/{SUB_RFC1766}/srchasst/srchasst.htm ->
HKCU: Local Page -> C:\WINDOWS\SYSTEM32\blank.htm ->
HKCU: Search Page -> http://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch ->
HKCU: Start Page -> http://www.google.ca/ ->
HKCU: ProxyEnable -> 0 ->
< Trusted Sites > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\Domains\ ->
msn.com [ - ] ->  ->
< BHO's > -> HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\ ->
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} [HKLM] -> %CommonProgramFiles%\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [Adobe PDF Reader Link Helper] -> Adobe Systems Incorporated [Ver = 8.0.0.2006102200 | Size = 62080 bytes | Modified Date = 10/23/2006 12:08:42 AM | Attr =    ]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} [HKLM] -> %ProgramFiles%\Java\jre1.6.0_01\bin\ssv.dll [SSVHelper Class] -> Sun Microsystems, Inc. [Ver = 6.0.10.6 | Size = 501400 bytes | Modified Date = 3/14/2007 3:43:40 AM | Attr =    ]
{7E853D72-626A-48EC-A868-BA8D5E23E045} [HKLM] -> Reg Data - Key not found [Reg Data - Key not found] -> File not found
< Internet Explorer Extensions [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\ ->
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} [HKLM] -> %ProgramFiles%\Java\jre1.6.0_01\bin\npjpi160_01.dll [MenuText: Sun Java Console] -> Sun Microsystems, Inc. [Ver = 6.0.10.6 | Size = 132760 bytes | Modified Date = 3/14/2007 3:43:42 AM | Attr =    ]
{08B0E5C0-4FCB-11CF-AAA5-00401C608501} [HKCU] -> %ProgramFiles%\Java\jre1.6.0_01\bin\ssv.dll [MenuText: Sun Java Console] -> Sun Microsystems, Inc. [Ver = 6.0.10.6 | Size = 501400 bytes | Modified Date = 3/14/2007 3:43:40 AM | Attr =    ]
{2670000A-7350-4f3c-8081-5663EE0C6C49} -> Reg Data - Value does not exist [ButtonText: Send to OneNote] -> File not found
{92780B25-18CC-41C8-B9BE-3C9C571A8263} -> Reg Data - Value does not exist [ButtonText: Research] -> File not found
{e2e2dd38-d088-4134-82b7-f2ba38496583} [HKLM] -> Reg Data - Key not found [MenuText: @xpsp3res.dll,-20001] -> File not found
< Internet Explorer Menu Extensions [HKCU] > -> HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\ ->
E&xport to Microsoft Excel ->  -> File not found
< DNS Name Servers [HKLM] > -> HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Tcpip\Parameters\Adapters\ ->
{0D5919AE-6FE7-486D-9403-BC00EF4C7A47} ->    (Linksys Wireless-G USB Network Adapter) ->
{3C2B5E85-E35F-4403-98BA-CFD222C24119} ->    (VIA Rhine II Fast Ethernet Adapter) ->
{5697D3FA-43C3-447B-B180-36CCF55E8FAC} ->    () ->
{887BBED2-CA05-4681-8CC2-7EFE985B9EEF} ->    () ->
{A8E81EC8-4D45-46BF-A69C-9DA33CBDE79D} ->    (Sony Ericsson Device 116 USB Ethernet Emulation (NDIS 5)) ->
{D03BCDE3-5D60-4AA8-946E-4F02EBCD2230} ->    () ->
< Protocol Handlers [HKLM] > -> HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\ ->
ipp -> Reg Data - Key not found -> File not found
msdaipp -> Reg Data - Key not found -> File not found
< Downloaded Program Files > -> HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\ ->
{02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} -> QuickTime Object - CodeBase = http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab ->
{0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} -> CKAVWebScan Object - CodeBase = http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab ->
{166B1BCA-3F9C-11CF-8075-444553540000} -> Shockwave ActiveX Control - CodeBase = http://download.macromedia.com/pub/shockwave/cabs/director/sw.cab ->
{4F1E5B1A-2A80-42CA-8532-2D05CB959537} -> MSN Photo Upload Tool - CodeBase = http://by108w.bay108.mail.live.com/mail/resources/MsnPUpld.cab ->
{5F8469B4-B055-49DD-83F7-62B522420ECC} -> Facebook Photo Uploader Control - CodeBase = http://upload.facebook.com/controls/FacebookPhotoUploader.cab ->
{6414512B-B978-451D-A0D8-FCFDF33E833C} -> WUWebControl Class - CodeBase = http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1177258613250 ->
{6E32070A-766D-4EE6-879C-DC1FA91D2FC3} -> MUWebControl Class - CodeBase = http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1171083299846 ->
{8AD9C840-044E-11D1-B3E9-00805F499D93} -> Java Plug-in 1.6.0_01 - CodeBase = http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab ->
{8FFBE65D-2C9C-4669-84BD-5829DC0B603C} ->  - CodeBase = http://fpdownload.macromedia.com/get/flashplayer/current/ultrashim.cab ->
{CAFEEFAC-0015-0000-0009-ABCDEFFEDCBA} -> Java Plug-in 1.5.0_09 - CodeBase = http://java.sun.com/update/1.5.0/jinstall-1_5_0_09-windows-i586.cab ->
{CAFEEFAC-0015-0000-0011-ABCDEFFEDCBA} -> Java Plug-in 1.5.0_11 - CodeBase = http://java.sun.com/update/1.5.0/jinstall-1_5_0_11-windows-i586.cab ->
{CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} -> Java Plug-in 1.6.0_01 - CodeBase = http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab ->
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} -> Java Plug-in 1.6.0_01 - CodeBase = http://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab ->
{D27CDB6E-AE6D-11CF-96B8-444553540000} ->  - CodeBase = http://fpdownload.macromedia.com/get/flashplayer/current/swflash.cab ->
{E8F628B5-259A-4734-97EE-BA914D7BE941} -> Driver Agent ActiveX Control - CodeBase = http://driveragent.com/files/driveragent.cab ->

Logged

extreme_21

  • Guest
Re: Win32:Agent-HOP [Wrm] ..Avast cannot delete file
« Reply #20 on: July 12, 2007, 05:04:51 AM »
[Files/Folders - Created Within 30 days]
!KillBox -> %SystemDrive%\!KillBox ->  [Folder | Created Date = 6/19/2007 4:58:05 PM | Attr =    ]
Avenger -> %SystemDrive%\Avenger ->  [Folder | Created Date = 6/16/2007 10:21:02 PM | Attr =    ]
ComboFix -> %SystemDrive%\ComboFix ->  [Folder | Created Date = 7/11/2007 9:30:39 PM | Attr =    ]
hiberfil.sys -> %SystemDrive%\hiberfil.sys ->  [Ver =  | Size = 787271680 bytes | Created Date = 1/1/1601 5:00:00 AM | Attr =  HS]
QooBox -> %SystemDrive%\QooBox ->  [Folder | Created Date = 6/16/2007 10:03:06 PM | Attr =    ]
sqmdata17.sqm -> %SystemDrive%\sqmdata17.sqm ->  [Ver =  | Size = 232 bytes | Created Date = 6/20/2007 10:45:02 PM | Attr =  H ]
sqmdata18.sqm -> %SystemDrive%\sqmdata18.sqm ->  [Ver =  | Size = 232 bytes | Created Date = 6/21/2007 11:55:43 PM | Attr =  H ]
sqmdata19.sqm -> %SystemDrive%\sqmdata19.sqm ->  [Ver =  | Size = 232 bytes | Created Date = 6/22/2007 6:00:24 PM | Attr =  H ]
sqmnoopt17.sqm -> %SystemDrive%\sqmnoopt17.sqm ->  [Ver =  | Size = 244 bytes | Created Date = 6/20/2007 10:45:02 PM | Attr =  H ]
sqmnoopt18.sqm -> %SystemDrive%\sqmnoopt18.sqm ->  [Ver =  | Size = 244 bytes | Created Date = 6/21/2007 11:55:43 PM | Attr =  H ]
sqmnoopt19.sqm -> %SystemDrive%\sqmnoopt19.sqm ->  [Ver =  | Size = 244 bytes | Created Date = 6/22/2007 6:00:24 PM | Attr =  H ]
VundoFix Backups -> %SystemDrive%\VundoFix Backups ->  [Folder | Created Date = 6/15/2007 7:23:21 PM | Attr =    ]
$NtUninstallKB929123$ -> %SystemRoot%\$NtUninstallKB929123$ ->  [Folder | Created Date = 6/13/2007 2:07:20 AM | Attr =  H ]
$NtUninstallKB935839$ -> %SystemRoot%\$NtUninstallKB935839$ ->  [Folder | Created Date = 6/13/2007 2:04:37 AM | Attr =  H ]
$NtUninstallKB935840$ -> %SystemRoot%\$NtUninstallKB935840$ ->  [Folder | Created Date = 6/13/2007 2:06:57 AM | Attr =  H ]
$NtUninstallKB936357$ -> %SystemRoot%\$NtUninstallKB936357$ ->  [Folder | Created Date = 7/10/2007 11:24:53 PM | Attr =  H ]
catchme.exe -> %SystemRoot%\catchme.exe ->  [Ver =  | Size = 87552 bytes | Created Date = 6/16/2007 9:55:10 PM | Attr =    ]
CSC -> %SystemRoot%\CSC ->  [Folder | Created Date = 6/28/2007 8:53:46 PM | Attr =  HS]
erdnt -> %SystemRoot%\erdnt ->  [Folder | Created Date = 6/16/2007 10:06:25 PM | Attr =    ]
nircmd.exe -> %SystemRoot%\nircmd.exe -> NirSoft [Ver = 1.85 | Size = 49152 bytes | Created Date = 6/16/2007 9:55:09 PM | Attr =    ]
amcompat.tlb -> %System32%\amcompat.tlb ->  [Ver =  | Size = 16832 bytes | Created Date = 6/16/2007 5:15:51 PM | Attr =    ]
appmgmt -> %System32%\appmgmt ->  [Folder | Created Date = 6/24/2007 9:34:16 AM | Attr =    ]
bysfyocv.ini -> %System32%\bysfyocv.ini ->  [Ver =  | Size = 465 bytes | Created Date = 6/18/2007 12:01:39 AM | Attr =  HS]
cvewtayc.ini -> %System32%\cvewtayc.ini ->  [Ver =  | Size = 899015 bytes | Created Date = 6/19/2007 4:52:15 PM | Attr =  HS]
exujklqs.exe -> %System32%\exujklqs.exe ->  [Ver =  | Size = 4672 bytes | Created Date = 1/1/1601 5:00:00 AM | Attr =    ]
fhqqbybr.ini -> %System32%\fhqqbybr.ini ->  [Ver =  | Size = 898896 bytes | Created Date = 6/19/2007 6:54:41 AM | Attr =  HS]
fpkjbpgm.exe -> %System32%\fpkjbpgm.exe ->  [Ver =  | Size = 4672 bytes | Created Date = 1/1/1601 5:00:00 AM | Attr =    ]
fqkxpwbs.ini -> %System32%\fqkxpwbs.ini ->  [Ver =  | Size = 922010 bytes | Created Date = 6/15/2007 8:10:55 PM | Attr =  HS]
gcrkyxwp.ini -> %System32%\gcrkyxwp.ini ->  [Ver =  | Size = 944167 bytes | Created Date = 6/13/2007 5:35:23 PM | Attr =  HS]
ghkmp.bak1 -> %System32%\ghkmp.bak1 ->  [Ver =  | Size = 6409 bytes | Created Date = 6/24/2007 10:35:52 PM | Attr =  HS]
ghkmp.bak2 -> %System32%\ghkmp.bak2 ->  [Ver =  | Size = 1448219 bytes | Created Date = 6/25/2007 10:36:10 AM | Attr =  HS]
ghkmp.ini -> %System32%\ghkmp.ini ->  [Ver =  | Size = 1448946 bytes | Created Date = 6/24/2007 10:35:30 PM | Attr =  HS]
gold.exe -> %System32%\gold.exe -> Emergy Development [Ver = 1.00 | Size = 178688 bytes | Created Date = 6/25/2007 4:09:24 PM | Attr =    ]
GroupPolicy -> %System32%\GroupPolicy ->  [Folder | Created Date = 6/25/2007 2:41:14 PM | Attr =  H ]
hutnqjyu.ini -> %System32%\hutnqjyu.ini ->  [Ver =  | Size = 959999 bytes | Created Date = 6/27/2007 8:46:16 PM | Attr =  HS]
initdebug.nfo -> %System32%\initdebug.nfo ->  [Ver =  | Size = 45 bytes | Created Date = 6/25/2007 2:56:01 PM | Attr =    ]
Kaspersky Lab -> %System32%\Kaspersky Lab ->  [Folder | Created Date = 6/15/2007 6:02:03 PM | Attr =    ]
mmwurmxi.ini -> %System32%\mmwurmxi.ini ->  [Ver =  | Size = 898776 bytes | Created Date = 6/18/2007 6:39:39 AM | Attr =  HS]
nscompat.tlb -> %System32%\nscompat.tlb ->  [Ver =  | Size = 23392 bytes | Created Date = 6/16/2007 5:15:50 PM | Attr =    ]
petaccnj.exe -> %System32%\petaccnj.exe ->  [Ver =  | Size = 4672 bytes | Created Date = 1/1/1601 5:00:00 AM | Attr =    ]
qtstv.ini -> %System32%\qtstv.ini ->  [Ver =  | Size = 6616 bytes | Created Date = 6/20/2007 4:50:48 PM | Attr =  HS]
rt2500usb.cat -> %System32%\rt2500usb.cat ->  [Ver =  | Size = 8022 bytes | Created Date = 7/3/2007 9:31:12 PM | Attr =    ]
rt2500usb.sys -> %System32%\rt2500usb.sys -> Ralink Technology Inc. [Ver = 2.01.00.0000 | Size = 245376 bytes | Created Date = 7/3/2007 9:31:12 PM | Attr =    ]
rtstv.bak1 -> %System32%\rtstv.bak1 ->  [Ver =  | Size = 6570 bytes | Created Date = 6/21/2007 5:01:40 PM | Attr =  HS]
rtstv.bak2 -> %System32%\rtstv.bak2 ->  [Ver =  | Size = 1242081 bytes | Created Date = 6/22/2007 6:53:57 PM | Attr =  HS]
rtstv.ini -> %System32%\rtstv.ini ->  [Ver =  | Size = 1246351 bytes | Created Date = 6/21/2007 5:01:29 PM | Attr =  HS]
rtstv.ini2 -> %System32%\rtstv.ini2 ->  [Ver =  | Size = 7386 bytes | Created Date = 6/21/2007 7:07:33 PM | Attr =  HS]
skmmokui.ini -> %System32%\skmmokui.ini ->  [Ver =  | Size = 405 bytes | Created Date = 6/17/2007 10:40:33 PM | Attr =  HS]
swreg.exe -> %System32%\swreg.exe -> SteelWerX [Ver = 2.0.1.6 | Size = 428032 bytes | Created Date = 6/16/2007 9:55:09 PM | Attr =    ]
swsc.exe -> %System32%\swsc.exe -> SteelWerX [Ver = 2.0.0.0 | Size = 370688 bytes | Created Date = 6/16/2007 9:55:09 PM | Attr =    ]
swxcacls.exe -> %System32%\swxcacls.exe -> SteelWerX [Ver = 1.0.1.1 | Size = 212480 bytes | Created Date = 6/16/2007 9:55:09 PM | Attr =    ]
uhhokujc.ini -> %System32%\uhhokujc.ini ->  [Ver =  | Size = 944153 bytes | Created Date = 6/12/2007 5:32:03 PM | Attr =  HS]
uibieepm.ini -> %System32%\uibieepm.ini ->  [Ver =  | Size = 984490 bytes | Created Date = 6/14/2007 5:32:21 PM | Attr =  HS]
vfind.exe -> %System32%\vfind.exe ->  [Ver =  | Size = 49152 bytes | Created Date = 6/16/2007 9:55:09 PM | Attr =    ]
VundoFixSVC.exe -> %System32%\VundoFixSVC.exe -> Atribune.org [Ver = 1.00.0002 | Size = 24576 bytes | Created Date = 6/30/2007 5:03:22 PM | Attr =    ]
WLAN.INI -> %System32%\WLAN.INI ->  [Ver =  | Size = 1668 bytes | Created Date = 7/3/2007 9:31:05 PM | Attr =    ]
wluwfnnw.ini -> %System32%\wluwfnnw.ini ->  [Ver =  | Size = 921768 bytes | Created Date = 6/16/2007 10:33:39 PM | Attr =  HS]
wqunhevu.ini -> %System32%\wqunhevu.ini ->  [Ver =  | Size = 405 bytes | Created Date = 6/15/2007 7:44:36 PM | Attr =  HS]
WUSB20XP.sys -> %System32%\WUSB20XP.sys -> Cisco-Linksys, LLC. [Ver = 1.0.8 | Size = 339488 bytes | Created Date = 7/3/2007 9:31:12 PM | Attr =    ]
WUSB54G.cat -> %System32%\WUSB54G.cat ->  [Ver =  | Size = 8090 bytes | Created Date = 7/3/2007 9:31:12 PM | Attr =    ]
WUSB54GV2.cat -> %System32%\WUSB54GV2.cat ->  [Ver =  | Size = 7846 bytes | Created Date = 7/3/2007 9:31:12 PM | Attr =    ]
WUSBGXP.sys -> %System32%\WUSBGXP.sys -> Cisco-Linksys, LLC. [Ver = 3.00.12 | Size = 374752 bytes | Created Date = 7/3/2007 9:31:12 PM | Attr =    ]
AegisP.sys -> %System32%\drivers\AegisP.sys -> Meetinghouse Data Communications [Ver = 3.4.3.0 | Size = 20747 bytes | Created Date = 7/3/2007 9:31:13 PM | Attr =    ]
AvgArCln.sys -> %System32%\drivers\AvgArCln.sys -> GRISOFT, s.r.o. [Ver = 1.0.0.14 | Size = 3968 bytes | Created Date = 6/24/2007 1:08:52 PM | Attr =    ]
AvgAsCln.sys -> %System32%\drivers\AvgAsCln.sys -> GRISOFT, s.r.o. [Ver = 1.0.0.14 | Size = 10872 bytes | Created Date = 6/25/2007 10:37:26 PM | Attr =    ]
hosts.ics -> %System32%\drivers\etc\hosts.ics ->  [Ver =  | Size = 374 bytes | Created Date = 7/3/2007 6:58:36 PM | Attr =    ]
Msft_User_WpdMtpDr_01_00_00.Wdf -> %System32%\drivers\UMDF\Msft_User_WpdMtpDr_01_00_00.Wdf ->  [Ver =  | Size = 0 bytes | Created Date = 6/16/2007 6:33:24 PM | Attr =  H ]
Logged

extreme_21

  • Guest
Re: Win32:Agent-HOP [Wrm] ..Avast cannot delete file
« Reply #21 on: July 12, 2007, 05:06:11 AM »

[Files/Folders - Modified Within 30 days]
!KillBox -> %SystemDrive%\!KillBox ->  [Folder | Modified Date = 6/22/2007 5:58:34 PM | Attr =    ]
Avenger -> %SystemDrive%\Avenger ->  [Folder | Modified Date = 6/16/2007 11:21:04 PM | Attr =    ]
boot.ini -> %SystemDrive%\boot.ini ->  [Ver =  | Size = 211 bytes | Modified Date = 7/11/2007 10:29:20 PM | Attr =  HS]
ComboFix -> %SystemDrive%\ComboFix ->  [Folder | Modified Date = 7/11/2007 10:38:32 PM | Attr =    ]
Config.Msi -> %SystemDrive%\Config.Msi ->  [Folder | Modified Date = 7/11/2007 10:24:54 PM | Attr =    ]
Documents and Settings -> %SystemDrive%\Documents and Settings ->  [Folder | Modified Date = 6/24/2007 10:26:48 AM | Attr =    ]
hiberfil.sys -> %SystemDrive%\hiberfil.sys ->  [Ver =  | Size = 787271680 bytes | Modified Date = 7/11/2007 10:24:56 PM | Attr =  HS]
Program Files -> %ProgramFiles% ->  [Folder | Modified Date = 7/3/2007 10:31:08 PM | Attr = R  ]
QooBox -> %SystemDrive%\QooBox ->  [Folder | Modified Date = 6/16/2007 11:03:08 PM | Attr =    ]
RECYCLER -> %SystemDrive%\RECYCLER ->  [Folder | Modified Date = 6/24/2007 10:28:06 AM | Attr =  HS]
sqmdata00.sqm -> %SystemDrive%\sqmdata00.sqm ->  [Ver =  | Size = 232 bytes | Modified Date = 6/24/2007 2:09:08 PM | Attr =  H ]
sqmdata01.sqm -> %SystemDrive%\sqmdata01.sqm ->  [Ver =  | Size = 232 bytes | Modified Date = 6/25/2007 5:42:12 PM | Attr =  H ]
sqmdata02.sqm -> %SystemDrive%\sqmdata02.sqm ->  [Ver =  | Size = 232 bytes | Modified Date = 6/25/2007 11:53:44 PM | Attr =  H ]
sqmdata03.sqm -> %SystemDrive%\sqmdata03.sqm ->  [Ver =  | Size = 232 bytes | Modified Date = 7/9/2007 12:29:36 AM | Attr =  H ]
sqmdata04.sqm -> %SystemDrive%\sqmdata04.sqm ->  [Ver =  | Size = 232 bytes | Modified Date = 7/9/2007 7:09:38 AM | Attr =  H ]
sqmdata17.sqm -> %SystemDrive%\sqmdata17.sqm ->  [Ver =  | Size = 232 bytes | Modified Date = 6/20/2007 11:45:04 PM | Attr =  H ]
sqmdata18.sqm -> %SystemDrive%\sqmdata18.sqm ->  [Ver =  | Size = 232 bytes | Modified Date = 6/22/2007 12:55:44 AM | Attr =  H ]
sqmdata19.sqm -> %SystemDrive%\sqmdata19.sqm ->  [Ver =  | Size = 232 bytes | Modified Date = 6/22/2007 7:00:26 PM | Attr =  H ]
sqmnoopt00.sqm -> %SystemDrive%\sqmnoopt00.sqm ->  [Ver =  | Size = 244 bytes | Modified Date = 6/24/2007 2:09:08 PM | Attr =  H ]
sqmnoopt01.sqm -> %SystemDrive%\sqmnoopt01.sqm ->  [Ver =  | Size = 244 bytes | Modified Date = 6/25/2007 5:42:12 PM | Attr =  H ]
sqmnoopt02.sqm -> %SystemDrive%\sqmnoopt02.sqm ->  [Ver =  | Size = 244 bytes | Modified Date = 6/25/2007 11:53:44 PM | Attr =  H ]
sqmnoopt03.sqm -> %SystemDrive%\sqmnoopt03.sqm ->  [Ver =  | Size = 244 bytes | Modified Date = 7/9/2007 12:29:36 AM | Attr =  H ]
sqmnoopt04.sqm -> %SystemDrive%\sqmnoopt04.sqm ->  [Ver =  | Size = 244 bytes | Modified Date = 7/9/2007 7:09:38 AM | Attr =  H ]
sqmnoopt17.sqm -> %SystemDrive%\sqmnoopt17.sqm ->  [Ver =  | Size = 244 bytes | Modified Date = 6/20/2007 11:45:04 PM | Attr =  H ]
sqmnoopt18.sqm -> %SystemDrive%\sqmnoopt18.sqm ->  [Ver =  | Size = 244 bytes | Modified Date = 6/22/2007 12:55:44 AM | Attr =  H ]
sqmnoopt19.sqm -> %SystemDrive%\sqmnoopt19.sqm ->  [Ver =  | Size = 244 bytes | Modified Date = 6/22/2007 7:00:26 PM | Attr =  H ]
System Volume Information -> %SystemDrive%\System Volume Information ->  [Folder | Modified Date = 6/25/2007 3:08:16 PM | Attr =  HS]
VundoFix Backups -> %SystemDrive%\VundoFix Backups ->  [Folder | Modified Date = 6/30/2007 6:15:48 PM | Attr =    ]
WINDOWS -> %SystemRoot% ->  [Folder | Modified Date = 7/11/2007 10:26:16 PM | Attr =    ]
$hf_mig$ -> %SystemRoot%\$hf_mig$ ->  [Folder | Modified Date = 7/10/2007 9:19:36 PM | Attr =  H ]
$NtUninstallKB929123$ -> %SystemRoot%\$NtUninstallKB929123$ ->  [Folder | Modified Date = 6/13/2007 3:07:22 AM | Attr =  H ]
$NtUninstallKB935839$ -> %SystemRoot%\$NtUninstallKB935839$ ->  [Folder | Modified Date = 6/13/2007 3:04:38 AM | Attr =  H ]
$NtUninstallKB935840$ -> %SystemRoot%\$NtUninstallKB935840$ ->  [Folder | Modified Date = 6/13/2007 3:06:58 AM | Attr =  H ]
$NtUninstallKB936357$ -> %SystemRoot%\$NtUninstallKB936357$ ->  [Folder | Modified Date = 7/11/2007 12:24:54 AM | Attr =  H ]
bootstat.dat -> %SystemRoot%\bootstat.dat ->  [Ver =  | Size = 2048 bytes | Modified Date = 7/11/2007 10:24:58 PM | Attr =   S]
cache -> %SystemRoot%\cache ->  [Folder | Modified Date = 7/3/2007 10:41:36 PM | Attr =    ]
CSC -> %SystemRoot%\CSC ->  [Folder | Modified Date = 7/2/2007 2:16:56 PM | Attr =  HS]
Downloaded Program Files -> %SystemRoot%\Downloaded Program Files ->  [Folder | Modified Date = 6/22/2007 9:00:46 PM | Attr =   S]
erdnt -> %SystemRoot%\erdnt ->  [Folder | Modified Date = 6/16/2007 11:06:26 PM | Attr =    ]
Help -> %SystemRoot%\Help ->  [Folder | Modified Date = 6/19/2007 8:21:50 PM | Attr =    ]
imsins.BAK -> %SystemRoot%\imsins.BAK ->  [Ver =  | Size = 1917 bytes | Modified Date = 6/24/2007 10:34:46 AM | Attr =    ]
inf -> %SystemRoot%\inf ->  [Folder | Modified Date = 7/11/2007 12:25:08 AM | Attr =  H ]
Installer -> %SystemRoot%\Installer ->  [Folder | Modified Date = 7/11/2007 12:25:44 AM | Attr =  HS]
od5.ini -> %SystemRoot%\od5.ini ->  [Ver =  | Size = 32380 bytes | Modified Date = 7/2/2007 3:03:44 PM | Attr =    ]
Prefetch -> %SystemRoot%\Prefetch ->  [Folder | Modified Date = 7/11/2007 10:42:06 PM | Attr =    ]
security -> %SystemRoot%\security ->  [Folder | Modified Date = 7/10/2007 11:07:34 PM | Attr =    ]
system.ini -> %SystemRoot%\system.ini ->  [Ver =  | Size = 246 bytes | Modified Date = 7/11/2007 10:29:20 PM | Attr =    ]
system32 -> %System32% ->  [Folder | Modified Date = 7/11/2007 10:48:10 PM | Attr =    ]
Tasks -> %SystemRoot%\Tasks ->  [Folder | Modified Date = 6/24/2007 11:25:08 PM | Attr =   S]
Temp -> %SystemRoot%\Temp ->  [Folder | Modified Date = 7/11/2007 10:38:32 PM | Attr =    ]
twain_32 -> %SystemRoot%\twain_32 ->  [Folder | Modified Date = 7/10/2007 11:07:18 PM | Attr =    ]
win.ini -> %SystemRoot%\win.ini ->  [Ver =  | Size = 1171 bytes | Modified Date = 7/11/2007 10:29:20 PM | Attr =    ]
AppleSoftwareUpdate.job -> %SystemRoot%\tasks\AppleSoftwareUpdate.job ->  [Ver =  | Size = 284 bytes | Modified Date = 6/30/2007 4:16:04 PM | Attr =    ]
Logged

extreme_21

  • Guest
Re: Win32:Agent-HOP [Wrm] ..Avast cannot delete file
« Reply #22 on: July 12, 2007, 05:06:38 AM »
SA.DAT -> %SystemRoot%\tasks\SA.DAT ->  [Ver =  | Size = 6 bytes | Modified Date = 7/11/2007 10:25:16 PM | Attr =  H ]
amcompat.tlb -> %System32%\amcompat.tlb ->  [Ver =  | Size = 16832 bytes | Modified Date = 6/16/2007 6:15:52 PM | Attr =    ]
appmgmt -> %System32%\appmgmt ->  [Folder | Modified Date = 6/24/2007 10:34:18 AM | Attr =    ]
bysfyocv.ini -> %System32%\bysfyocv.ini ->  [Ver =  | Size = 465 bytes | Modified Date = 6/18/2007 1:02:06 AM | Attr =  HS]
CatRoot -> %System32%\CatRoot ->  [Folder | Modified Date = 7/9/2007 7:05:20 AM | Attr =    ]
CatRoot2 -> %System32%\CatRoot2 ->  [Folder | Modified Date = 7/10/2007 9:19:30 PM | Attr =    ]
config -> %System32%\config ->  [Folder | Modified Date = 6/16/2007 11:12:56 PM | Attr =    ]
CONFIG.NT -> %System32%\CONFIG.NT ->  [Ver =  | Size = 2626 bytes | Modified Date = 6/24/2007 11:44:00 PM | Attr =    ]
cvewtayc.ini -> %System32%\cvewtayc.ini ->  [Ver =  | Size = 899015 bytes | Modified Date = 6/19/2007 6:18:40 PM | Attr =  HS]
dllcache -> %System32%\dllcache ->  [Folder | Modified Date = 7/11/2007 12:24:58 AM | Attr = RHS]
drivers -> %System32%\drivers ->  [Folder | Modified Date = 7/11/2007 10:35:24 PM | Attr =    ]
fhqqbybr.ini -> %System32%\fhqqbybr.ini ->  [Ver =  | Size = 898896 bytes | Modified Date = 6/19/2007 5:41:50 PM | Attr =  HS]
fqkxpwbs.ini -> %System32%\fqkxpwbs.ini ->  [Ver =  | Size = 922010 bytes | Modified Date = 6/16/2007 1:00:50 PM | Attr =  HS]
gcrkyxwp.ini -> %System32%\gcrkyxwp.ini ->  [Ver =  | Size = 944167 bytes | Modified Date = 6/13/2007 6:35:56 PM | Attr =  HS]
ghkmp.bak1 -> %System32%\ghkmp.bak1 ->  [Ver =  | Size = 6409 bytes | Modified Date = 6/24/2007 11:35:54 PM | Attr =  HS]
ghkmp.bak2 -> %System32%\ghkmp.bak2 ->  [Ver =  | Size = 1448219 bytes | Modified Date = 6/25/2007 11:36:12 AM | Attr =  HS]
ghkmp.ini -> %System32%\ghkmp.ini ->  [Ver =  | Size = 1448946 bytes | Modified Date = 6/25/2007 2:32:36 PM | Attr =  HS]
gold.exe -> %System32%\gold.exe -> Emergy Development [Ver = 1.00 | Size = 178688 bytes | Modified Date = 6/25/2007 11:15:18 PM | Attr =    ]
GroupPolicy -> %System32%\GroupPolicy ->  [Folder | Modified Date = 6/25/2007 3:41:16 PM | Attr =  H ]
hutnqjyu.ini -> %System32%\hutnqjyu.ini ->  [Ver =  | Size = 959999 bytes | Modified Date = 6/27/2007 10:30:14 PM | Attr =  HS]
initdebug.nfo -> %System32%\initdebug.nfo ->  [Ver =  | Size = 45 bytes | Modified Date = 6/25/2007 3:56:04 PM | Attr =    ]
Kaspersky Lab -> %System32%\Kaspersky Lab ->  [Folder | Modified Date = 6/15/2007 7:02:04 PM | Attr =    ]
mmwurmxi.ini -> %System32%\mmwurmxi.ini ->  [Ver =  | Size = 898776 bytes | Modified Date = 6/19/2007 7:52:32 AM | Attr =  HS]
nscompat.tlb -> %System32%\nscompat.tlb ->  [Ver =  | Size = 23392 bytes | Modified Date = 6/16/2007 6:15:52 PM | Attr =    ]
qtstv.ini -> %System32%\qtstv.ini ->  [Ver =  | Size = 6616 bytes | Modified Date = 6/20/2007 5:56:10 PM | Attr =  HS]
Restore -> %System32%\Restore ->  [Folder | Modified Date = 6/24/2007 9:23:18 PM | Attr =    ]
rtstv.bak1 -> %System32%\rtstv.bak1 ->  [Ver =  | Size = 6570 bytes | Modified Date = 6/21/2007 6:01:42 PM | Attr =  HS]
rtstv.bak2 -> %System32%\rtstv.bak2 ->  [Ver =  | Size = 1242081 bytes | Modified Date = 6/22/2007 7:53:58 PM | Attr =  HS]
rtstv.ini -> %System32%\rtstv.ini ->  [Ver =  | Size = 1246351 bytes | Modified Date = 6/22/2007 8:28:48 PM | Attr =  HS]
rtstv.ini2 -> %System32%\rtstv.ini2 ->  [Ver =  | Size = 7386 bytes | Modified Date = 6/21/2007 11:11:04 PM | Attr =  HS]
skmmokui.ini -> %System32%\skmmokui.ini ->  [Ver =  | Size = 405 bytes | Modified Date = 6/18/2007 12:59:02 AM | Attr =  HS]
uhhokujc.ini -> %System32%\uhhokujc.ini ->  [Ver =  | Size = 944153 bytes | Modified Date = 6/13/2007 6:23:44 PM | Attr =  HS]
uibieepm.ini -> %System32%\uibieepm.ini ->  [Ver =  | Size = 984490 bytes | Modified Date = 6/15/2007 6:38:34 PM | Attr =  HS]
VundoFixSVC.exe -> %System32%\VundoFixSVC.exe -> Atribune.org [Ver = 1.00.0002 | Size = 24576 bytes | Modified Date = 6/30/2007 6:03:24 PM | Attr =    ]
WLAN.INI -> %System32%\WLAN.INI ->  [Ver =  | Size = 1668 bytes | Modified Date = 7/3/2007 10:46:12 PM | Attr =    ]
wluwfnnw.ini -> %System32%\wluwfnnw.ini ->  [Ver =  | Size = 921768 bytes | Modified Date = 6/17/2007 11:33:58 PM | Attr =  HS]
wpa.dbl -> %System32%\wpa.dbl ->  [Ver =  | Size = 1374 bytes | Modified Date = 7/11/2007 10:26:46 PM | Attr =    ]
wqunhevu.ini -> %System32%\wqunhevu.ini ->  [Ver =  | Size = 405 bytes | Modified Date = 6/15/2007 9:09:52 PM | Attr =  HS]
ywajaypv.ini -> %System32%\ywajaypv.ini ->  [Ver =  | Size = 943928 bytes | Modified Date = 6/12/2007 6:35:48 PM | Attr =  HS]
AegisP.sys -> %System32%\drivers\AegisP.sys -> Meetinghouse Data Communications [Ver = 3.4.3.0 | Size = 20747 bytes | Modified Date = 7/3/2007 10:46:52 PM | Attr =    ]
etc -> %System32%\drivers\etc ->  [Folder | Modified Date = 6/24/2007 11:30:10 PM | Attr =    ]
UMDF -> %System32%\drivers\UMDF ->  [Folder | Modified Date = 6/16/2007 7:33:26 PM | Attr =    ]
hosts.ics -> %System32%\drivers\etc\hosts.ics ->  [Ver =  | Size = 374 bytes | Modified Date = 7/3/2007 7:58:38 PM | Attr =    ]
Msft_User_WpdMtpDr_01_00_00.Wdf -> %System32%\drivers\UMDF\Msft_User_WpdMtpDr_01_00_00.Wdf ->  [Ver =  | Size = 0 bytes | Modified Date = 6/16/2007 7:33:26 PM | Attr =  H ]
Logged

extreme_21

  • Guest
Re: Win32:Agent-HOP [Wrm] ..Avast cannot delete file
« Reply #23 on: July 12, 2007, 05:07:02 AM »

[File String Scan - Non-Microsoft Only]
UPX! , UPX0 ,  -> %System32%\aswBoot.exe -> ALWIL Software [Ver = 4, 7, 997, 0 | Size = 745600 bytes | Modified Date = 4/30/2007 11:46:10 AM | Attr =    ]
PEC2 ,  -> %System32%\dfrg.msc ->  [Ver =  | Size = 41397 bytes | Modified Date = 8/4/2004 8:00:00 AM | Attr =    ]
winsync ,  -> %System32%\wbdbase.deu ->  [Ver =  | Size = 1309184 bytes | Modified Date = 8/4/2004 8:00:00 AM | Attr =    ]
WSUD , UPX0 ,  -> %System32%\dllcache\hwxjpn.dll ->  [Ver =  | Size = 13463552 bytes | Modified Date = 8/4/2004 8:00:00 AM | Attr =    ]
PEC2 ,  -> %System32%\drivers\VcommMgr.sys -> IVT Corporation [Ver = 2.20 | Size = 82148 bytes | Modified Date = 11/5/2004 11:39:08 AM | Attr =    ]

< End of report >
Logged

extreme_21

  • Guest
Re: Win32:Agent-HOP [Wrm] ..Avast cannot delete file
« Reply #24 on: July 12, 2007, 06:00:47 AM »
btw..here's a recent link to the forum i was getting help from: http://forums.techguy.org/security/584634-win32-agent-hop-molebox-how-3.html
Logged

mauserme

  • Guest
Re: Win32:Agent-HOP [Wrm] ..Avast cannot delete file
« Reply #25 on: July 12, 2007, 01:56:10 PM »
If you haven't already downloaded OTMoveIt  by OldTimer do so now and save it to your desktop.  Don't do anything with this yet.
 

Start WinPFind3U. Copy/Paste the information in the quotebox below into the pane where it says "Paste fix here" and then click the Run Fix button.

Quote

[Files/Folders - Created Within 30 days]
NY -> amcompat.tlb -> %System32%\amcompat.tlb
NY -> bysfyocv.ini -> %System32%\bysfyocv.ini
NY -> cvewtayc.ini -> %System32%\cvewtayc.ini
NY -> exujklqs.exe -> %System32%\exujklqs.exe
NY -> fhqqbybr.ini -> %System32%\fhqqbybr.ini
NY -> fpkjbpgm.exe -> %System32%\fpkjbpgm.exe
NY -> fqkxpwbs.ini -> %System32%\fqkxpwbs.ini
NY -> gcrkyxwp.ini -> %System32%\gcrkyxwp.ini
NY -> ghkmp.bak1 -> %System32%\ghkmp.bak1
NY -> ghkmp.bak2 -> %System32%\ghkmp.bak2
NY -> ghkmp.ini -> %System32%\ghkmp.ini
NY -> hutnqjyu.ini -> %System32%\hutnqjyu.ini
NY -> mmwurmxi.ini -> %System32%\mmwurmxi.ini
NY -> petaccnj.exe -> %System32%\petaccnj.exe
NY -> qtstv.ini -> %System32%\qtstv.ini
NY -> rtstv.bak1 -> %System32%\rtstv.bak1
NY -> rtstv.bak2 -> %System32%\rtstv.bak2
NY -> rtstv.ini -> %System32%\rtstv.ini
NY -> rtstv.ini2 -> %System32%\rtstv.ini2
NY -> skmmokui.ini -> %System32%\skmmokui.ini
NY -> uhhokujc.ini -> %System32%\uhhokujc.ini
NY -> uibieepm.ini -> %System32%\uibieepm.ini
NY -> wluwfnnw.ini -> %System32%\wluwfnnw.ini
NY -> wqunhevu.ini -> %System32%\wqunhevu.ini
[Files/Folders - Modified Within 30 days]
NY -> imsins.BAK -> %SystemRoot%\imsins.BAK
NY -> qtstv.ini -> %System32%\qtstv.ini
NY -> ywajaypv.ini -> %System32%\ywajaypv.ini


The fix should only take a very short time. When the fix is completed a message box will pop up telling you that it is finished. Click the Ok button and Notepad will open with a log of actions taken during the fix. Post that information.

Also let me know of any problems you encounter performing these steps or any continuing problems you are having with the computer.


Now open OTMoveit.  Copy the file paths below to the clipboard by highlighting it and pressing CTRL + C (or, after highlighting, right-click and choose copy):

Quote

C:\WINDOWS\system32\petaccnj.exe
C:\DOCUME~1\Steph\iop.exe


Return to OTMoveIt, right click on the "Paste List of Files/Folders to be moved" window and choose Paste.
Click the red Moveit! button.
Copy everything on the Results window to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it on your next reply with a new Hijack log.
Close OTMoveIt
If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes.


When those are finished go into Add/Remove Programs in the Control Panel and make sure all old versions of Java have been uninstalled.  It looks like several if these may still be present.

Then post new ComboFix and WinPFind logs (run them in that order).

BTW, some of the files listed above may already have been deleted.  Don't worry if some (many?) aren't found.

Logged

extreme_21

  • Guest
Re: Win32:Agent-HOP [Wrm] ..Avast cannot delete file
« Reply #26 on: July 13, 2007, 03:52:48 AM »
[Files/Folders - Created Within 30 days]
C:\WINDOWS\SYSTEM32\amcompat.tlb moved successfully.
C:\WINDOWS\SYSTEM32\bysfyocv.ini moved successfully.
C:\WINDOWS\SYSTEM32\cvewtayc.ini moved successfully.
File C:\WINDOWS\SYSTEM32\exujklqs.exe not found!
C:\WINDOWS\SYSTEM32\fhqqbybr.ini moved successfully.
File C:\WINDOWS\SYSTEM32\fpkjbpgm.exe not found!
C:\WINDOWS\SYSTEM32\fqkxpwbs.ini moved successfully.
C:\WINDOWS\SYSTEM32\gcrkyxwp.ini moved successfully.
C:\WINDOWS\SYSTEM32\ghkmp.bak1 moved successfully.
C:\WINDOWS\SYSTEM32\ghkmp.bak2 moved successfully.
C:\WINDOWS\SYSTEM32\ghkmp.ini moved successfully.
C:\WINDOWS\SYSTEM32\hutnqjyu.ini moved successfully.
C:\WINDOWS\SYSTEM32\mmwurmxi.ini moved successfully.
File C:\WINDOWS\SYSTEM32\petaccnj.exe not found!
C:\WINDOWS\SYSTEM32\qtstv.ini moved successfully.
C:\WINDOWS\SYSTEM32\rtstv.bak1 moved successfully.
C:\WINDOWS\SYSTEM32\rtstv.bak2 moved successfully.
C:\WINDOWS\SYSTEM32\rtstv.ini moved successfully.
C:\WINDOWS\SYSTEM32\rtstv.ini2 moved successfully.
C:\WINDOWS\SYSTEM32\skmmokui.ini moved successfully.
C:\WINDOWS\SYSTEM32\uhhokujc.ini moved successfully.
C:\WINDOWS\SYSTEM32\uibieepm.ini moved successfully.
C:\WINDOWS\SYSTEM32\wluwfnnw.ini moved successfully.
C:\WINDOWS\SYSTEM32\wqunhevu.ini moved successfully.
[Files/Folders - Modified Within 30 days]
C:\WINDOWS\imsins.BAK moved successfully.
File C:\WINDOWS\SYSTEM32\qtstv.ini not found!
C:\WINDOWS\SYSTEM32\ywajaypv.ini moved successfully.
< End of log >
Created on 07/12/2007 21:52:54
Logged

extreme_21

  • Guest
Re: Win32:Agent-HOP [Wrm] ..Avast cannot delete file
« Reply #27 on: July 13, 2007, 04:01:31 AM »
File/Folder C:\WINDOWS\system32\petaccnj.exe not found.
C:\DOCUME~1\Steph\iop.exe moved successfully.
 
Created on 07/12/2007 21:54:47

***************************************************

Logfile of HijackThis v1.99.1
Scan saved at 10:01:45 PM, on 7/12/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16473)

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WUSB54Gv42.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe
C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
C:\Documents and Settings\Chris\Desktop\AntiVirus Tools\OTMoveIt.exe
C:\WINDOWS\system32\msiexec.exe
C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
C:\Documents and Settings\Chris\Desktop\AntiVirus Tools\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.ca/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [AudioDeck] C:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe 1
O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O11 - Options group: [INTERNATIONAL] International*
O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/20061205/qtinstall.info.apple.com/qtactivex/qtplugin.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by108w.bay108.mail.live.com/mail/resources/MsnPUpld.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1177258613250
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1171083299846
O16 - DPF: {E8F628B5-259A-4734-97EE-BA914D7BE941} (Driver Agent ActiveX Control) - http://driveragent.com/files/driveragent.cab
O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL
O18 - Protocol: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Protocol: ms-help - {314111C7-A502-11D2-BBCA-00C04F8EC294} - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 - Protocol: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 - Filter hijack: text/xml - {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
O21 - SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe" /service (file missing)
O23 - Service: avast! Web Scanner - Unknown owner - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe" /service (file missing)
O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\shybxtje.exe (file missing)
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: VundoFix Service (VundoFixSvc) - Atribune.org - C:\WINDOWS\SYSTEM32\VundoFixSVC.exe
O23 - Service: WUSB54Gv42SVC - Unknown owner - C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe" "WUSB54Gv42.exe (file missing)

Logged

extreme_21

  • Guest
Re: Win32:Agent-HOP [Wrm] ..Avast cannot delete file
« Reply #28 on: July 13, 2007, 04:29:15 AM »
"Chris" - 2007-07-12 22:07:01 - ComboFix 07-07-12.3 - Service Pack 2 

   /wow section - STAGE #8

(((((((((((((((((((((((((((((((((((((((   Drivers/Services   )))))))))))))))))))))))))))))))))))))))))))))))))


-------\LEGACY_DOMAINSERVICE
-------\DomainService


(((((((((((((((((((((((((   Files Created from 2007-06-13 to 2007-07-13  )))))))))))))))))))))))))))))))


2007-07-10 23:06   53,760   --a------   C:\WINDOWS\system32\vfwwdm32.dll
2007-07-03 22:31   374,752   --a------   C:\WINDOWS\system32\WUSBGXP.sys
2007-07-03 22:31   339,488   --a------   C:\WINDOWS\system32\WUSB20XP.sys
2007-07-03 22:31   245,376   --a------   C:\WINDOWS\system32\rt2500usb.sys
2007-07-03 22:31   20,747   --a------   C:\WINDOWS\system32\drivers\AegisP.sys
2007-07-03 22:31   <DIR>   d--------   C:\Program Files\Linksys Wireless-G USB Wireless Network Monitor
2007-06-30 18:03   24,576   --a------   C:\WINDOWS\system32\VundoFixSVC.exe
2007-06-28 21:53   <DIR>   d--hs----   C:\WINDOWS\CSC
2007-06-25 23:37   10,872   --a------   C:\WINDOWS\system32\drivers\AvgAsCln.sys
2007-06-25 22:11   178,688   --a------   C:\DOCUME~1\Colleen\gold.exe
2007-06-25 17:59   178,688   --a------   C:\DOCUME~1\Steph\gold.exe
2007-06-25 17:09   178,688   --a------   C:\WINDOWS\system32\gold.exe
2007-06-25 15:56   <DIR>   d--------   C:\Program Files\SpeedFan
2007-06-25 15:41   <DIR>   d--h-----   C:\WINDOWS\system32\GroupPolicy
2007-06-24 14:08   3,968   --a------   C:\WINDOWS\system32\drivers\AvgArCln.sys
2007-06-24 13:23   <DIR>   d--------   C:\Program Files\RogueRemover
2007-06-24 10:34   <DIR>   d--------   C:\WINDOWS\system32\appmgmt
2007-06-24 10:27   <DIR>   d--------   C:\DOCUME~1\ADMINI~1\APPLIC~1\MySpace
2007-06-24 10:26   786,432   --ah-----   C:\DOCUME~1\ADMINI~1\NTUSER.DAT
2007-06-19 17:58   <DIR>   d--------   C:\!KillBox
2007-06-16 22:55   51,200   --a------   C:\WINDOWS\nircmd.exe
2007-06-15 20:49   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\APPLIC~1\SUPERAntiSpyware.com
2007-06-15 20:48   <DIR>   d--------   C:\Program Files\SUPERAntiSpyware
2007-06-15 20:48   <DIR>   d--------   C:\Program Files\Common Files\Wise Installation Wizard
2007-06-15 20:48   <DIR>   d--------   C:\DOCUME~1\Chris\APPLIC~1\SUPERAntiSpyware.com
2007-06-15 20:23   <DIR>   d--------   C:\VundoFix Backups
2007-06-15 19:02   <DIR>   d--------   C:\WINDOWS\system32\Kaspersky Lab
2007-06-15 19:02   <DIR>   d--------   C:\DOCUME~1\ALLUSE~1\APPLIC~1\Kaspersky Lab
2007-06-13 17:57   <DIR>   d--------   C:\Program Files\NoAdware5.0


((((((((((((((((((((((((((((((((((((((((   Find3M Report   ))))))))))))))))))))))))))))))))))))))))))))))))))))

2007-07-09 01:32:47   --------   d-----w   C:\Program Files\MSN Messenger
2007-06-03 15:36:39   --------   d-----w   C:\DOCUME~1\Chris\APPLIC~1\LimeWire
2007-06-01 04:06:55   --------   d-----w   C:\Program Files\Audacity
2007-06-01 03:12:49   --------   d-----w   C:\DOCUME~1\Chris\APPLIC~1\SonyEricsson
2007-06-01 03:12:41   --------   d-----w   C:\Program Files\Sony Ericsson
2007-05-30 23:26:45   --------   d-----w   C:\Program Files\MySpace
2007-05-26 20:33:28   --------   d-----w   C:\Program Files\QuickTime
2007-05-20 01:56:28   --------   d-----w   C:\DOCUME~1\Chris\APPLIC~1\uTorrent
2007-05-19 19:56:50   --------   d-----w   C:\Program Files\TGTSoft
2007-05-16 15:12:02   683,520   ----a-w   C:\WINDOWS\system32\inetcomm.dll
2007-05-15 23:38:28   --------   d-----w   C:\Program Files\Google
2007-04-30 15:46:10   745,600   ----a-w   C:\WINDOWS\system32\aswBoot.exe
2007-04-30 15:35:28   95,872   ----a-w   C:\WINDOWS\system32\AVASTSS.scr
2007-04-25 14:21:15   144,896   ----a-w   C:\WINDOWS\system32\schannel.dll
2007-04-18 16:12:23   2,854,400   ----a-w   C:\WINDOWS\system32\msi.dll
2007-04-17 02:47:36   33,624   ----a-w   C:\WINDOWS\system32\wups.dll
2007-04-17 02:45:54   1,710,936   ----a-w   C:\WINDOWS\system32\wuaueng.dll
2007-04-17 02:45:48   549,720   ----a-w   C:\WINDOWS\system32\wuapi.dll
2007-04-17 02:45:42   325,976   ----a-w   C:\WINDOWS\system32\wucltui.dll
2007-04-17 02:45:36   203,096   ----a-w   C:\WINDOWS\system32\wuweb.dll
2007-04-17 02:45:28   92,504   ----a-w   C:\WINDOWS\system32\cdm.dll
2007-04-17 02:45:20   53,080   ----a-w   C:\WINDOWS\system32\wuauclt.exe
2007-04-17 02:45:20   43,352   ----a-w   C:\WINDOWS\system32\wups2.dll
2007-04-17 02:44:20   271,224   ----a-w   C:\WINDOWS\system32\mucltui.dll
2007-04-17 02:44:18   208,248   ----a-w   C:\WINDOWS\system32\muweb.dll


(((((((((((((((((((((((((((((((((((((   Reg Loading Points   ))))))))))))))))))))))))))))))))))))))))))))))))))
 
 
*Note* empty entries & legit default entries are not shown

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
2006-10-23 00:08   62080   --a------   C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]
2006-10-27 00:48   2210608   --a------   C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
2007-03-14 03:43   501400   --a------   C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
2006-08-31 21:33   322368   --a------   C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-04-30 11:42]
"@"="" []
"AudioDeck"="C:\Program Files\VIA\VIAudioi\SBADeck\ADeck.exe" [2006-11-02 16:57]
"!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 05:25]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:00]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 12:54]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
"DisableRegistryTools"=0 (0x0)

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"="C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL" [2006-10-27 00:48]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"="C:\Program Files\SUPERAntiSpyware\SASSEH.DLL" [2006-12-20 13:55]
"{57B86673-276A-48B2-BAE7-C6DBB3020EB8}"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\shellexecutehook.dll" [2007-05-30 08:29]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll --a------ 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Driver]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\safeboot\minimal\AVG Anti-Spyware Guard]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware]
"C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor]
"C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
"C:\Program Files\Messenger\msmsgs.exe" /background

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
C:\WINDOWS\system32\NeroCheck.exe

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
"C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SUPERAntiSpyware]
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe


HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{09772DF9-2789-033C-0605-010707050006}
C:\WINDOWS\system32\system.exe

Contents of the 'Scheduled Tasks' folder
2007-06-30 20:16:03  C:\WINDOWS\tasks\AppleSoftwareUpdate.job

**************************************************************************

catchme 0.3.915 W2K/XP/Vista - rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-07-12 22:15:48
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************

Completion time: 2007-07-12 22:19:19 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-07-12 22:19
C:\ComboFix2.txt ... 2007-07-11 22:37
C:\ComboFix3.txt ... 2007-06-24 23:34

   --- E O F ---
Logged

extreme_21

  • Guest
Re: Win32:Agent-HOP [Wrm] ..Avast cannot delete file
« Reply #29 on: July 13, 2007, 04:44:21 AM »
WinPFind3 logfile created on: 7/12/2007 10:30:31 PM
WinPFind3U by OldTimer - Version 1.0.39   Folder = C:\Documents and Settings\Chris\Desktop\AntiVirus Tools\wipfind3u\WinPFind3u\
Microsoft Windows XP Service Pack 2 (Version = 5.1.2600)
Internet Explorer (Version = 7.0.5730.11)
 
750.73 Mb Total Physical Memory | 503.38 Mb Available Physical Memory | 67.05% Memory free
1.07 Gb Paging File | 0.78 Gb Available in Paging File | 72.86% Paging File free
Paging file location(s): c:\pagefile.sys 384 768;
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Program Files
Drive C: | 189.92 Gb Total Space | 162.45 Gb Free Space | 85.54% Space Free
Drive D: | 4.01 Gb Total Space | 2.01 Gb Free Space | 50.10% Space Free
E: Drive not present or media not loaded
F: Drive not present or media not loaded

Computer Name: FAMILY-5B125E0A
Current User Name: Chris
Logged in as Administrator.
Current Boot Mode: Normal


[Processes - Non-Microsoft Only]
adeck.exe -> %ProgramFiles%\VIA\VIAudioi\SBADeck\ADeck.exe -> VIA Technologies, Inc. [Ver = 6, 3, 4, 0 | Size = 528384 bytes | Modified Date = 11/2/2006 4:57:56 PM | Attr =    ]
ashdisp.exe -> %ProgramFiles%\Alwil Software\Avast4\ashDisp.exe -> ALWIL Software [Ver = 4, 7, 997, 0 | Size = 75392 bytes | Modified Date = 4/30/2007 11:42:48 AM | Attr =    ]
ashmaisv.exe -> %ProgramFiles%\Alwil Software\Avast4\ashMaiSv.exe -> ALWIL Software [Ver = 4, 7, 997, 0 | Size = 243328 bytes | Modified Date = 4/30/2007 12:04:38 PM | Attr =    ]
ashserv.exe -> %ProgramFiles%\Alwil Software\Avast4\ashServ.exe -> ALWIL Software [Ver = 4, 7, 997, 0 | Size = 132736 bytes | Modified Date = 4/30/2007 11:42:40 AM | Attr =    ]
ashwebsv.exe -> %ProgramFiles%\Alwil Software\Avast4\ashWebSv.exe -> ALWIL Software [Ver = 4, 7, 997, 0 | Size = 345728 bytes | Modified Date = 4/30/2007 11:41:28 AM | Attr =    ]
aswupdsv.exe -> %ProgramFiles%\Alwil Software\Avast4\aswUpdSv.exe -> ALWIL Software [Ver = 4, 7, 997, 0 | Size = 16512 bytes | Modified Date = 4/30/2007 11:29:56 AM | Attr =    ]
avgas.exe -> %ProgramFiles%\GRISOFT\AVG Anti-Spyware 7.5\avgas.exe -> GRISOFT s.r.o. [Ver = 7, 5, 1, 43 | Size = 6731312 bytes | Modified Date = 6/11/2007 5:25:42 AM | Attr =    ]
guard.exe -> %ProgramFiles%\GRISOFT\AVG Anti-Spyware 7.5\guard.exe -> GRISOFT s.r.o. [Ver = 7, 5, 1, 22 | Size = 312880 bytes | Modified Date = 5/30/2007 8:31:10 AM | Attr =    ]
jusched.exe -> %ProgramFiles%\Java\jre1.6.0_01\bin\jusched.exe -> Sun Microsystems, Inc. [Ver = 6.0.10.6 | Size = 83608 bytes | Modified Date = 3/14/2007 3:43:44 AM | Attr =    ]
winpfind3u.exe -> %UserDesktop%\AntiVirus Tools\wipfind3u\WinPFind3u\WinPFind3U.exe -> OldTimer Tools [Ver = 1.0.38.0 | Size = 322048 bytes | Modified Date = 6/23/2007 3:15:54 PM | Attr =    ]
wlservice.exe -> %ProgramFiles%\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe -> GEMTEKS [Ver = 1, 0, 0, 9 | Size = 53307 bytes | Modified Date = 7/4/2005 4:46:04 PM | Attr =    ]
wusb54gv42.exe -> %ProgramFiles%\Linksys Wireless-G USB Wireless Network Monitor\WUSB54Gv42.exe -> Linksys [Ver = 1.0.3.0 | Size = 5264384 bytes | Modified Date = 11/9/2005 2:33:42 AM | Attr =    ]

[Win32 Services - Non-Microsoft Only]
(aswUpdSv) avast! iAVS4 Control Service [Win32_Own | Auto | Running] -> %ProgramFiles%\Alwil Software\Avast4\aswUpdSv.exe -> ALWIL Software [Ver = 4, 7, 997, 0 | Size = 16512 bytes | Modified Date = 4/30/2007 11:29:56 AM | Attr =    ]
(avast! Antivirus) avast! Antivirus [Win32_Own | Auto | Running] -> %ProgramFiles%\Alwil Software\Avast4\ashServ.exe -> ALWIL Software [Ver = 4, 7, 997, 0 | Size = 132736 bytes | Modified Date = 4/30/2007 11:42:40 AM | Attr =    ]
(avast! Mail Scanner) avast! Mail Scanner [Win32_Own | On_Demand | Running] -> %ProgramFiles%\Alwil Software\Avast4\ashMaiSv.exe -> ALWIL Software [Ver = 4, 7, 997, 0 | Size = 243328 bytes | Modified Date = 4/30/2007 12:04:38 PM | Attr =    ]
(avast! Web Scanner) avast! Web Scanner [Win32_Own | On_Demand | Running] -> %ProgramFiles%\Alwil Software\Avast4\ashWebSv.exe -> ALWIL Software [Ver = 4, 7, 997, 0 | Size = 345728 bytes | Modified Date = 4/30/2007 11:41:28 AM | Attr =    ]
(AVG Anti-Spyware Guard) AVG Anti-Spyware Guard [Win32_Own | Auto | Running] -> %ProgramFiles%\GRISOFT\AVG Anti-Spyware 7.5\guard.exe -> GRISOFT s.r.o. [Ver = 7, 5, 1, 22 | Size = 312880 bytes | Modified Date = 5/30/2007 8:31:10 AM | Attr =    ]
(dmadmin) Logical Disk Manager Administrative Service [Win32_Shared | On_Demand | Stopped] -> %System32%\dmadmin.exe -> Microsoft Corp., Veritas Software [Ver = 2600.2180.503.0 | Size = 224768 bytes | Modified Date = 8/4/2004 8:00:00 AM | Attr =    ]
(iPod Service) iPod Service [Win32_Own | On_Demand | Stopped] -> %ProgramFiles%\iPod\bin\iPodService.exe -> Apple Inc. [Ver = 7.1.1.5 | Size = 500800 bytes | Modified Date = 3/14/2007 7:05:42 PM | Attr =    ]
(VundoFixSvc) VundoFix Service [Win32_Own | On_Demand | Stopped] -> %System32%\VundoFixSVC.exe -> Atribune.org [Ver = 1.00.0002 | Size = 24576 bytes | Modified Date = 6/30/2007 6:03:24 PM | Attr =    ]
(WUSB54Gv42SVC) WUSB54Gv42SVC [Win32_Own | Auto | Running] -> %ProgramFiles%\Linksys Wireless-G USB Wireless Network Monitor\WLService.exe -> GEMTEKS [Ver = 1, 0, 0, 9 | Size = 53307 bytes | Modified Date = 7/4/2005 4:46:04 PM | Attr =    ]
Logged
Pages: 1 [2] 3 4   Go Up
« previous next »