Hi all,
Greetings on a Sunday afternoon. My laptop recently got infected with a virus which i can’t seem to detect/clean with AOL Active Virus Shield and Panda AV2007.
It placed death.exe into my System32 folder but that was cleaned. Couldn’t find supervise.exe though. Also, my explorer.exe keeps trying to connect to the Internet from time to time. And when that happens, i will find some weird files ie 01.exe, 04.exe, 14.exe, etc in my temp folders. Been trying to clean it for the past 24 hours but failed. Also, when i shut down the laptop, it gives an error saying “tl13145 is not responding”.
Here is a log from HijackThis :
Logfile of HijackThis v1.99.1
Scan saved at 2:14:26 PM, on 5/27/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\pavsrv51.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\AVENGINE.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\apvxdwin.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\PsImSvc.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
c:\Program Files\HPQ\Shared\Sierra Wireless\Win32\Unicode\SWIHPWMI.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\Program Files\Analog Devices\SoundMAX\Smax4.exe
C:\WINDOWS\AGRSMMSG.exe
C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\WINDOWS\system32\ctfmon.exe
c:\program files\panda software\panda antivirus 2007\WebProxy.exe
C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
C:\WINDOWS\System32\svchost.exe
C:\Active Ports\aports.exe
C:\BitComet\BitComet.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\explorer.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\WinRAR\WinRAR.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\psimreal.exe
C:\Program Files\Panda Software\Panda Antivirus 2007\avciman.exe
C:\DOCUME~1\JAMOK\LOCALS~1\Temp\Rar$EX20.797\HijackThis.exe
R1 – HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 190.100.90.95:8080
R1 – HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 190.100.90.*;
O1 – Hosts: 188.188.122.33 localhost
O1 – Hosts: dnl-us1.kaspersky-labs.com localhost
O1 – Hosts: dnl-us2.kaspersky-labs.com localhost
O1 – Hosts: dnl-us3.kaspersky-labs.com localhost
O1 – Hosts: dnl-us4.kaspersky-labs.com localhost
O1 – Hosts: dnl-us5.kaspersky-labs.com localhost
O1 – Hosts: dnl-us6.kaspersky-labs.com localhost
O1 – Hosts: dnl-us7.kaspersky-labs.com localhost
O1 – Hosts: dnl-us8.kaspersky-labs.com localhost
O1 – Hosts: dnl-us9.kaspersky-labs.com localhost
O1 – Hosts: dnl-us10.kaspersky-labs.com localhost
O1 – Hosts: dnl-us11.kaspersky-labs.com localhost
O1 – Hosts: dnl-us12.kaspersky-labs.com localhost
O1 – Hosts: dnl-us13.kaspersky-labs.com localhost
O1 – Hosts: dnl-us14.kaspersky-labs.com localhost
O1 – Hosts: dnl-us15.kaspersky-labs.com localhost
O1 – Hosts: dnl-us16.kaspersky-labs.com localhost
O1 – Hosts: dnl-us17.kaspersky-labs.com localhost
O1 – Hosts: dnl-us18.kaspersky-labs.com localhost
O1 – Hosts: dnl-us19.kaspersky-labs.com localhost
O1 – Hosts: dnl-us20.kaspersky-labs.com localhost
O1 – Hosts: update.jiangmin.info localhost
O1 – Hosts: update1.jiangmin.info localhost
O1 – Hosts: update2.jiangmin.info localhost
O1 – Hosts: update3.jiangmin.info localhost
O1 – Hosts: update4.jiangmin.info localhost
O1 – Hosts: update5.jiangmin.info localhost
O1 – Hosts: update6.jiangmin.info localhost
O1 – Hosts: update7.jiangmin.info localhost
O1 – Hosts: update8.jiangmin.info localhost
O1 – Hosts: update9.jiangmin.info localhost
O1 – Hosts: update10.jiangmin.info localhost
O1 – Hosts: update.jiangmin.com localhost
O1 – Hosts: update1.jiangmin.com localhost
O1 – Hosts: update2.jiangmin.com localhost
O1 – Hosts: update3.jiangmin.com localhost
O1 – Hosts: update4.jiangmin.com localhost
O1 – Hosts: update5.jiangmin.com localhost
O1 – Hosts: update6.jiangmin.com localhost
O1 – Hosts: update7.jiangmin.com localhost
O1 – Hosts: update8.jiangmin.com localhost
O1 – Hosts: update9.jiangmin.com localhost
O1 – Hosts: update10.jiangmin.com localhost
O1 – Hosts: edu.jiangmin.com localhost
O1 – Hosts: edu1.jiangmin.com localhost
O1 – Hosts: edu2.jiangmin.com localhost
O1 – Hosts: edu3.jiangmin.com localhost
O1 – Hosts: rsdownauto.rising.com.cn localhost
O2 – BHO: Adobe PDF Reader Link Helper – {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} – C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 – BHO: BitComet ClickCapture – {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} – C:\BitComet\tools\BitCometBHO_1.1.3.19.dll
O2 – BHO: (no name) – {53707962-6F74-2D53-2644-206D7942484F} – C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 – BHO: SSVHelper Class – {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} – C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O2 – BHO: (no name) – {7E853D72-626A-48EC-A868-BA8D5E23E045} – (no file)
O4 – HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 – HKLM\..\Run: [SoundMAX] “C:\Program Files\Analog Devices\SoundMAX\Smax4.exe” /tray
O4 – HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
O4 – HKLM\..\Run: [IntelZeroConfig] “C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe”
O4 – HKLM\..\Run: [IntelWireless] “C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe” /tf Intel PROSet/Wireless
O4 – HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 – HKLM\..\Run: [APVXDWIN] “C:\Program Files\Panda Software\Panda Antivirus 2007\APVXDWIN.EXE” /s
O4 – HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O8 – Extra context menu item: &D&ownload &with BitComet – res://C:\BitComet\BitComet.exe/AddLink.htm
O8 – Extra context menu item: &D&ownload all video with BitComet – res://C:\BitComet\BitComet.exe/AddVideo.htm
O8 – Extra context menu item: &D&ownload all with BitComet – res://C:\BitComet\BitComet.exe/AddAllLink.htm
O8 – Extra context menu item: E&xport to Microsoft Excel – res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
O9 – Extra button: (no name) – {08B0E5C0-4FCB-11CF-AAA5-00401C608501} – C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 – Extra ‘Tools’ menuitem: Sun Java Console – {08B0E5C0-4FCB-11CF-AAA5-00401C608501} – C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
O9 – Extra button: Research – {92780B25-18CC-41C8-B9BE-3C9C571A8263} – C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
O9 – Extra button: Messenger – {FB5F1910-F110-11d2-BB9E-00C04F795683} – C:\Program Files\Messenger\msmsgs.exe
O9 – Extra ‘Tools’ menuitem: Windows Messenger – {FB5F1910-F110-11d2-BB9E-00C04F795683} – C:\Program Files\Messenger\msmsgs.exe
O16 – DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) – http://go.microsoft.com/fwlink/?linkid=39204
O16 – DPF: {F5131C24-E56D-11CF-B78A-444553540000} (Ikonic Menu Control) – http://activex.microsoft.com/controls/iptdweb/ikcntrls.cab
O17 – HKLM\System\CCS\Services\Tcpip\..\{DCBAABC1-80AE-49B4-8709-A0F11B11348B}: NameServer = 202.188.0.133,202.188.1.5
O18 – Protocol: livecall – {828030A1-22C1-4009-854F-8E305202313F} – C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 – Protocol: ms-help – {314111C7-A502-11D2-BBCA-00C04F8EC294} – C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
O18 – Protocol: msnim – {828030A1-22C1-4009-854F-8E305202313F} – C:\PROGRA~1\MSNMES~1\MSGRAP~1.DLL
O18 – Filter hijack: text/xml – {807563E5-5146-11D5-A672-00B0D022E945} – C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
O20 – Winlogon Notify: avldr – C:\WINDOWS\SYSTEM32\avldr.dll
O23 – Service: Ati HotKey Poller – ATI Technologies Inc. – C:\WINDOWS\system32\Ati2evxx.exe
O23 – Service: Intel(R) PROSet/Wireless Event Log (EvtEng) – Intel Corporation – C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 – Service: Intel(R) Matrix Storage Event Monitor (IAANTMon) – Intel Corporation – C:\Program Files\Intel\Intel Matrix Storage Manager\iaantmon.exe
O23 – Service: Panda anti-virus service (PAVSRV) – Panda Software International – C:\Program Files\Panda Software\Panda Antivirus 2007\pavsrv51.exe
O23 – Service: Panda IManager Service (PSIMSVC) – Panda Software – C:\Program Files\Panda Software\Panda Antivirus 2007\PsImSvc.exe
O23 – Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) – Intel Corporation – C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 – Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) – Intel Corporation – C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 – Service: SWIHPWMI – Sierra Wireless Inc. – c:\Program Files\HPQ\Shared\Sierra Wireless\Win32\Unicode\SWIHPWMI.exe
Any feedback/help is truly appreciated. Worse cast scenario would have to be to format the whole hard drive 🙁
Thanks.
Regards,
Jason