| katysmith |
| (regular) |
| Fri Feb 15 2008 05:37 PM |
ns###.tmp files
|
Hallo there,
Bunches of ns###.tmp files are cluttering up my puter - apparently, the reason for it is in the text below:
Is there a kind expert out there who will take a look and tell me how I can rid myself of the bug? I would be truly grateful.
Thank you and regards
PS: I am a lay person and don't understand much about the workings of my puter, so please keep the explanation as simple as possible.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:35:06, on 15.02.2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
D:\PROGRAMME\WindowBlinds\wbload.exe
C:\WINDOWS\system32\spoolsv.exe
E:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
E:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
E:\PROGRA~1\Grisoft\AVG7\avgemc.exe
C:\WINDOWS\system32\cisvc.exe
C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\snmp.exe
C:\Programme\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
E:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\System32\svchost.exe
D:\PROGRAMME\Firefox\firefox.exe
C:\Programme\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/ig?hl=de
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
R3 - URLSearchHook: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: (no name) - -{00000000-6CB0-410C-8C3D-8FA8D2011D0A} - (no file)
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - (no file)
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)
O2 - BHO: (no name) - {206E52E0-D52E-11D4-AD54-0000E86C26F6} - E:\PROGRAMME\FreshDevices\FreshDownload\FDCatch.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
O3 - Toolbar: Easy-WebPrint - {327C2873-E90D-4c37-AA9D-10AC9BABA46C} - (no file)
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar4.dll
O3 - Toolbar: FreshDownload Bar - {ED0E8CA5-42FB-4B18-997B-769E0408E79D} - E:\PROGRAMME\FreshDevices\FreshDownload\fdiebar.dll
O3 - Toolbar: Yahoo! Toolbar mit Pop-Up-Blocker - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC] E:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
O4 - HKCU\..\Run: [Red Swoosh] C:\Programme\RSSoft\RedSwoosh.exe /S
O4 - HKCU\..\Run: [swg] C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] E:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe (User 'Default user')
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: FreshDownload - {9D3A3F1A-732A-42F9-B8E0-6D9EC67CF8F2} - E:\PROGRAMME\FreshDevices\FreshDownload\fd.exe
O16 - DPF: {238F6F83-B8B4-11CF-8771-00A024541EE3} (Citrix ICA Client) - http://a516.g.akamai.net/f/516/25175/7d/runaware.download.akamai.com/25175/citrix/wficat-no-eula.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) -
O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF: {74DBCB52-F298-4110-951D-AD2FF67BC8AB} (NVIDIA Smart Scan) - http://www.nvidia.com/content/DriverDownload/nforce/NvidiaSmartScan.cab
O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - E:\PROGRA~1\Grisoft\AVG7\avgemc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Programme\WinPcap\rpcapd.exe
O24 - Desktop Component 0: (no name) - file:///C:/DOKUME~1/LOKALE~1/Temp/msohtml1/01/clip_image002.jpg
--
End of file - 5966 bytes
| bricat |
| (HijackThis Helper) |
| Fri Feb 15 2008 06:49 PM |
|
Re: ns###.tmp files
|
Please download the trial version of AVG Anti-Spyware. from
here.
Install it and
update the program with the latest definitions.
Reboot your computer in "SAFE MODE" using the F8 method.
To do this, restart your computer and after hearing your computer beep once during startup (but before the Windows icon appears) press the F8 key repeatedly.
A menu will appear with several options. Use the arrow keys to navigate and select the option to run Windows in "Safe Mode".
Scan with AVG Anti-Spyware as follows:
- Click on the "Scanner" button and choose the "Settings" tab.
- Under "How to act?", click on "Recommended actions" and choose "Quarantine" to set default action for detected malware.
- Under "How to Scan?", "Possibly unwanted software", and What to Scan?" leave all the default settings.
- Under "Reports" select "Do not automatically generate reports".
- Click the "Scan" tab to return to scanning options.
- Click "Complete System Scan" to start.
- When the scan has finished, it should automatically be set to Quarantine--if not click on Recommended Action and set it there.
- You will also be presented with a list of infected objects found. Click "Apply all actions" to place the files in Quarantine.
IMPORTANT! Do not save the report before you have clicked the :Apply all actions button.
If you do, the log that is created will indicate "No action taken", making it more difficult to interpret the report.
So be sure you save it only AFTER clicking the "Apply all actions" button.
- Click on "Save Report" to view all completed scans. Click on the most recent scan you performed, select "Save report as" and save to your desktop.
The default file name will be in date/time format: Report-Scan-200706-1606.
A copy of each report will be saved in C:\Documents and Settings\<user profile>\Application Data\Grisoft\AVG Antispyware 7.5\Reports. - If you installed AVG AS over a previous version, reports are saved in C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\Reports\
- If you are a Vista user, reports are saved in C:\Users\<username>\AppData\Roaming\Grisoft\AVG Antispyware 7.5\Reports\
Exit AVG Anti-Spyware when done, reboot normally and post the AVg log report and a new HijackThis log.
| katysmith |
| (regular) |
| Sat Feb 16 2008 12:51 PM |
|
Re: ns###.tmp files
|
Hallo Bricat,
Thank you for your reply. However, I don't understand your asking me to download AVG Spyware because I already have it, as you can see in the Hijack file, and it is up to date. Or is this a different programme? I ran the AVG rootkit a couple of days ago but it didn't find anything.
What is actually happening on the puter, is that the scroller suddenly starts to scroll down to the bottom of the page and nothing I do can make it scroll to the top - and stay there. Very mysterious. I have my AV, ran the rootkit which found nothing, spybot found nothing. Is the problem an aging mouse? Right now everything is working - but quite suddenly the programm will start scrolling to the bottom of the page and stay there. I can pull the display up to the top of the screen but it will immediately jump to the bottom when "let go". It is very frustrating.
Can you deduce anything from all this?
Thanks and regards
| bricat |
| (HijackThis Helper) |
| Sat Feb 16 2008 01:28 PM |
|
|
|
Re: ns###.tmp files
|
there is no sign of AVG ANTISPYWARE in your HJT log.
you have AVG ANTI VIRUS installed.
can you please follow my last instructions and post the ANTI SPYWARE log back here.
| katysmith |
| (regular) |
| Sat Feb 16 2008 02:18 PM |
|
Re: ns###.tmp files
|
will do
| katysmith |
| (regular) |
| Sat Feb 16 2008 04:38 PM |
|
Re: ns###.tmp files
|
Here it is. Not a thing about ns .tmp files as far as I can see. However, you are a better judge.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 17:29:16, on 16.02.2008
Platform: Windows XP SP2 (WinNT
5.01.2600)
MSIE: Internet Explorer v6.00 SP2
(6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
D:\PROGRAMME\WindowBlinds\wbload
.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Grisoft\AVG Anti-Spyware
7.5\guard.exe
C:\Programme\Java\jre1.6.0_03\bin\jusche
d.exe
E:\PROGRA~1\Grisoft\AVG7\avgamsvr.e
xe
C:\WINDOWS\SOUNDMAN.EXE
C:\WINDOWS\system32\RUNDLL32.EX
E
E:\PROGRA~1\Grisoft\AVG7\avgupsvc.e
xe
E:\PROGRA~1\Grisoft\AVG7\avgemc.ex
e
E:\PROGRA~1\Grisoft\AVG7\avgcc.exe
C:\Programme\Grisoft\AVG Anti-Spyware
7.5\avgas.exe
C:\WINDOWS\system32\cisvc.exe
C:\Programme\Gemeinsame
Dateien\Microsoft
Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\msiexec.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\tcpsvcs.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\cidaemon.exe
C:\WINDOWS\System32\svchost.exe
D:\PROGRAMME\Firefox\firefox.exe
C:\Programme\Outlook
Express\msimn.exe
E:\Program Files\Trend
Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet
Explorer\Main,Start Page =
http://www.google.de/ig?hl=de
R0 - HKCU\Software\Microsoft\Internet
Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet
Explorer\Main,Local Page =
R3 - URLSearchHook: Yahoo! Toolbar
mit Pop-Up-Blocker -
{EF99BD32-C1FB-11D2-892F-0090271D
4F88} - (no file)
O2 - BHO: (no name) -
-{00000000-6CB0-410C-8C3D-8FA8D20
11D0A} - (no file)
O2 - BHO: Yahoo! Toolbar Helper -
{02478D38-C3F9-4EFB-9B51-7695ECA
05670} - (no file)
O2 - BHO: AcroIEHlprObj Class -
{06849E9F-C8D7-4D59-B87D-784B7D6
BE0B3} - (no file)
O2 - BHO: (no name) -
{206E52E0-D52E-11D4-AD54-0000E86
C26F6} -
E:\PROGRAMME\FreshDevices\FreshDo
wnload\FDCatch.dll
O2 - BHO: (no name) -
{53707962-6F74-2D53-2644-206D79424
84F} -
D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class -
{761497BB-D6F0-462C-B6EB-D4DAF1
D92D43} -
C:\Programme\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Helper -
{AA58ED58-01DD-4d91-8333-CF105774
73F7} -
c:\programme\google\googletoolbar4.dll
O2 - BHO: Google Toolbar Notifier BHO -
{AF69DE43-7D58-4638-B6FA-CE66B5A
D205D} -
C:\Programme\Google\GoogleToolbarNoti
fier\2.0.301.7164\swg.dll
O3 - Toolbar: Easy-WebPrint -
{327C2873-E90D-4c37-AA9D-10AC9BA
BA46C} - (no file)
O3 - Toolbar: &Google -
{2318C2B1-4965-11d4-9B18-009027A5C
D4F} -
c:\programme\google\googletoolbar4.dll
O3 - Toolbar: FreshDownload Bar -
{ED0E8CA5-42FB-4B18-997B-769E040
8E79D} -
E:\PROGRAMME\FreshDevices\FreshDo
wnload\fdiebar.dll
O3 - Toolbar: Yahoo! Toolbar mit
Pop-Up-Blocker -
{EF99BD32-C1FB-11D2-892F-0090271D
4F88} - (no file)
O4 - HKLM\..\Run: [NvCplDaemon]
RUNDLL32.EXE
C:\WINDOWS\system32\NvCpl.dll,NvSta
rtup
O4 - HKLM\..\Run:
[SunJavaUpdateSched]
"C:\Programme\Java\jre1.6.0_03\bin\jusch
ed.exe"
O4 - HKLM\..\Run: [SoundMan]
SOUNDMAN.EXE
O4 - HKLM\..\Run: [NvMediaCenter]
RUNDLL32.EXE
C:\WINDOWS\system32\NvMcTray.dll,N
vTaskbarInit
O4 - HKLM\..\Run: [AVG7_CC]
E:\PROGRA~1\Grisoft\AVG7\avgcc.exe
/STARTUP
O4 - HKLM\..\Run: [!AVG Anti-Spyware]
"C:\Programme\Grisoft\AVG
Anti-Spyware 7.5\avgas.exe" /minimized
O4 - HKCU\..\Run: [Red Swoosh]
C:\Programme\RSSoft\RedSwoosh.exe /S
O4 - HKUS\S-1-5-19\..\Run:
[CTFMON.EXE]
C:\WINDOWS\System32\CTFMON.EXE
(User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run]
E:\PROGRA~1\Grisoft\AVG7\avgw.exe
/RUNONCE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run:
[CTFMON.EXE]
C:\WINDOWS\System32\CTFMON.EXE
(User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run:
[CTFMON.EXE]
C:\WINDOWS\system32\ctfmon.exe
(User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run:
[CTFMON.EXE]
C:\WINDOWS\system32\ctfmon.exe
(User 'Default user')
O6 -
HKCU\Software\Policies\Microsoft\Intern
et Explorer\Restrictions present
O6 -
HKCU\Software\Policies\Microsoft\Intern
et Explorer\Control Panel present
O8 - Extra context menu item: Nach
Microsoft &Excel exportieren -
res://C:\PROGRA~1\MICROS~2\OFFICE
11\EXCEL.EXE/3000
O9 - Extra button: (no name) -
{08B0E5C0-4FCB-11CF-AAA5-00401C6
08501} -
C:\Programme\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java
Konsole -
{08B0E5C0-4FCB-11CF-AAA5-00401C6
08501} -
C:\Programme\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Recherchieren -
{92780B25-18CC-41C8-B9BE-3C9C571
A8263} -
C:\PROGRA~1\MICROS~2\OFFICE11\R
EFIEBAR.DLL
O9 - Extra button: FreshDownload -
{9D3A3F1A-732A-42F9-B8E0-6D9EC67
CF8F2} -
E:\PROGRAMME\FreshDevices\FreshDo
wnload\fd.exe
O16 - DPF:
{238F6F83-B8B4-11CF-8771-00A024541
EE3} (Citrix ICA Client) -
http://a516.g.akamai.net/f/516/25175/7d/r
unaware.download.akamai.com/25175/citr
ix/wficat-no-eula.cab
O16 - DPF:
{30528230-99f7-4bb4-88d8-fa1d4f56a2ab
} (YInstStarter Class) -
O16 - DPF:
{67A5F8DC-1A4B-4D66-9F24-A704AD9
29EEE} (System Requirements Lab) -
http://www.nvidia.com/content/DriverDo
wnload/srl/2.0.0.1/sysreqlab2.cab
O16 - DPF:
{74DBCB52-F298-4110-951D-AD2FF67
BC8AB} (NVIDIA Smart Scan) -
http://www.nvidia.com/content/DriverDo
wnload/nforce/NvidiaSmartScan.cab
O23 - Service: AVG Anti-Spyware Guard -
GRISOFT s.r.o. -
C:\Programme\Grisoft\AVG Anti-Spyware
7.5\guard.exe
O23 - Service: AVG7 Alert Manager
Server (Avg7Alrt) - GRISOFT, s.r.o. -
E:\PROGRA~1\Grisoft\AVG7\avgamsvr.e
xe
O23 - Service: AVG7 Update Service
(Avg7UpdSvc) - GRISOFT, s.r.o. -
E:\PROGRA~1\Grisoft\AVG7\avgupsvc.e
xe
O23 - Service: AVG E-mail Scanner
(AVGEMS) - GRISOFT, s.r.o. -
E:\PROGRA~1\Grisoft\AVG7\avgemc.ex
e
O23 - Service: Google Updater Service
(gusvc) - Google -
C:\Programme\Google\Common\Google
Updater\GoogleUpdaterService.exe
O23 - Service: NVIDIA Display Driver
Service (NVSvc) - NVIDIA Corporation -
C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Remote Packet Capture
Protocol v.0 (experimental) (rpcapd) -
CACE Technologies -
C:\Programme\WinPcap\rpcapd.exe
O24 - Desktop Component 0: (no name) -
file:///C:/DOKUME~1/LOKALE~1/Temp/
msohtml1/01/clip_image002.jpg
--
End of file - 6201 bytes
+ Created at: 17:17:25 16.02.2008
+ Scan result:
C:\WINDOWS\system32\b4fm.dll ->
Adware.BurnFree : Cleaned.
:mozilla.65:C:\Dokumente und
Einstellungen\Anwendungsdaten\Mozilla\
Firefox\Profiles\7330air8.default\cookies.t
xt -> TrackingCookie.Safer-networking :
Cleaned.
C:\Dokumente und
Einstellungen\Cookies\riebach@m.webtr
ends[2].txt -> TrackingCookie.Webtrends
: Cleaned.
::Report end
| bricat |
| (HijackThis Helper) |
| Sat Feb 16 2008 04:55 PM |
|
|
|
Re: ns###.tmp files
|
Click Start->Run...-> type Notepad.exe and press Enter
Click "Format", then make sure "WordWrap" is unchecked.
Now close Notepad.
wordwrap makes logs extermely hard to decipher,
then post the avg antispyware log again.
| katysmith |
| (regular) |
| Sun Feb 17 2008 09:36 AM |
|
Re: ns###.tmp files
|
Good morning, Here's the report in the required format, I hope. Thanks for your time, I really appreciate it. Regards
---------------------------------------------------------
AVG Anti-Spyware - Scan Report
---------------------------------------------------------
+ Created at: 17:17:25 16.02.2008
+ Scan result:
C:\WINDOWS\system32\b4fm.dll -> Adware.BurnFree : Cleaned.
:mozilla.65:C:\Dokumente und Einstellungen\Griesbach\Anwendungsdaten\Mozilla\Firefox\Profiles\7330air8.default\cookies.txt -> TrackingCookie.Safer-networking : Cleaned.
C:\Dokumente und Einstellungen\Griesbach\Cookies\griesbach@m.webtrends[2].txt -> TrackingCookie.Webtrends : Cleaned.
::Report end
| bricat |
| (HijackThis Helper) |
| Sun Feb 17 2008 09:50 AM |
|
|
|
Re: ns###.tmp files
|
not much to worry about there.
Please download ComboFix from either of these two locations
BleepingComputerComboFix
geeks to go combofix
* Double click combofix.exe & follow the prompts.
* When finished, it shall produce a log for you. Post that log in your next reply
Do not mouseclick combofix's window whilst it's running. That may cause it to stall.
Post back with the log from ComboFix and a new HJT log please.
| katysmith |
| (regular) |
| Sun Feb 17 2008 03:31 PM |
|
Re: ns###.tmp files
|
Hi there,
Combofix registered nothing out of the way - except that I don't have a recovery console - however, the result disappeared into a void so I can't reproduce it here. The above files still appear each time I use the internet and each has a system.dll which seems to be protected as long as I am online but I can delete before or after. As Alice said, curiouser and curiouser.
However, the mouse syndrome seems to have disappeared and I can write normally. So I suppose I shall just have to wait until something serious happens and check if anyone else is experiencing similar problems.
A thousand thanks for your help.
Regards
| bricat |
| (HijackThis Helper) |
| Sun Feb 17 2008 03:33 PM |
|
|
|
Re: ns###.tmp files
|
the combofix log should be at C:\COMBOFIX.TXT
i need to have a look at it to see if there is anything lurking on your comp.
| katysmith |
| (regular) |
| Sun Feb 17 2008 05:28 PM |
|
Re: ns###.tmp files
|
Hallo, I've just run Combofix again - the result follows:
ComboFix 08-02-17.2 - Griesbach 2008-02-17 18:15:47.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1031.18.192 [GMT 1:00]
ausgeführt von:: E:\PROGRAMME\FreshDevices\FreshDownload\Fresh Downloads\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
---- Previous Run -------
.
C:\WINDOWS\system32\winsys.exe
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\LEGACY_IPRIP
-------\LEGACY_NPF
-------\Iprip
-------\NPF
((((((((((((((((((((((( Dateien erstellt von 2008-01-17 bis 2008-02-17 ))))))))))))))))))))))))))))))
.
2008-02-17 15:47 . 2008-02-17 15:47 <DIR> d-------- C:\ComboFix1
2008-02-16 20:21 . 2008-02-16 20:21 1,374 --a--c--- C:\WINDOWS\imsins.BAK
2008-02-16 15:09 . 2008-02-16 15:09 <DIR> d-------- C:\Dokumente und Einstellungen\Griesbach\Anwendungsdaten\Grisoft
2008-02-16 15:08 . 2007-05-30 13:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
2008-02-15 18:21 . 2008-02-15 18:21 <DIR> d-------- C:\Programme\Trend Micro
2008-02-03 14:46 . 2008-02-03 14:46 <DIR> d----c--- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Office Genuine Advantage
2008-01-27 19:50 . 2008-02-17 18:13 <DIR> d-------- C:\Programme\RSSoft
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-17 14:06 --------- dc----w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2008-02-16 19:18 --------- d-----w C:\Dokumente und Einstellungen\Griesbach\Anwendungsdaten\AVG7
2008-02-16 14:08 --------- dc----w C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Grisoft
2008-01-03 08:59 --------- d-----w C:\Dokumente und Einstellungen\Griesbach\Anwendungsdaten\Auslogics
2007-12-18 09:51 179,584 ----a-w C:\WINDOWS\system32\drivers\mrxdav.sys
2007-12-07 00:46 671,744 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 18:40 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2005-09-05 07:17 56 -csh--r C:\WINDOWS\system32\C983C3E6CF.sys
.
(((((((((((((((((((((((((((( Autostart Punkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
REGEDIT4
*Hinweis* leere Eintrage & legitime Standardeintrage werden nicht angezeigt.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Red Swoosh"="C:\Programme\RSSoft\RedSwoosh.exe" [2007-07-19 03:17 62436]
"swg"="C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-14 14:46 68856]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-06-01 16:22 7618560]
"SunJavaUpdateSched"="C:\Programme\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11 132496]
"SoundMan"="SOUNDMAN.EXE" [2006-03-01 15:22 577536 C:\WINDOWS\soundman.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-06-01 16:22 86016]
"AVG7_CC"="E:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-08 13:37 579072]
"!AVG Anti-Spyware"="C:\Programme\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 10:25 6731312]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 23:57 15360]
"AVG7_Run"="E:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2007-11-26 08:25 219136]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoWelcomeScreen"= 1 (0x1)
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"MaxRecentDocs"= 8 (0x8)
"NoStartMenuMorePrograms"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)
"GreyMSIAds"= 1 (0x1)
"NoRecentDocsNetHood"= 1 (0x1)
"NoUserNameInStartMenu"= 1 (0x1)
"NoSMMyPictures"= 1 (0x1)
"NoStartMenuMFUProgramsList"= 1 (0x1)
"NoSMConfigurePrograms"= 1 (0x1)
"NoNetworkConnections"= 1000000 (0xf4240)
"NoEntireNetwork"= 1 (0x1)
"NoFavoritesMenu"= 1 (0x1)
"NoSimpleStartMenu"= 1 (0x1)
"NoStartMenuMyMusic"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WB]
D:\PROGRA~1\WINDOW~1\fastload.dll 2001-12-20 21:34 24576 D:\PROGRA~1\WINDOW~1\fastload.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wbsys.dll
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"swg"=C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2007-07-05 05:33]
R3 RMSPPPOE;WAN Miniport (PPP over Ethernet Protocol);C:\WINDOWS\system32\DRIVERS\RMSPPPOE.SYS [2002-10-25 15:47]
S3 AdslUsbLdr;MicroLink ADSL Fun USB Loader Driver;C:\WINDOWS\system32\drivers\mldsluld.sys [2002-11-07 10:29]
S3 drhard;DRHARD;C:\WINDOWS\system32\DRIVERS\DRHARD.SYS [2005-12-01 10:49]
S3 mladslusb;MicroLink ADSL Fun USB Driver;C:\WINDOWS\system32\DRIVERS\mldslusb.sys [2002-11-07 10:29]
S3 p2pgasvc;Peernetzwerk-Gruppenauthentifizierung;C:\WINDOWS\System32\svchost.exe [2004-08-03 23:58]
S3 p2pimsvc;Peernetzwerkidentitäts-Manager;C:\WINDOWS\System32\svchost.exe [2004-08-03 23:58]
S3 p2psvc;Peernetzwerk;C:\WINDOWS\System32\svchost.exe [2004-08-03 23:58]
S3 PNRPSvc;Peer Name Resolution-Protokoll;C:\WINDOWS\System32\svchost.exe [2004-08-03 23:58]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
p2psvc REG_MULTI_SZ p2psvc p2pimsvc p2pgasvc PNRPSvc
.
**************************************************************************
catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-17 18:19:06
Windows 5.1.2600 Service Pack 2 NTFS
Scanne versteckte Prozesse...
Scanne versteckte Autostart Einträge...
Scanne versteckte Dateien...
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
**************************************************************************
.
Zeit der Fertigstellung: 2008-02-17 18:20:05
ComboFix-quarantined-files.txt 2008-02-17 17:19:47
.
2008-02-16 19:21:40 --- E O F ---
| bricat |
| (HijackThis Helper) |
| Sun Feb 17 2008 07:10 PM |
|
|
|
Re: ns###.tmp files
|
Please copy this page to *Notepad* and save to your desktop for reference as you will not have any browsers open while you are carrying out portions of these instructions.
It's IMPORTANT to carry out the instructions in the sequence listed below.
1. Close any open browsers.
2. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
Open *notepad* and copy/paste the text in the quotebox below into it:
Quote:
Killall::
File::
C:\WINDOWS\system32\C983C3E6CF.sys
Save this as CFScript.txt, in the same location as ComboFix.exe which is on the Desktop.
Refering to the picture above, drag CFScript.txt into ComboFix.exe
Restart your computer.
When finished, it shall produce a log for you at C:\ComboFix.txt
Please copy and paste the ComboFix.txt along with a fresh HijackThis log in your next reply please and
let me know how it is running.
*Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall*