1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Trojan:win32/virtumonde.O

Discussion in 'Malware and Virus Removal Archive' started by goldfish, 2007/08/07.

  1. 2007/08/07
    goldfish

    goldfish Well-Known Member Thread Starter

    Joined:
    2007/03/27
    Messages:
    32
    Likes Received:
    0
    I cannot get rid of it. Have run Windows defender, AVG Anti and it still comes back. I also get pop ups citing "xmdubuxh.exe" Please help. Thanks
     
    goldfish,
    #1
  2. 2007/08/07
    goldfish

    goldfish Well-Known Member Thread Starter

    Joined:
    2007/03/27
    Messages:
    32
    Likes Received:
    0
    Hjt

    Sorry, I meant to include this in the first post. Thanks in advance.


    Logfile of HijackThis v1.99.1
    Scan saved at 10:14:40 PM, on 8/7/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16473)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Dell\Media Experience\PCMService.exe
    C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
    C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    C:\Program Files\Microsoft IntelliPoint\point32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Kaseya\Agent\KaUsrTsk.exe
    C:\WINDOWS\ycxtrogA.exe
    C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
    c:\program files\common files\installshield\updateservice\isuspm.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\agent.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Outlook Express\msimn.exe
    C:\Program Files\Hijackthis\destroy.exe

    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: (no name) - {0455F40E-92FB-4C47-8F30-0817F65F6B4C} - C:\Program Files\MSN Gaming Zone\hoke83122.dll (file missing)
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {145CAFC2-AAB2-46F6-8F5B-4FB88C531723} - C:\Program Files\MSN Gaming Zone\hoke4444.dll
    O2 - BHO: (no name) - {3964D8D6-86D0-493A-B460-A805B5401114} - C:\WINDOWS\system32\iifeeec.dll
    O2 - BHO: (no name) - {4E89F8B5-3B01-6AF9-2177-49B60B49F3BF} - (no file)
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
    O2 - BHO: 0 - {8088385A-8EBF-44CB-F0BF-6B604E096530} - C:\Program Files\MSN\lavupa.dll (file missing)
    O2 - BHO: (no name) - {C6039E6C-BDE9-4de5-BB40-768CAA584FDC} - C:\WINDOWS\system32\gdqnprgf.dll
    O2 - BHO: IE Redirector - {C68AE9C0-0909-4DDC-B661-C1AFB9F5AE53} - C:\WINDOWS\system32\dnsersnd.dll (file missing)
    O2 - BHO: (no name) - {E5BA3AD0-CF6E-4531-A860-C28F95A5E8AF} - C:\WINDOWS\system32\jkklk.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
    O4 - HKLM\..\Run: [ShowLOMControl] 
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe "
    O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
    O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [VoiceCenter] "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray
    O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe "
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [ISUSPM Startup] "c:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe "
    O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe "
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [Kaseya Agent Service Helper] C:\Program Files\Kaseya\Agent\KaUsrTsk.exe
    O4 - HKLM\..\Run: [EPSON Stylus CX6000 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBIA.EXE /FU "C:\WINDOWS\TEMP\E_S120.tmp" /EF "HKLM "
    O4 - HKLM\..\Run: [ycxtrogA] C:\WINDOWS\ycxtrogA.exe
    O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
    O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
    O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
    O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
    O4 - Startup: TA_Start.lnk = C:\WINDOWS\TISKY009.exe
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Bluetooth Manager.lnk = ?
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Broken Internet access because of LSP provider 'kaseyasp.dll' missing
    O11 - Options group: [INTERNATIONAL] International*
    O15 - Trusted Zone: *.amaena.com
    O15 - Trusted Zone: *.errorsafe.com
    O15 - Trusted Zone: *.systemdoctor.com
    O15 - Trusted Zone: *.winantispyware.com
    O15 - Trusted Zone: *.winantivirus.com
    O15 - Trusted Zone: *.winfixer.com
    O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1148335419176
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1148487711562
    O16 - DPF: {8EC18CE2-D7B4-11D2-88C8-006008A717FD} (NCSView Class) - http://aerial.leepa.org/ecwplugins/ncs.cab
    O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15023/CTPID.cab
    O20 - AppInit_DLLs: c:\windows\system32\ldcore.dll
    O20 - Winlogon Notify: iifeeec - C:\WINDOWS\SYSTEM32\iifeeec.dll
    O20 - Winlogon Notify: jkklk - C:\WINDOWS\system32\jkklk.dll
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O20 - Winlogon Notify: winbue32 - winbue32.dll (file missing)
    O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: Kaseya Agent (KaseyaAgent) - Kaseya - C:\Program Files\Kaseya\Agent\AgentMon.exe
    O23 - Service: Net Agent - Unknown owner - C:\WINDOWS\dls0523pmw.exe (file missing)
    O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: Windows Overlay Components - Unknown owner - C:\WINDOWS\ycxtrog.exe (file missing)
    O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
     
    goldfish,
    #2


  3. to hide this advert.

  4. 2007/08/07
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    I'll be back ;)
     
    noahdfear,
    #3
  5. 2007/08/07
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Download VundoFix by Atribune, saving it to your desktop.
    • Double-click VundoFix.exe to run it.
    • Click the Scan for Vundo button.
    • Once it's done scanning, click the Remove Vundo button.
    • You will receive a prompt asking if you want to remove the files, click YES
    • Once you click yes, your desktop will go blank as it starts removing Vundo.
    • When completed, it will prompt that it will reboot your computer, click OK.
    Note: It is possible that VundoFix encounters a file it could not remove. In this case, VundoFix will run on reboot. If that happens, follow the above instructions starting from "Click the Scan for Vundo button" when VundoFix appears upon rebooting.

    Then;

    Download ComboFix by sUBs from Here or Here, saving the file to your Desktop.
    • Close all open programs and windows
    • Double click combofix.exe and follow the prompts.
    • When finished, it will open a log for you. Post that log and a new HijackThis log in your next reply.
    Note: Do not mouseclick combofix's window while its running. That may cause it to stall

    Please post the contents of C:\vundofix.txt too.
     
    noahdfear,
    #4
  6. 2007/08/07
    goldfish

    goldfish Well-Known Member Thread Starter

    Joined:
    2007/03/27
    Messages:
    32
    Likes Received:
    0
    Here are all of the logfiles, Thanks again for your help

    Logfile of HijackThis v1.99.1
    Scan saved at 11:12:19 PM, on 8/7/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16473)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Kaseya\Agent\AgentMon.exe
    C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\stsystra.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Dell\Media Experience\PCMService.exe
    C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
    C:\WINDOWS\system32\Rundll32.exe
    C:\DOCUME~1\Stephen\LOCALS~1\Temp\clclean.0001
    C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    C:\Program Files\Microsoft IntelliPoint\point32.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Kaseya\Agent\KaUsrTsk.exe
    C:\WINDOWS\ycxtrogA.exe
    C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
    C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
    C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe
    C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Adobe\Acrobat 7.0\Reader\AcroRd32Info.exe
    C:\Program Files\Hijackthis\destroy.exe

    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: (no name) - {0455F40E-92FB-4C47-8F30-0817F65F6B4C} - C:\Program Files\MSN Gaming Zone\hoke83122.dll (file missing)
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {145CAFC2-AAB2-46F6-8F5B-4FB88C531723} - C:\Program Files\MSN Gaming Zone\hoke4444.dll
    O2 - BHO: (no name) - {4E89F8B5-3B01-6AF9-2177-49B60B49F3BF} - (no file)
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
    O2 - BHO: (no name) - {66556411-8839-4EAA-9C9B-4A36F5827375} - C:\WINDOWS\system32\jkklk.dll (file missing)
    O2 - BHO: 0 - {8088385A-8EBF-44CB-F0BF-6B604E096530} - C:\Program Files\MSN\lavupa.dll (file missing)
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
    O4 - HKLM\..\Run: [ShowLOMControl] 
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe "
    O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
    O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [VoiceCenter] "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray
    O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe "
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe "
    O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe "
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [Kaseya Agent Service Helper] C:\Program Files\Kaseya\Agent\KaUsrTsk.exe
    O4 - HKLM\..\Run: [ycxtrogA] C:\WINDOWS\ycxtrogA.exe
    O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
    O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
    O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
    O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Bluetooth Manager.lnk = ?
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Broken Internet access because of LSP provider 'kaseyasp.dll' missing
    O11 - Options group: [INTERNATIONAL] International*
    O15 - Trusted Zone: *.amaena.com
    O15 - Trusted Zone: *.errorsafe.com
    O15 - Trusted Zone: *.systemdoctor.com
    O15 - Trusted Zone: *.winantispyware.com
    O15 - Trusted Zone: *.winantivirus.com
    O15 - Trusted Zone: *.winfixer.com
    O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1148335419176
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1148487711562
    O16 - DPF: {8EC18CE2-D7B4-11D2-88C8-006008A717FD} (NCSView Class) - http://aerial.leepa.org/ecwplugins/ncs.cab
    O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15023/CTPID.cab
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O20 - Winlogon Notify: winbue32 - winbue32.dll (file missing)
    O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: Kaseya Agent (KaseyaAgent) - Kaseya - C:\Program Files\Kaseya\Agent\AgentMon.exe
    O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe

    undoFix V6.5.7

    Checking Java version...

    Java version is 1.4.2.3
    Old versions of java are exploitable and should be removed.

    Scan started at 10:29:56 PM 8/7/2007

    Listing files found while scanning....

    C:\windows\system32\cbxvvvs.dll
    C:\WINDOWS\system32\gdqnprgf.dll
    C:\WINDOWS\system32\iifeeec.dll
    C:\WINDOWS\system32\jkklk.dll
    C:\WINDOWS\system32\klkkj.bak1
    C:\WINDOWS\system32\klkkj.bak2
    C:\WINDOWS\system32\klkkj.ini
    C:\windows\system32\xmdubuxh.exe
    C:\windows\system32\yaywwuv.dll

    Beginning removal...

    Attempting to delete C:\windows\system32\cbxvvvs.dll
    C:\windows\system32\cbxvvvs.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\gdqnprgf.dll
    C:\WINDOWS\system32\gdqnprgf.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\iifeeec.dll
    C:\WINDOWS\system32\iifeeec.dll Could not be deleted.

    Attempting to delete C:\WINDOWS\system32\jkklk.dll
    C:\WINDOWS\system32\jkklk.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\klkkj.bak1
    C:\WINDOWS\system32\klkkj.bak1 Has been deleted!

    Attempting to delete C:\WINDOWS\system32\klkkj.bak2
    C:\WINDOWS\system32\klkkj.bak2 Has been deleted!

    Attempting to delete C:\WINDOWS\system32\klkkj.ini
    C:\WINDOWS\system32\klkkj.ini Has been deleted!

    Attempting to delete C:\windows\system32\xmdubuxh.exe
    C:\windows\system32\xmdubuxh.exe Has been deleted!

    Attempting to delete C:\windows\system32\yaywwuv.dll
    C:\windows\system32\yaywwuv.dll Has been deleted!

    Performing Repairs to the registry.
    Done!

    VundoFix V6.3.18

    Checking Java version...

    Java version is 1.4.2.3
    Old versions of java are exploitable and should be removed.

    Scan started at 10:35:39 PM 8/7/2007

    Listing files found while scanning....

    No infected files were found.

    ComboFix 07-08-04.3 - "Stephen" 2007-08-07 22:42:12.1 [GMT -4:00] - NTFS
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.True
    * Created a new restore point


    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


    C:\DOCUME~1\NETWOR~1\APPLIC~1\.rdr.ini
    C:\DOCUME~1\Stephen\APPLIC~1\.rdr.ini
    C:\Program Files\Common Files\Yazzle1281OinUninstaller.exe
    C:\Program Files\inetget2
    C:\Program Files\inetget2\popinstall.exe
    C:\Program Files\MSN\profsydy.html
    C:\Program Files\outerinfo
    C:\Program Files\outerinfo\Terms.rtf
    C:\Program Files\vsadd-in
    C:\Program Files\winpop
    C:\Program Files\winpop\UnInstall.exe
    C:\temp\0c2
    C:\temp\0c2\tmpFF.log
    C:\temp\brr
    C:\temp\brr\tmpZTF.log
    C:\WINDOWS\b122.exe
    C:\WINDOWS\smbols~1
    C:\WINDOWS\system32\A1
    C:\WINDOWS\system32\ajpdrwoh.exe
    C:\WINDOWS\system32\b02FdUe
    C:\WINDOWS\system32\b06FdUe
    C:\WINDOWS\system32\iifeeec.dll
    C:\WINDOWS\system32\ldinfo.ldr
    C:\WINDOWS\system32\win
    C:\WINDOWS\system32\X1
    C:\WINDOWS\system32\X11
    C:\WINDOWS\system32\X3
    C:\WINDOWS\system32\X3\wr731.exe
    C:\WINDOWS\system32\X7
    C:\WINDOWS\wnsxs~1
    C:\WINDOWS\wr.txt


    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


    -------\LEGACY_NET_AGENT
    -------\LEGACY_WINDOWS_OVERLAY_COMPONENTS
    -------\Net Agent
    -------\Windows Overlay Components


    ((((((((((((((((((((((((( Files Created from 2007-07-08 to 2007-08-08 )))))))))))))))))))))))))))))))


    2007-08-07 22:41 51,200 --a------ C:\WINDOWS\nircmd.exe
    2007-08-02 22:21 436,352 -r-hs---- C:\WINDOWS\ycxtrogA.exe
    2007-08-02 22:21 169,147 --a------ C:\WINDOWS\TTC-4444.exe


    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    2007-08-02 22:21 --------- d-------- C:\Program Files\MSN Gaming Zone
    2007-05-24 21:36 88 -r-hs---- C:\WINDOWS\system32\0E7B04EAC5.sys
    2007-05-24 21:36 6944 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
    2007-05-18 19:23 122880 --a------ C:\WINDOWS\system32\kaseyasp.dll
    2007-05-16 11:12 86528 --------- C:\WINDOWS\system32\dllcache\directdb.dll
    2007-05-16 11:12 85504 --a------ C:\WINDOWS\system32\dllcache\wabimp.dll
    2007-05-16 11:12 683520 --a------ C:\WINDOWS\system32\inetcomm.dll
    2007-05-16 11:12 683520 --------- C:\WINDOWS\system32\dllcache\inetcomm.dll
    2007-05-16 11:12 510976 --------- C:\WINDOWS\system32\dllcache\wab32.dll
    2007-05-16 11:12 1314816 --------- C:\WINDOWS\system32\dllcache\msoe.dll
    2007-05-08 05:24 3583488 --a------ C:\WINDOWS\system32\dllcache\mshtml.dll
    2007-03-07 02:07:22 56 --sh--r C:\WINDOWS\system32\C5EA047B0E.sys


    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


    *Note* empty entries & legit default entries are not shown

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0455F40E-92FB-4C47-8F30-0817F65F6B4C}]
    C:\Program Files\MSN Gaming Zone\hoke83122.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{145CAFC2-AAB2-46F6-8F5B-4FB88C531723}]
    2007-08-02 09:43 282624 --a------ C:\Program Files\MSN Gaming Zone\hoke4444.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{4E89F8B5-3B01-6AF9-2177-49B60B49F3BF}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{66556411-8839-4EAA-9C9B-4A36F5827375}]
    C:\WINDOWS\system32\jkklk.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{8088385A-8EBF-44CB-F0BF-6B604E096530}]
    C:\Program Files\MSN\lavupa.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SigmatelSysTrayApp "= "stsystra.exe" [2005-11-16 15:35 C:\WINDOWS\stsystra.exe]
    "ShowLOMControl "= "1 (0x1)" []
    "SynTPEnh "= "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-11-29 12:56]
    "ATICCC "= "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 15:43]
    "PCMService "= "C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 21:15]
    "CTSysVol "= "C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-10-31 11:51]
    "MBMon "= "CTMBHA.DLL" [2006-03-03 04:18 C:\WINDOWS\system32\CTMBHA.DLL]
    "UpdReg "= "C:\WINDOWS\UpdReg.EXE" [2000-05-11 02:00]
    "VoiceCenter "= "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" [2006-01-02 10:13]
    "DVDLauncher "= "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-09 21:29]
    "dla "= "C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-12-06 02:05]
    "ISUSPM Startup "= "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 11:44]
    "ISUSScheduler "= "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 11:44]
    "QuickTime Task "= "C:\Program Files\QuickTime\qttask.exe" [2006-05-16 02:42]
    "IntelliPoint "= "C:\Program Files\Microsoft IntelliPoint\point32.exe" [2005-03-23 19:26]
    "MSKDetectorExe "= "C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" [2005-07-12 20:05]
    "IntelZeroConfig "= "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-05-01 09:28]
    "IntelWireless "= "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-05-01 09:28]
    "Windows Defender "= "C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20]
    "Kaseya Agent Service Helper "= "C:\Program Files\Kaseya\Agent\KaUsrTsk.exe" [2007-06-04 20:04]
    "ycxtrogA "= "C:\WINDOWS\ycxtrogA.exe" [1989-12-12 10:10]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SetDefaultMIDI "= "MIDIDef.exe" [2004-12-22 05:40 C:\WINDOWS\MIDIDEF.EXE]
    "Creative Detector "= "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 19:23]
    "FreeRAM XP "= "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" [2006-03-23 00:13]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00]
    "updateMgr "= "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45]
    "DellSupport "= "C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09]

    [HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
    "DWQueuedReporting "= "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
    Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe [2005-06-16 12:11:42]
    Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-05-16 02:34:14]
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]

    [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
    Source= C:\Program Files\MSN\profsydy.html
    FriendlyName=

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\winbue32]
    winbue32.dll

    R1 sscdbhk5;sscdbhk5;C:\WINDOWS\system32\drivers\sscdbhk5.sys
    R1 ssrtln;ssrtln;C:\WINDOWS\system32\drivers\ssrtln.sys
    R1 WmiAcpi;Microsoft Windows Management Interface for ACPI;C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
    R2 ASCTRM;ASCTRM;C:\WINDOWS\system32\drivers\ASCTRM.sys
    R2 KaseyaAgent;Kaseya Agent;C:\Program Files\Kaseya\Agent\AgentMon.exe
    R2 s24trans;WLAN Transport;C:\WINDOWS\system32\DRIVERS\s24trans.sys
    R2 tfsnpool;tfsnpool;C:\WINDOWS\system32\dla\tfsnpool.sys
    R3 Afc;PPdus ASPI Shell;C:\WINDOWS\system32\drivers\Afc.sys
    R3 KAPFA;KAPFA;\??\C:\WINDOWS\system32\drivers\KAPFA.SYS
    R3 monfilt;monfilt;C:\WINDOWS\system32\drivers\monfilt.sys
    R3 rimmptsk;rimmptsk;C:\WINDOWS\system32\DRIVERS\rimmptsk.sys
    R3 rimsptsk;rimsptsk;C:\WINDOWS\system32\DRIVERS\rimsptsk.sys
    R3 rismxdp;Ricoh xD-Picture Card Driver;C:\WINDOWS\system32\DRIVERS\rixdptsk.sys
    R3 sdbus;sdbus;C:\WINDOWS\system32\DRIVERS\sdbus.sys
    R3 STHDA;SigmaTel High Definition Audio CODEC;C:\WINDOWS\system32\drivers\sthda.sys
    R3 SynTP;Synaptics TouchPad Driver;C:\WINDOWS\system32\DRIVERS\SynTP.sys
    R3 Tosrfbd;Bluetooth RFBUS from TOSHIBA;C:\WINDOWS\system32\Drivers\tosrfbd.sys
    R3 Tosrfhid;Bluetooth RFHID from TOSHIBA;C:\WINDOWS\system32\DRIVERS\Tosrfhid.sys
    R3 Tosrfusb;Bluetooth USB Controller;C:\WINDOWS\system32\Drivers\tosrfusb.sys
    R3 w39n51;Intel(R) PRO/Wireless 3945ABG Adapter Driver;C:\WINDOWS\system32\DRIVERS\w39n51.sys
    S1 Tosrfcom;Tosrfcom;C:\WINDOWS\system32\drivers\Tosrfcom.sys
    S3 AX88772;ASIX AX88772 USB2.0 to Fast Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\ax88772.sys
    S3 E100B;Intel(R) PRO Adapter Driver;C:\WINDOWS\system32\DRIVERS\e100b325.sys
    S3 Point32;Microsoft IntelliPoint Filter Driver;C:\WINDOWS\system32\DRIVERS\point32.sys
    S3 sffdisk;SFF Storage Class Driver;C:\WINDOWS\system32\DRIVERS\sffdisk.sys
    S3 sffp_sd;SFF Storage Protocol Driver for SDBus;C:\WINDOWS\system32\DRIVERS\sffp_sd.sys
    S3 wanatw;WAN Miniport (ATW);C:\WINDOWS\system32\DRIVERS\wanatw4.sys


    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
    AutoRun\command- F:\LaunchU3.exe

    *Newly Created Service* - KAPFA

    Contents of the 'Scheduled Tasks' folder
    2007-08-08 02:36:20 C:\WINDOWS\Tasks\MP Scheduled Scan.job - C:\Program Files\Windows Defender\MpCmdRun.exe

    **************************************************************************

    catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-08-07 22:45:01
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden registry entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    Completion time: 2007-08-07 22:46:43 - machine was rebooted
    C:\ComboFix-quarantined-files.txt ... 2007-08-07 22:46

    --- E O F ---
     
    goldfish,
    #5
  7. 2007/08/07
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Did you install Kaseya?

    Scan again with HijackThis, place a check next to the following entries, close all other windows and click Fix Checked.

    O2 - BHO: (no name) - {0455F40E-92FB-4C47-8F30-0817F65F6B4C} - C:\Program Files\MSN Gaming Zone\hoke83122.dll (file missing)
    O2 - BHO: (no name) - {145CAFC2-AAB2-46F6-8F5B-4FB88C531723} - C:\Program Files\MSN Gaming Zone\hoke4444.dll
    O2 - BHO: (no name) - {4E89F8B5-3B01-6AF9-2177-49B60B49F3BF} - (no file)
    O2 - BHO: (no name) - {66556411-8839-4EAA-9C9B-4A36F5827375} - C:\WINDOWS\system32\jkklk.dll (file missing)
    O2 - BHO: 0 - {8088385A-8EBF-44CB-F0BF-6B604E096530} - C:\Program Files\MSN\lavupa.dll (file missing)
    O4 - HKLM\..\Run: [ShowLOMControl] 
    O4 - HKLM\..\Run: [ycxtrogA] C:\WINDOWS\ycxtrogA.exe
    O15 - Trusted Zone: *.amaena.com
    O15 - Trusted Zone: *.errorsafe.com
    O15 - Trusted Zone: *.systemdoctor.com
    O15 - Trusted Zone: *.winantispyware.com
    O15 - Trusted Zone: *.winantivirus.com
    O15 - Trusted Zone: *.winfixer.com
    O20 - Winlogon Notify: winbue32 - winbue32.dll (file missing)

    Close hijackThis.

    Open your desktop properties, Desktop tab>Customize Desktop>Web tab and delete the entry for C:\Program Files\MSN\profsydy.html

    Copy the contents of the code box below and paste it into a blank notepad, then save it to your desktop as;

    Filename: CFScript.txt
    Save As Type: All Files (*.*)

    Code:
    File::
C:\WINDOWS\ycxtrogA.exe
C:\WINDOWS\TTC-4444.exe
C:\Program Files\MSN\profsydy.html

Look::
C:\WINDOWS\system32\0E7B04EAC5.sys
C:\WINDOWS\system32\C5EA047B0E.sys

Registry::
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]

    Close all other windows and programs. Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log, the C:\ComboFix-quarantined-files.txt and a new HijackThis log.
     
    noahdfear,
    #6
  8. 2007/08/08
    goldfish

    goldfish Well-Known Member Thread Starter

    Joined:
    2007/03/27
    Messages:
    32
    Likes Received:
    0
    I do have Kaseya agent for work. The office IT put it on my computer.

    Here are the logs, I do not have anything in C:\ComboFix folder for quarantined files or anything else. Thanks again.

    ComboFix 07-08-04.3 - "Stephen" 2007-08-08 16:58:17.2 [GMT -4:00] - NTFS
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.True
    Command switches used :: C:\Documents and Settings\Stephen\Desktop\CFScript.txt
    * Created a new restore point


    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


    C:\WINDOWS\TTC-4444.exe
    C:\WINDOWS\ycxtrogA.exe


    ((((((((((((((((((((((((( Files Created from 2007-07-08 to 2007-08-08 )))))))))))))))))))))))))))))))


    2007-08-07 22:41 51,200 --a------ C:\WINDOWS\nircmd.exe


    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    2007-08-08 16:53 --------- d-------- C:\Program Files\MSN Gaming Zone
    2007-05-24 21:36 88 -r-hs---- C:\WINDOWS\system32\0E7B04EAC5.sys
    2007-05-24 21:36 6944 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
    2007-05-18 19:23 122880 --a------ C:\WINDOWS\system32\kaseyasp.dll
    2007-05-16 11:12 86528 --------- C:\WINDOWS\system32\dllcache\directdb.dll
    2007-05-16 11:12 85504 --a------ C:\WINDOWS\system32\dllcache\wabimp.dll
    2007-05-16 11:12 683520 --a------ C:\WINDOWS\system32\inetcomm.dll
    2007-05-16 11:12 683520 --------- C:\WINDOWS\system32\dllcache\inetcomm.dll
    2007-05-16 11:12 510976 --------- C:\WINDOWS\system32\dllcache\wab32.dll
    2007-05-16 11:12 1314816 --------- C:\WINDOWS\system32\dllcache\msoe.dll
    2007-05-08 05:24 3583488 --a------ C:\WINDOWS\system32\dllcache\mshtml.dll
    2007-03-07 02:07:22 56 --sh--r C:\WINDOWS\system32\C5EA047B0E.sys


    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


    *Note* empty entries & legit default entries are not shown

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SigmatelSysTrayApp "= "stsystra.exe" [2005-11-16 15:35 C:\WINDOWS\stsystra.exe]
    "SynTPEnh "= "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-11-29 12:56]
    "ATICCC "= "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 15:43]
    "PCMService "= "C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 21:15]
    "CTSysVol "= "C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-10-31 11:51]
    "MBMon "= "CTMBHA.DLL" [2006-03-03 04:18 C:\WINDOWS\system32\CTMBHA.DLL]
    "UpdReg "= "C:\WINDOWS\UpdReg.EXE" [2000-05-11 02:00]
    "VoiceCenter "= "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" [2006-01-02 10:13]
    "DVDLauncher "= "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-09 21:29]
    "dla "= "C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-12-06 02:05]
    "ISUSPM Startup "= "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 11:44]
    "ISUSScheduler "= "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 11:44]
    "QuickTime Task "= "C:\Program Files\QuickTime\qttask.exe" [2006-05-16 02:42]
    "IntelliPoint "= "C:\Program Files\Microsoft IntelliPoint\point32.exe" [2005-03-23 19:26]
    "MSKDetectorExe "= "C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" [2005-07-12 20:05]
    "IntelZeroConfig "= "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-05-01 09:28]
    "IntelWireless "= "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-05-01 09:28]
    "Windows Defender "= "C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20]
    "Kaseya Agent Service Helper "= "C:\Program Files\Kaseya\Agent\KaUsrTsk.exe" [2007-06-04 20:04]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SetDefaultMIDI "= "MIDIDef.exe" [2004-12-22 05:40 C:\WINDOWS\MIDIDEF.EXE]
    "Creative Detector "= "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 19:23]
    "FreeRAM XP "= "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" [2006-03-23 00:13]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00]
    "updateMgr "= "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45]
    "DellSupport "= "C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09]

    [HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
    "DWQueuedReporting "= "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
    Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe [2005-06-16 12:11:42]
    Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-05-16 02:34:14]
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]

    R1 sscdbhk5;sscdbhk5;C:\WINDOWS\system32\drivers\sscdbhk5.sys
    R1 ssrtln;ssrtln;C:\WINDOWS\system32\drivers\ssrtln.sys
    R1 WmiAcpi;Microsoft Windows Management Interface for ACPI;C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
    R2 ASCTRM;ASCTRM;C:\WINDOWS\system32\drivers\ASCTRM.sys
    R2 KaseyaAgent;Kaseya Agent;C:\Program Files\Kaseya\Agent\AgentMon.exe
    R2 s24trans;WLAN Transport;C:\WINDOWS\system32\DRIVERS\s24trans.sys
    R2 tfsnpool;tfsnpool;C:\WINDOWS\system32\dla\tfsnpool.sys
    R3 Afc;PPdus ASPI Shell;C:\WINDOWS\system32\drivers\Afc.sys
    R3 KAPFA;KAPFA;\??\C:\WINDOWS\system32\drivers\KAPFA.SYS
    R3 monfilt;monfilt;C:\WINDOWS\system32\drivers\monfilt.sys
    R3 rimmptsk;rimmptsk;C:\WINDOWS\system32\DRIVERS\rimmptsk.sys
    R3 rimsptsk;rimsptsk;C:\WINDOWS\system32\DRIVERS\rimsptsk.sys
    R3 rismxdp;Ricoh xD-Picture Card Driver;C:\WINDOWS\system32\DRIVERS\rixdptsk.sys
    R3 sdbus;sdbus;C:\WINDOWS\system32\DRIVERS\sdbus.sys
    R3 STHDA;SigmaTel High Definition Audio CODEC;C:\WINDOWS\system32\drivers\sthda.sys
    R3 SynTP;Synaptics TouchPad Driver;C:\WINDOWS\system32\DRIVERS\SynTP.sys
    R3 Tosrfbd;Bluetooth RFBUS from TOSHIBA;C:\WINDOWS\system32\Drivers\tosrfbd.sys
    R3 Tosrfhid;Bluetooth RFHID from TOSHIBA;C:\WINDOWS\system32\DRIVERS\Tosrfhid.sys
    R3 Tosrfusb;Bluetooth USB Controller;C:\WINDOWS\system32\Drivers\tosrfusb.sys
    R3 w39n51;Intel(R) PRO/Wireless 3945ABG Adapter Driver;C:\WINDOWS\system32\DRIVERS\w39n51.sys
    S1 Tosrfcom;Tosrfcom;C:\WINDOWS\system32\drivers\Tosrfcom.sys
    S3 AX88772;ASIX AX88772 USB2.0 to Fast Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\ax88772.sys
    S3 E100B;Intel(R) PRO Adapter Driver;C:\WINDOWS\system32\DRIVERS\e100b325.sys
    S3 Point32;Microsoft IntelliPoint Filter Driver;C:\WINDOWS\system32\DRIVERS\point32.sys
    S3 sffdisk;SFF Storage Class Driver;C:\WINDOWS\system32\DRIVERS\sffdisk.sys
    S3 sffp_sd;SFF Storage Protocol Driver for SDBus;C:\WINDOWS\system32\DRIVERS\sffp_sd.sys
    S3 wanatw;WAN Miniport (ATW);C:\WINDOWS\system32\DRIVERS\wanatw4.sys


    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
    AutoRun\command- F:\LaunchU3.exe

    *Newly Created Service* - CATCHME
    *Newly Created Service* - KAPFA

    Contents of the 'Scheduled Tasks' folder
    2007-08-08 03:05:51 C:\WINDOWS\Tasks\MP Scheduled Scan.job

    **************************************************************************

    catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-08-08 16:59:14
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden registry entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    Completion time: 2007-08-08 16:59:44
    C:\ComboFix-quarantined-files.txt ... 2007-08-08 16:59
    C:\ComboFix2.txt ... 2007-08-07 22:46

    --- E O F ---

    Logfile of HijackThis v1.99.1
    Scan saved at 5:05:42 PM, on 8/8/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16473)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\Program Files\Kaseya\Agent\AgentMon.exe
    C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\stsystra.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Dell\Media Experience\PCMService.exe
    C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
    C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    C:\Program Files\Microsoft IntelliPoint\point32.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Kaseya\Agent\KaUsrTsk.exe
    C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
    C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
    C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe
    C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Hijackthis\destroy.exe

    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe "
    O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
    O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [VoiceCenter] "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray
    O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe "
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe "
    O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe "
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [Kaseya Agent Service Helper] C:\Program Files\Kaseya\Agent\KaUsrTsk.exe
    O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
    O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
    O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
    O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Bluetooth Manager.lnk = ?
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Broken Internet access because of LSP provider 'kaseyasp.dll' missing
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1148335419176
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1148487711562
    O16 - DPF: {8EC18CE2-D7B4-11D2-88C8-006008A717FD} (NCSView Class) - http://aerial.leepa.org/ecwplugins/ncs.cab
    O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15023/CTPID.cab
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: Kaseya Agent (KaseyaAgent) - Kaseya - C:\Program Files\Kaseya\Agent\AgentMon.exe
    O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
     
    goldfish,
    #7
  9. 2007/08/08
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    The ComboFix-quarantined-files.txt is a text file located in C:
    Please post it's contents.

    Click Start>Run, type cmd and hit enter to open a command window. Copy the following command and paste it into the window, then hit enter.

    attrib -r -h -s C:\WINDOWS\system32\0E7B04EAC5.sys

    Then do this one

    attrib -r -h -s C:\WINDOWS\system32\C5EA047B0E.sys

    Now open the CFScript on your desktop and remove everything in it. Copy the contents of the following quote box and paste it into CFScript.txt, then close it and save the changes.

    Close all open programs and windows. Drag CFScript.txt onto ComboFix.exe and drop it. Wait for ComboFix to complete and post the log that opens.
     
    noahdfear,
    #8
  10. 2007/08/08
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Please upload the following files to my submission channel. Leave a link back to this topic.

    C:\WINDOWS\system32\0E7B04EAC5.sys
    C:\WINDOWS\system32\C5EA047B0E.sys

    Thanks!
     
    noahdfear,
    #9
  11. 2007/08/08
    goldfish

    goldfish Well-Known Member Thread Starter

    Joined:
    2007/03/27
    Messages:
    32
    Likes Received:
    0
    Ok, I found the file you were looking for, sorry for the confusion before. Here they are. Thanks, I will post to your other message now.

    Code:
    1989-12-12 10:10      436352    --a------    C:\Qoobox\Quarantine\C\WINDOWS\ycxtrogA.exe.vir
2007-04-24 12:21      9248    --a------    C:\Qoobox\Quarantine\C\Temp\0c2\tmpFF.log.vir
2007-07-17 08:27      56320    --a------    C:\Qoobox\Quarantine\C\WINDOWS\b122.exe.vir
2007-07-19 13:46      18031    --a------    C:\Qoobox\Quarantine\C\Program Files\Outerinfo\Terms.rtf.vir
2007-07-28 05:06      135    --a------    C:\Qoobox\Quarantine\C\Program Files\MSN\profsydy.html.vir
2007-07-31 09:21      8790    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\X3\wr731.exe.vir
2007-08-02 22:21      16    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\NETWOR~1\APPLIC~1\.rdr.ini.vir
2007-08-02 22:21      16    --a------    C:\Qoobox\Quarantine\C\DOCUME~1\Stephen\APPLIC~1\.rdr.ini.vir
2007-08-02 22:21      169147    --a------    C:\Qoobox\Quarantine\C\WINDOWS\TTC-4444.exe.vir
2007-08-02 22:21      228    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\ldinfo.ldr.vir
2007-08-02 22:21      31254    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\iifeeec.dll.vir
2007-08-02 22:24      12800    --a------    C:\Qoobox\Quarantine\C\Program Files\WinPop\UnInstall.exe.vir
2007-08-02 22:24      40183    --a------    C:\Qoobox\Quarantine\C\Program Files\Common Files\Yazzle1281OinUninstaller.exe.vir
2007-08-02 22:24      49664    --a------    C:\Qoobox\Quarantine\C\Program Files\InetGet2\popinstall.exe.vir
2007-08-02 22:24      930    --a------    C:\Qoobox\Quarantine\C\Temp\brr\tmpZTF.log.vir
2007-08-02 22:30      233    --a------    C:\Qoobox\Quarantine\C\WINDOWS\wr.txt.vir
2007-08-07 21:21      66112    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\ajpdrwoh.exe.vir
2007-08-07 22:43      2526    --a------    C:\Qoobox\Quarantine\Registry_backups\services_Net Agent.reg.cf
2007-08-07 22:43      2564    --a------    C:\Qoobox\Quarantine\Registry_backups\services_Windows Overlay Components.reg.cf
2007-08-07 22:43      762    --a------    C:\Qoobox\Quarantine\Registry_backups\hklm_windowsNT_windows.reg.cf
2007-08-07 22:43      814    --a------    C:\Qoobox\Quarantine\Registry_backups\LEGACY_NET_AGENT.reg.cf
2007-08-07 22:43      950    --a------    C:\Qoobox\Quarantine\Registry_backups\LEGACY_WINDOWS_OVERLAY_COMPONENTS.reg.cf


Folder PATH listing
Volume serial number is 9073-58C1
C:\QOOBOX
\---Quarantine
    +---C
    |   +---DOCUME~1
    |   |   +---NETWOR~1
    |   |   |   \---APPLIC~1
    |   |   |           .rdr.ini.vir
    |   |   |           
    |   |   \---Stephen
    |   |       \---APPLIC~1
    |   |               .rdr.ini.vir
    |   |               
    |   +---Program Files
    |   |   +---Common Files
    |   |   |       Yazzle1281OinUninstaller.exe.vir
    |   |   |       
    |   |   +---InetGet2
    |   |   |       popinstall.exe.vir
    |   |   |       
    |   |   +---MSN
    |   |   |       profsydy.html.vir
    |   |   |       
    |   |   +---Outerinfo
    |   |   |       Terms.rtf.vir
    |   |   |       
    |   |   \---WinPop
    |   |           UnInstall.exe.vir
    |   |           
    |   +---Temp
    |   |   +---0c2
    |   |   |       tmpFF.log.vir
    |   |   |       
    |   |   \---brr
    |   |           tmpZTF.log.vir
    |   |           
    |   \---WINDOWS
    |       |   b122.exe.vir
    |       |   TTC-4444.exe.vir
    |       |   wr.txt.vir
    |       |   ycxtrogA.exe.vir
    |       |   
    |       \---system32
    |           |   ajpdrwoh.exe.vir
    |           |   iifeeec.dll.vir
    |           |   ldinfo.ldr.vir
    |           |   
    |           \---X3
    |                   wr731.exe.vir
    |                   
    \---Registry_backups
            hklm_windowsNT_windows.reg.cf
            LEGACY_NET_AGENT.reg.cf
            LEGACY_WINDOWS_OVERLAY_COMPONENTS.reg.cf
            services_Net Agent.reg.cf
            services_Windows Overlay Components.reg.cf

    ComboFix 07-08-04.3 - "Stephen" 2007-08-08 21:09:19.4 [GMT -4:00] - NTFS
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.True
    Command switches used :: C:\Documents and Settings\Stephen\Desktop\CFScript.txt
    * Created a new restore point


    ((((((((((((((((((((((((( Files Created from 2007-07-09 to 2007-08-09 )))))))))))))))))))))))))))))))


    2007-08-07 22:41 51,200 --a------ C:\WINDOWS\nircmd.exe


    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))

    2007-08-08 16:53 --------- d-------- C:\Program Files\MSN Gaming Zone
    2007-05-24 21:36 88 --------- C:\WINDOWS\system32\0E7B04EAC5.sys
    2007-05-24 21:36 6944 --ahs---- C:\WINDOWS\system32\KGyGaAvL.sys
    2007-05-18 19:23 122880 --a------ C:\WINDOWS\system32\kaseyasp.dll
    2007-05-16 11:12 86528 --------- C:\WINDOWS\system32\dllcache\directdb.dll
    2007-05-16 11:12 85504 --a------ C:\WINDOWS\system32\dllcache\wabimp.dll
    2007-05-16 11:12 683520 --a------ C:\WINDOWS\system32\inetcomm.dll
    2007-05-16 11:12 683520 --------- C:\WINDOWS\system32\dllcache\inetcomm.dll
    2007-05-16 11:12 510976 --------- C:\WINDOWS\system32\dllcache\wab32.dll
    2007-05-16 11:12 1314816 --------- C:\WINDOWS\system32\dllcache\msoe.dll


    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))


    *Note* empty entries & legit default entries are not shown

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SigmatelSysTrayApp "= "stsystra.exe" [2005-11-16 15:35 C:\WINDOWS\stsystra.exe]
    "SynTPEnh "= "C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-11-29 12:56]
    "ATICCC "= "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" [2005-08-12 15:43]
    "PCMService "= "C:\Program Files\Dell\Media Experience\PCMService.exe" [2004-04-11 21:15]
    "CTSysVol "= "C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe" [2005-10-31 11:51]
    "MBMon "= "CTMBHA.DLL" [2006-03-03 04:18 C:\WINDOWS\system32\CTMBHA.DLL]
    "UpdReg "= "C:\WINDOWS\UpdReg.EXE" [2000-05-11 02:00]
    "VoiceCenter "= "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" [2006-01-02 10:13]
    "DVDLauncher "= "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2005-12-09 21:29]
    "dla "= "C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-12-06 02:05]
    "ISUSPM Startup "= "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" [2005-06-10 11:44]
    "ISUSScheduler "= "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" [2005-06-10 11:44]
    "QuickTime Task "= "C:\Program Files\QuickTime\qttask.exe" [2006-05-16 02:42]
    "IntelliPoint "= "C:\Program Files\Microsoft IntelliPoint\point32.exe" [2005-03-23 19:26]
    "MSKDetectorExe "= "C:\Program Files\McAfee\SpamKiller\MSKDetct.exe" [2005-07-12 20:05]
    "IntelZeroConfig "= "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2006-05-01 09:28]
    "IntelWireless "= "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2006-05-01 09:28]
    "Windows Defender "= "C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20]
    "Kaseya Agent Service Helper "= "C:\Program Files\Kaseya\Agent\KaUsrTsk.exe" [2007-06-04 20:04]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SetDefaultMIDI "= "MIDIDef.exe" [2004-12-22 05:40 C:\WINDOWS\MIDIDEF.EXE]
    "Creative Detector "= "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" [2004-12-02 19:23]
    "FreeRAM XP "= "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" [2006-03-23 00:13]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 06:00]
    "updateMgr "= "C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45]
    "DellSupport "= "C:\Program Files\DellSupport\DSAgnt.exe" [2007-03-15 11:09]

    [HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
    "DWQueuedReporting "= "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26]
    Bluetooth Manager.lnk - C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe [2005-06-16 12:11:42]
    Digital Line Detect.lnk - C:\Program Files\Digital Line Detect\DLG.exe [2006-05-16 02:34:14]
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 01:01:04]

    R1 sscdbhk5;sscdbhk5;C:\WINDOWS\system32\drivers\sscdbhk5.sys
    R1 ssrtln;ssrtln;C:\WINDOWS\system32\drivers\ssrtln.sys
    R1 WmiAcpi;Microsoft Windows Management Interface for ACPI;C:\WINDOWS\system32\DRIVERS\wmiacpi.sys
    R2 ASCTRM;ASCTRM;C:\WINDOWS\system32\drivers\ASCTRM.sys
    R2 KaseyaAgent;Kaseya Agent;C:\Program Files\Kaseya\Agent\AgentMon.exe
    R2 s24trans;WLAN Transport;C:\WINDOWS\system32\DRIVERS\s24trans.sys
    R2 tfsnpool;tfsnpool;C:\WINDOWS\system32\dla\tfsnpool.sys
    R3 Afc;PPdus ASPI Shell;C:\WINDOWS\system32\drivers\Afc.sys
    R3 KAPFA;KAPFA;\??\C:\WINDOWS\system32\drivers\KAPFA.SYS
    R3 monfilt;monfilt;C:\WINDOWS\system32\drivers\monfilt.sys
    R3 rimmptsk;rimmptsk;C:\WINDOWS\system32\DRIVERS\rimmptsk.sys
    R3 rimsptsk;rimsptsk;C:\WINDOWS\system32\DRIVERS\rimsptsk.sys
    R3 rismxdp;Ricoh xD-Picture Card Driver;C:\WINDOWS\system32\DRIVERS\rixdptsk.sys
    R3 sdbus;sdbus;C:\WINDOWS\system32\DRIVERS\sdbus.sys
    R3 STHDA;SigmaTel High Definition Audio CODEC;C:\WINDOWS\system32\drivers\sthda.sys
    R3 SynTP;Synaptics TouchPad Driver;C:\WINDOWS\system32\DRIVERS\SynTP.sys
    R3 Tosrfbd;Bluetooth RFBUS from TOSHIBA;C:\WINDOWS\system32\Drivers\tosrfbd.sys
    R3 Tosrfhid;Bluetooth RFHID from TOSHIBA;C:\WINDOWS\system32\DRIVERS\Tosrfhid.sys
    R3 Tosrfusb;Bluetooth USB Controller;C:\WINDOWS\system32\Drivers\tosrfusb.sys
    R3 w39n51;Intel(R) PRO/Wireless 3945ABG Adapter Driver;C:\WINDOWS\system32\DRIVERS\w39n51.sys
    S1 Tosrfcom;Tosrfcom;C:\WINDOWS\system32\drivers\Tosrfcom.sys
    S3 AX88772;ASIX AX88772 USB2.0 to Fast Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\ax88772.sys
    S3 E100B;Intel(R) PRO Adapter Driver;C:\WINDOWS\system32\DRIVERS\e100b325.sys
    S3 Point32;Microsoft IntelliPoint Filter Driver;C:\WINDOWS\system32\DRIVERS\point32.sys
    S3 sffdisk;SFF Storage Class Driver;C:\WINDOWS\system32\DRIVERS\sffdisk.sys
    S3 sffp_sd;SFF Storage Protocol Driver for SDBus;C:\WINDOWS\system32\DRIVERS\sffp_sd.sys
    S3 wanatw;WAN Miniport (ATW);C:\WINDOWS\system32\DRIVERS\wanatw4.sys

    *Newly Created Service* - CATCHME
    *Newly Created Service* - KAPFA

    Contents of the 'Scheduled Tasks' folder
    2007-08-08 03:05:51 C:\WINDOWS\Tasks\MP Scheduled Scan.job

    **************************************************************************

    catchme 0.3.1061 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-08-08 21:10:09
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden registry entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    Completion time: 2007-08-08 21:10:39
    C:\ComboFix-quarantined-files.txt ... 2007-08-08 21:10
    C:\ComboFix2.txt ... 2007-08-08 17:11
    C:\ComboFix3.txt ... 2007-08-08 16:59

    --- E O F ---
     
    goldfish,
    #10
  12. 2007/08/08
    goldfish

    goldfish Well-Known Member Thread Starter

    Joined:
    2007/03/27
    Messages:
    32
    Likes Received:
    0
    Submitted Files

    I have submitted the files you requested. Thanks for the help.
     
    goldfish,
    #11
  13. 2007/08/08
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Thanks for the file upload. Were you not able to find C:\WINDOWS\system32\0E7B04EAC5.sys to upload? It appears from the ComboFix log that C:\WINDOWS\system32\C5EA047B0E.sys is gone. Did you delete it?

    Please post a fresh HijackThis log.

    How is your computer performing?
     
    noahdfear,
    #12
  14. 2007/08/08
    goldfish

    goldfish Well-Known Member Thread Starter

    Joined:
    2007/03/27
    Messages:
    32
    Likes Received:
    0
    I found both files you requested and uploaded them separately. I just did it again about a minute ago. Here is the new HJT log. The computer seems to be running fine. Thanks for all the help.

    Logfile of HijackThis v1.99.1
    Scan saved at 9:31:02 PM, on 8/8/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16473)

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
    C:\WINDOWS\system32\CTsvcCDA.exe
    C:\Program Files\Kaseya\Agent\AgentMon.exe
    C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\stsystra.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\Dell\Media Experience\PCMService.exe
    C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe
    C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
    C:\Program Files\Microsoft IntelliPoint\point32.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Kaseya\Agent\KaUsrTsk.exe
    C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe
    C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe
    C:\Program Files\Toshiba\Bluetooth Toshiba Stack\TosBtMng1.exe
    C:\PROGRA~1\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\Program Files\Digital Line Detect\DLG.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Hijackthis\destroy.exe

    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [SigmatelSysTrayApp] stsystra.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime -Delay
    O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe "
    O4 - HKLM\..\Run: [CTSysVol] C:\Program Files\Creative\SBAudigy\Surround Mixer\CTSysVol.exe /r
    O4 - HKLM\..\Run: [MBMon] Rundll32 CTMBHA.DLL,MBMon
    O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
    O4 - HKLM\..\Run: [VoiceCenter] "C:\Program Files\Creative\VoiceCenter\AndreaVC.exe" /tray
    O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe "
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [IntelliPoint] "C:\Program Files\Microsoft IntelliPoint\point32.exe "
    O4 - HKLM\..\Run: [MSKDetectorExe] C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe "
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [Kaseya Agent Service Helper] C:\Program Files\Kaseya\Agent\KaUsrTsk.exe
    O4 - HKCU\..\Run: [SetDefaultMIDI] MIDIDef.exe
    O4 - HKCU\..\Run: [Creative Detector] "C:\Program Files\Creative\MediaSource\Detector\CTDetect.exe" /R
    O4 - HKCU\..\Run: [FreeRAM XP] "C:\Program Files\YourWare Solutions\FreeRAM XP Pro\FreeRAM XP Pro.exe" -win
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
    O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
    O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
    O4 - Global Startup: Bluetooth Manager.lnk = ?
    O4 - Global Startup: Digital Line Detect.lnk = ?
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: MUSICMATCH MX Web Player - {d81ca86b-ef63-42af-bee3-4502d9a03c2d} - http://wwws.musicmatch.com/mmz/openWebRadio.html (file missing)
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - %windir%\Network Diagnostic\xpnetdiag.exe (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Broken Internet access because of LSP provider 'kaseyasp.dll' missing
    O11 - Options group: [INTERNATIONAL] International*
    O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15015/CTSUEng.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1148335419176
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1148487711562
    O16 - DPF: {8EC18CE2-D7B4-11D2-88C8-006008A717FD} (NCSView Class) - http://aerial.leepa.org/ecwplugins/ncs.cab
    O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15023/CTPID.cab
    O20 - Winlogon Notify: WgaLogon - C:\WINDOWS\SYSTEM32\WgaLogon.dll
    O20 - Winlogon Notify: WRNotifier - WRLogonNTF.dll (file missing)
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Creative Labs Licensing Service - Creative Labs - C:\Program Files\Common Files\Creative Labs Shared\Service\CreativeLicensing.exe
    O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.exe
    O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: Kaseya Agent (KaseyaAgent) - Kaseya - C:\Program Files\Kaseya\Agent\AgentMon.exe
    O23 - Service: NICCONFIGSVC - Dell Inc. - C:\Program Files\Dell\NICCONFIGSVC\NICCONFIGSVC.exe
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
     
    goldfish,
    #13
  15. 2007/08/08
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    I must have checked just before you uploaded the second one. I got them both, thanks. They appear to be void of any instructions or code. Please delete them.

    Download ATF Cleaner by Atribune and save it to your Desktop.
    Double click ATF-Cleaner.exe to run the program.
    Check the boxes to the left of:

    Windows Temp
    Current User Temp
    All Users Temp
    Temporary Internet Files
    Prefetch
    Java Cache
    Recycle bin


    The rest are optional - if you want it to remove everything check "Select All ".
    Finally, click Empty Selected. When you get the "Done Cleaning" message, click OK.

    Clear your past system restore points. Right click My Computer and select properties. On the System Restore tab, check the box to turn off System restore, then click Apply. Now uncheck the box and click Apply, then OK.


    Your logs appear to be clean, but I'd like for you to run an online virus scan to check for anything I may not be seeing.

    Panda ActiveScan
    or
    Kaspersky Online Scanner

    If anything is found infected, please save the report and post it back here.

    While I see an entry for McAfee Spam Killer, I don't see an active antivirus program on your computer. I highly recommend installing not only a reputable antivirus program, but a firewall application as well.

    Post back if you have any further problems or questions, and surf safe. :)
     
    noahdfear,
    #14
  16. 2007/08/09
    goldfish

    goldfish Well-Known Member Thread Starter

    Joined:
    2007/03/27
    Messages:
    32
    Likes Received:
    0
    Everything seems to be running fine. I did run Panda virus and it found nothing. I have Windows Defender which I was told was enough. Any other recommendations you have for antivirus or preventative maintenance would be greatly appreciated. Thanks for the help.
     
    goldfish,
    #15
  17. 2007/08/09
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    noahdfear,
    #16

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...