1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Help Downloader Virus in vturssp.dll

Discussion in 'Malware and Virus Removal Archive' started by GregoryC, 2007/10/12.

  1. 2007/10/12
    GregoryC

    GregoryC Inactive Thread Starter

    Joined:
    2007/10/12
    Messages:
    7
    Likes Received:
    0
    Symantec AntiVirus finds the virus "Downloader" during Realtime Protection Scan. Action taken: Clean failed : Quarantine failed : Access denied. The file is located at: C:\WINDOWS\system32\vturssp.dll.
    I have tried updating to windows SP2 and all other updates as well as Microsoft Windows Malicious Software Removal Tool, but it didn't help. I tried doing a Symantec scan and telling it to delete the file, but it won't let me. I have tried going into safe mode as the administrator and deleting the file, and it won't let me. I tried installing AVGs Antispyware 7.5 program, and it doesn't even detect it. Below is a Hijack this log. I would really appreciate any help.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:01:34 PM, on 10/12/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Ahead\InCD\InCDsrv.exe
    C:\WINDOWS\system32\spoolsv.exe
    D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\System32\cisvc.exe
    D:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    D:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\fxssvc.exe
    C:\WINDOWS\system32\VTTimer.exe
    C:\WINDOWS\system32\RunDll32.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9HA.EXE
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    D:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
    D:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
    D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\WINDOWS\system32\cidaemon.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {46be620a-67d5-4ef7-bb44-41d95c0192e3} - C:\WINDOWS\system32\mousons.dll
    O2 - BHO: Thunder Browser Helper - {63B2D652-EAD9-4D6E-93ED-2CC51D22CF02} - C:\WINDOWS\System32\XunLei.dll (file missing)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O2 - BHO: WebAssist - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\System32\BMLdf6JI.dll (file missing)
    O2 - BHO: (no name) - {89AD4D75-2429-462e-BD4E-443F233F6033} - C:\WINDOWS\System32\tmpB.tmp.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
    O4 - HKLM\..\Run: [EPSON Stylus Photo RX620 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9HA.EXE /P31 "EPSON Stylus Photo RX620 Series" /O6 "USB001" /M "Stylus Photo RX620 "
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [vptray] D:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe "
    O4 - HKLM\..\Run: [LGODDFU] "D:\Program Files\lg_fwupdate\fwupdate.exe "
    O4 - HKLM\..\Run: [RemoteControl] "D:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe "
    O4 - HKLM\..\Run: [] C:\WINDOWS\System32\scvhost.exe
    O4 - HKLM\..\Run: [mppds] C:\WINDOWS\mppds.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
    O4 - HKCU\..\Run: [BitComet] "D:\Program Files\BitLord\BitLord.exe "
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.apple.com.edgesuite.net/qtinstall.info.apple.com/lupin/us/win/QuickTimeInstaller.exe
    O20 - AppInit_DLLs: c:\windows\system32\vturssp.dll
    O20 - Winlogon Notify: inetut8 - inetut8.dll (file missing)
    O20 - Winlogon Notify: mousons - C:\WINDOWS\SYSTEM32\mousons.dll
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: DefWatch - Symantec Corporation - D:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
    O23 - Service: DomainService - Unknown owner - C:\Documents and Settings\Owner\Application Data\tmp5F.tmp.exe (file missing)
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - D:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
    O23 - Service: ÃŽ¢ÃˆÃ­ (ÃŽ¢ÃˆÃ­2007) - Unknown owner - C:\WINDOWS\inter.exe (file missing)

    --
    End of file - 7439 bytes
     
    GregoryC,
    #1
  2. 2007/10/12
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Welcome to WindowsBBS GregoryC :)

    Download VundoFix by Atribune, saving it to your desktop.
    • Double-click VundoFix.exe to run it.
    • Click the Scan for Vundo button.
    • Once it's done scanning, click the Remove Vundo button.
    • You will receive a prompt asking if you want to remove the files, click YES
    • Once you click yes, your desktop will go blank as it starts removing Vundo.
    • When completed, it will prompt that it will reboot your computer, click OK.
    Note: It is possible that VundoFix encounters a file it could not remove. In this case, VundoFix will run on reboot. If that happens, follow the above instructions starting from "Click the Scan for Vundo button" when VundoFix appears upon rebooting.


    Then, download Deckard's System Scanner (dss.exe) to your desktop.

    Note: You must be logged onto an account with administrator privileges to complete the following.​

    • Close all applications and windows.
    • Double click on dss.exe to run it and follow the prompts.
    • When the scan is complete, two text files will open; main.txt, which will be maximized and extra.txt, which will be minimized.
    Post the contents of main.txt and the C:\vundofix.txt logs only.
     
    noahdfear,
    #2


  3. to hide this advert.

  4. 2007/10/13
    GregoryC

    GregoryC Inactive Thread Starter

    Joined:
    2007/10/12
    Messages:
    7
    Likes Received:
    0
    Thanks or your warm welcome and help

    I ran vundofix like you said, it found 2 files, which probably needed to be deleted, but were not the one that I knew about (vturssp.dll).
    I only have one user account called "Owner computer administrator ", so I hope that's the one you wanted me to use. The only way I know that I can actually select an administrator account is in safe mode. So I used "Owner computer administrator ", if this is not what you want, please tell me if you meant to go into safe mode as an administator, or how to do it in normal mode. The two logs are listed below.

    VundoFix V6.5.9

    Checking Java version...

    Java version is 1.5.0.9
    Old versions of java are exploitable and should be removed.

    Java version is 1.5.0.10

    Scan started at 10:47:29 AM 10/13/2007

    Listing files found while scanning....

    C:\WINDOWS\System32\tmp4.tmp.dll
    C:\WINDOWS\System32\tmpB.tmp.dll

    Beginning removal...

    Attempting to delete C:\WINDOWS\System32\tmp4.tmp.dll
    C:\WINDOWS\System32\tmp4.tmp.dll Has been deleted!

    Attempting to delete C:\WINDOWS\System32\tmpB.tmp.dll
    C:\WINDOWS\System32\tmpB.tmp.dll Could not be deleted.

    Performing Repairs to the registry.
    Done!

    Beginning removal...

    Attempting to delete C:\WINDOWS\System32\tmpB.tmp.dll
    C:\WINDOWS\System32\tmpB.tmp.dll Has been deleted!

    Performing Repairs to the registry.
    Done!

    Deckard's System Scanner v20070905.67
    Run by Owner on 2007-10-13 11:10:13
    Computer is in Normal Mode.
    --------------------------------------------------------------------------------

    -- System Restore --------------------------------------------------------------

    Successfully created a Deckard's System Scanner Restore Point.


    -- Last 5 Restore Point(s) --
    26: 2007-10-13 09:10:19 UTC - RP455 - Deckard's System Scanner Restore Point
    25: 2007-10-12 16:41:31 UTC - RP454 - Installed Symantec Technical Support Web Controls
    24: 2007-10-12 15:47:19 UTC - RP453 - Software Distribution Service 3.0
    23: 2007-10-12 15:23:27 UTC - RP452 - Software Distribution Service 3.0
    22: 2007-10-12 14:55:37 UTC - RP451 - Software Distribution Service 3.0


    -- First Restore Point --
    1: 2007-09-08 19:55:26 UTC - RP430 - System Checkpoint


    Backed up registry hives.
    Performed disk cleanup.

    Total Physical Memory: 448 MiB (512 MiB recommended).


    -- HijackThis (run as Owner.exe) -----------------------------------------------

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:22:22 AM, on 10/13/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Ahead\InCD\InCDsrv.exe
    C:\WINDOWS\system32\spoolsv.exe
    D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\System32\cisvc.exe
    D:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    D:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\fxssvc.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\VTTimer.exe
    C:\WINDOWS\system32\RunDll32.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9HA.EXE
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    D:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
    D:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\cidaemon.exe
    C:\Documents and Settings\Owner\Desktop\dss.exe
    C:\PROGRA~1\TRENDM~1\HIJACK~1\Owner.exe

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: (no name) - {46be620a-67d5-4ef7-bb44-41d95c0192e3} - C:\WINDOWS\system32\mousons.dll
    O2 - BHO: Thunder Browser Helper - {63B2D652-EAD9-4D6E-93ED-2CC51D22CF02} - C:\WINDOWS\System32\XunLei.dll (file missing)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O2 - BHO: WebAssist - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\System32\BMLdf6JI.dll (file missing)
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
    O4 - HKLM\..\Run: [EPSON Stylus Photo RX620 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9HA.EXE /P31 "EPSON Stylus Photo RX620 Series" /O6 "USB001" /M "Stylus Photo RX620 "
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [vptray] D:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe "
    O4 - HKLM\..\Run: [LGODDFU] "D:\Program Files\lg_fwupdate\fwupdate.exe "
    O4 - HKLM\..\Run: [RemoteControl] "D:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe "
    O4 - HKLM\..\Run: [] C:\WINDOWS\System32\scvhost.exe
    O4 - HKLM\..\Run: [mppds] C:\WINDOWS\mppds.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
    O4 - HKCU\..\Run: [BitComet] "D:\Program Files\BitLord\BitLord.exe "
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.apple.com.edgesuite.net/qtinstall.info.apple.com/lupin/us/win/QuickTimeInstaller.exe
    O20 - AppInit_DLLs: c:\windows\system32\vturssp.dll
    O20 - Winlogon Notify: inetut8 - inetut8.dll (file missing)
    O20 - Winlogon Notify: mousons - C:\WINDOWS\SYSTEM32\mousons.dll
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: DefWatch - Symantec Corporation - D:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
    O23 - Service: DomainService - Unknown owner - C:\Documents and Settings\Owner\Application Data\tmp5F.tmp.exe (file missing)
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - D:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
    O23 - Service: ÃŽ¢ÃˆÃ­ (ÃŽ¢ÃˆÃ­2007) - Unknown owner - C:\WINDOWS\inter.exe (file missing)

    --
    End of file - 7151 bytes

    -- HijackThis Fixed Entries (C:\PROGRA~1\TRENDM~1\HIJACK~1\backups\) -----------

    backup-20071012-213244-854 O20 - AppInit_DLLs: c:\windows\system32\vturssp.dll

    -- File Associations -----------------------------------------------------------

    All associations okay.


    -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

    R3 pfc (Padus ASPI Shell) - c:\windows\system32\drivers\pfc.sys <Not Verified; Padus, Inc.; Padus(R) ASPI Shell>

    S3 Ptserial (W2K Conexant Serial Device Driver) - c:\windows\system32\drivers\ptserial.sys <Not Verified; PCTEL, INC.; HSP Modem Serial Device>
    S3 Vmodem (W2K Vmodem) - c:\windows\system32\drivers\vmodem.sys <Not Verified; Conexant Systems, Inc.; HSP Modem Modem Device>
    S3 Vpctcom (W2K Vpctcom) - c:\windows\system32\drivers\vpctcom.sys <Not Verified; Conexant Systems, Inc.; HSP Modem Virtual Control Device>
    S3 Vvoice (W2K Vvoice) - c:\windows\system32\drivers\vvoice.sys <Not Verified; Conexant Systems, Inc.; Conexant HSP Modem Voice Device>


    -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

    S2 DomainService - c:\documents and settings\owner\application data\tmp5f.tmp.exe /service (file missing)
    S2 ÃŽ¢ÃˆÃ­2007 (ÃŽ¢ÃˆÃ­) - c:\windows\inter.exe (file missing)


    -- Device Manager: Disabled ----------------------------------------------------

    No disabled devices found.


    -- Scheduled Tasks -------------------------------------------------------------

    2007-10-13 11:00:02 350 --a------ C:\WINDOWS\Tasks\At12.job
    2007-10-13 10:00:00 350 --a------ C:\WINDOWS\Tasks\At11.job
    2007-10-13 09:00:00 350 --a------ C:\WINDOWS\Tasks\At10.job
    2007-10-13 08:00:00 350 --a------ C:\WINDOWS\Tasks\At9.job
    2007-10-13 07:00:00 350 --a------ C:\WINDOWS\Tasks\At8.job
    2007-10-13 06:00:00 350 --a------ C:\WINDOWS\Tasks\At7.job
    2007-10-13 05:00:00 350 --a------ C:\WINDOWS\Tasks\At6.job
    2007-10-13 04:00:00 350 --a------ C:\WINDOWS\Tasks\At5.job
    2007-10-13 03:00:00 350 --a------ C:\WINDOWS\Tasks\At4.job
    2007-10-13 02:00:00 350 --a------ C:\WINDOWS\Tasks\At3.job
    2007-10-13 01:00:00 350 --a------ C:\WINDOWS\Tasks\At2.job
    2007-10-13 00:00:00 350 --a------ C:\WINDOWS\Tasks\At1.job
    2007-10-12 23:00:00 350 --a------ C:\WINDOWS\Tasks\At24.job
    2007-10-12 22:00:00 350 --a------ C:\WINDOWS\Tasks\At23.job
    2007-10-12 21:00:00 350 --a------ C:\WINDOWS\Tasks\At22.job
    2007-10-12 19:00:00 350 --a------ C:\WINDOWS\Tasks\At20.job
    2007-10-12 18:00:00 350 --a------ C:\WINDOWS\Tasks\At19.job
    2007-10-12 17:00:00 350 --a------ C:\WINDOWS\Tasks\At18.job
    2007-10-12 16:45:43 350 --a------ C:\WINDOWS\Tasks\At21.job
    2007-10-12 16:45:43 350 --a------ C:\WINDOWS\Tasks\At17.job
    2007-10-12 16:45:43 350 --a------ C:\WINDOWS\Tasks\At16.job
    2007-10-12 16:45:43 350 --a------ C:\WINDOWS\Tasks\At15.job
    2007-10-12 16:45:43 350 --a------ C:\WINDOWS\Tasks\At14.job
    2007-10-12 16:45:43 350 --a------ C:\WINDOWS\Tasks\At13.job
    2004-07-12 13:21:14 258 --a------ C:\WINDOWS\Tasks\Windows Update.job


    -- Files created between 2007-09-13 and 2007-10-13 -----------------------------

    2007-10-13 10:47:29 0 d-------- C:\VundoFix Backups
    2007-10-12 21:00:54 0 d-------- C:\Program Files\Trend Micro
    2007-10-12 20:07:43 0 d-------- C:\Documents and Settings\All Users\Application Data\Google
    2007-10-12 20:00:10 0 d-------- C:\Documents and Settings\All Users\Application Data\MSN6
    2007-10-12 20:00:10 0 d-------- C:\Documents and Settings\Administrator.COUGAR-CZOYQ1XS\Application Data\MSN6
    2007-10-12 19:58:16 0 d-------- C:\Documents and Settings\Administrator.COUGAR-CZOYQ1XS\Application Data\Mozilla
    2007-10-12 17:38:57 88576 --a------ C:\WINDOWS\system32\mousons.dll
    2007-10-12 17:38:30 106496 --a------ C:\WINDOWS\system32\pmkjj.exe
    2007-10-12 16:55:44 0 d-------- C:\WINDOWS\system32\PreInstall
    2007-10-12 16:55:42 0 d--h----- C:\WINDOWS\$hf_mig$
    2007-10-12 16:47:01 0 d-------- C:\Documents and Settings\LocalService\Start Menu
    2007-10-12 16:45:44 0 d-------- C:\WINDOWS\Prefetch
    2007-10-12 16:27:47 0 d-------- C:\WINDOWS\peernet
    2007-10-12 16:27:41 0 d-------- C:\WINDOWS\provisioning
    2007-10-12 16:17:52 0 d-------- C:\WINDOWS\ServicePackFiles
    2007-10-12 15:53:38 0 d-------- C:\WINDOWS\EHome
    2007-10-12 08:14:54 0 d-------- C:\Documents and Settings\Owner\Application Data\iPodder
    2007-10-10 09:51:34 0 d--h----- C:\Documents and Settings\Administrator.COUGAR-CZOYQ1XS\Templates
    2007-10-10 09:51:34 0 dr------- C:\Documents and Settings\Administrator.COUGAR-CZOYQ1XS\Start Menu
    2007-10-10 09:51:34 0 dr-h----- C:\Documents and Settings\Administrator.COUGAR-CZOYQ1XS\SendTo
    2007-10-10 09:51:34 0 d--h----- C:\Documents and Settings\Administrator.COUGAR-CZOYQ1XS\Recent
    2007-10-10 09:51:34 0 d--h----- C:\Documents and Settings\Administrator.COUGAR-CZOYQ1XS\PrintHood
    2007-10-10 09:51:34 786432 --ah----- C:\Documents and Settings\Administrator.COUGAR-CZOYQ1XS\NTUSER.DAT
    2007-10-10 09:51:34 0 d--h----- C:\Documents and Settings\Administrator.COUGAR-CZOYQ1XS\NetHood
    2007-10-10 09:51:34 0 d-------- C:\Documents and Settings\Administrator.COUGAR-CZOYQ1XS\My Documents
    2007-10-10 09:51:34 0 d--h----- C:\Documents and Settings\Administrator.COUGAR-CZOYQ1XS\Local Settings
    2007-10-10 09:51:34 0 d-------- C:\Documents and Settings\Administrator.COUGAR-CZOYQ1XS\Favorites
    2007-10-10 09:51:34 0 d-------- C:\Documents and Settings\Administrator.COUGAR-CZOYQ1XS\Desktop
    2007-10-10 09:51:34 0 d---s---- C:\Documents and Settings\Administrator.COUGAR-CZOYQ1XS\Cookies
    2007-10-10 09:51:34 0 dr-h----- C:\Documents and Settings\Administrator.COUGAR-CZOYQ1XS\Application Data
    2007-10-10 09:51:34 0 d---s---- C:\Documents and Settings\Administrator.COUGAR-CZOYQ1XS\Application Data\Microsoft
    2007-10-09 23:25:19 0 d-------- C:\Documents and Settings\Owner\Application Data\Grisoft
    2007-10-09 23:25:06 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2007-10-09 19:30:28 0 d-------- C:\!KillBox
    2007-09-18 18:10:41 0 d-------- C:\Program Files\Fisher-Price(R)


    -- Find3M Report ---------------------------------------------------------------

    2007-10-13 11:24:17 53 --a------ C:\WINDOWS\system32\dn6ee7f4a0.dat
    2007-10-12 18:42:24 0 d-------- C:\Program Files\Common Files\Symantec Shared
    2007-10-12 17:37:58 0 d-------- C:\Program Files\Messenger
    2007-10-12 16:27:47 0 d-------- C:\Program Files\Movie Maker
    2007-10-12 16:16:40 0 d-------- C:\Program Files\Windows NT
    2007-10-10 07:40:22 87040 --a------ C:\Documents and Settings\Owner\Application Data\tmpB.tmp.exe
    2007-10-10 07:39:16 77738 --a------ C:\Documents and Settings\Owner\Application Data\tmp6.tmp.exe
    2007-10-09 23:21:22 77920 --a------ C:\Documents and Settings\Owner\Application Data\tmp1A.tmp.exe
    2007-10-09 23:17:05 77920 --a------ C:\Documents and Settings\Owner\Application Data\tmp15.tmp.exe
    2007-10-09 22:26:34 77920 --a------ C:\Documents and Settings\Owner\Application Data\tmp1.tmp.exe
    2007-10-09 19:39:34 155648 --a------ C:\WINDOWS\system32\NeroCheck.exe <Not Verified; Ahead Software Gmbh; Ahead Software Gmbh NeroCheck>
    2007-10-02 19:02:37 87040 --a------ C:\Documents and Settings\Owner\Application Data\tmp35.tmp.exe
    2007-09-19 22:38:48 84992 --a------ C:\Documents and Settings\Owner\Application Data\tmp4.tmp.exe
    2007-09-18 18:10:42 0 d-------- C:\Program Files\Common Files\Knowledge Adventure
    2007-09-05 17:37:44 79634 --a------ C:\Documents and Settings\Owner\Application Data\tmp25.tmp.exe
    2007-09-03 18:31:20 124629 --a------ C:\Documents and Settings\Owner\Application Data\tmp4F.tmp.exe
    2007-08-27 19:07:12 0 --a------ C:\WINDOWS\system32\winsock.exe
    2007-08-24 17:31:00 0 d-------- C:\Documents and Settings\Owner\Application Data\dvdcss
    2007-08-17 11:27:18 79609 --a------ C:\Documents and Settings\Owner\Application Data\tmp2D3.tmp.exe
    2007-08-17 11:26:30 124679 --a------ C:\Documents and Settings\Owner\Application Data\tmp2CB.tmp.exe
    2007-08-16 14:00:42 0 d-------- C:\Documents and Settings\Owner\Application Data\ArcSoft
    2007-08-16 12:51:22 124699 --a------ C:\Documents and Settings\Owner\Application Data\tmp10.tmp.exe
    2007-08-15 11:41:22 124662 --a------ C:\Documents and Settings\Owner\Application Data\tmp3D.tmp.exe
    2007-08-15 05:34:43 13380 -----n--- C:\WINDOWS\system32\vturssp.dll


    -- Registry Dump ---------------------------------------------------------------

    *Note* empty entries & legit default entries are not shown


    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{46be620a-67d5-4ef7-bb44-41d95c0192e3}]
    10/12/2007 05:38 PM 88576 --a------ C:\WINDOWS\system32\mousons.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{63B2D652-EAD9-4D6E-93ED-2CC51D22CF02}]
    C:\WINDOWS\System32\XunLei.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{85589B5D-D53D-4237-A677-46B82EA275F3}]
    C:\WINDOWS\System32\BMLdf6JI.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "VTTimer "= "VTTimer.exe" [01/15/2004 02:33 PM C:\WINDOWS\system32\VTTimer.exe]
    "Cmaudio "= "cmicnfg.cpl" []
    "PCTVOICE "= "pctspk.exe" [01/30/2004 02:33 AM C:\WINDOWS\system32\pctspk.exe]
    "EPSON Stylus Photo RX620 Series "= "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9HA.exe" [05/19/2004 10:00 PM]
    "NeroFilterCheck "= "C:\WINDOWS\system32\NeroCheck.exe" [10/09/2007 07:39 PM]
    "InCD "= "C:\Program Files\Ahead\InCD\InCD.exe" []
    "QuickTime Task "= "C:\Program Files\QuickTime\qttask.exe" [09/06/2006 10:54 AM]
    "TkBellExe "= "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [09/06/2006 11:47 AM]
    "iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [06/14/2006 04:24 PM]
    "vptray "= "D:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe" [08/28/2002 02:12 PM]
    "SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [03/14/2007 03:43 AM]
    "LGODDFU "= "D:\Program Files\lg_fwupdate\fwupdate.exe" []
    "RemoteControl "= "D:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [12/08/2003 06:35 PM]
    "@ "= "C:\WINDOWS\System32\scvhost.exe" []
    "mppds "= "C:\WINDOWS\mppds.exe" []
    "Adobe Reader Speed Launcher "= "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [05/11/2007 03:06 AM]
    "!AVG Anti-Spyware "= "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [06/11/2007 11:25 AM]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 09:56 AM]
    "BitTorrent "= "C:\Program Files\BitTorrent\bittorrent.exe" []
    "BitComet "= "D:\Program Files\BitLord\BitLord.exe" [05/07/2005 02:47 AM]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
    "DisableRegistryTools "=0 (0x0)

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    "{7F4A6EE7-6EE7-F4A0-E7F4-EE74AEE7F4A0} "= C:\Program Files\Common Files\Microsoft Shared\MSINFO\6EE7F4A0.dll [ ]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\inetut8]
    inetut8.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\mousons]
    mousons.dll 10/12/2007 05:38 PM 88576 C:\WINDOWS\system32\mousons.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "appinit_dlls "=c:\windows\system32\vturssp.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
    @= "Volume shadow copy "




    -- End of Deckard's System Scanner: finished at 2007-10-13 11:28:31 ------------
     
    GregoryC,
    #3
  5. 2007/10/13
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    The account you're on is fine. That administrator privledges statement applies to computers with secondary 'limited' user account(s).

    Download ComboFix by sUBs from here or here, saving the file to your Desktop.
    • Close all open programs and windows
    • Double click combofix.exe and follow the prompts.
    • When finished, it will open a log for you. Post that log and a new HijackThis log in your next reply.
    Note: Do not mouseclick combofix's window while its running. That may cause it to stall
     
    noahdfear,
    #4
  6. 2007/10/13
    GregoryC

    GregoryC Inactive Thread Starter

    Joined:
    2007/10/12
    Messages:
    7
    Likes Received:
    0
    REGT Missing

    When I ran combo fix it gave me errors 2 or 3 times saying REGT is invalid or something like that. Below are the logs you requested.

    ComboFix 07-10-12.4 - Owner 2007-10-13 15:59:43.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.188 [GMT 2:00]
    Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
    * Created a new restore point
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Documents and Settings\Owner\Application Data\tmp1.tmp.exe
    C:\Documents and Settings\Owner\Application Data\tmp1.tmp.exe
    C:\Documents and Settings\Owner\Application Data\tmp10.tmp.exe
    C:\Documents and Settings\Owner\Application Data\tmp10.tmp.exe
    C:\Documents and Settings\Owner\Application Data\tmp15.tmp.exe
    C:\Documents and Settings\Owner\Application Data\tmp15.tmp.exe
    C:\Documents and Settings\Owner\Application Data\tmp1A.tmp.exe
    C:\Documents and Settings\Owner\Application Data\tmp1A.tmp.exe
    C:\Documents and Settings\Owner\Application Data\tmp25.tmp.exe
    C:\Documents and Settings\Owner\Application Data\tmp25.tmp.exe
    C:\Documents and Settings\Owner\Application Data\tmp2CB.tmp.exe
    C:\Documents and Settings\Owner\Application Data\tmp2CB.tmp.exe
    C:\Documents and Settings\Owner\Application Data\tmp2D3.tmp.exe
    C:\Documents and Settings\Owner\Application Data\tmp2D3.tmp.exe
    C:\Documents and Settings\Owner\Application Data\tmp35.tmp.exe
    C:\Documents and Settings\Owner\Application Data\tmp35.tmp.exe
    C:\Documents and Settings\Owner\Application Data\tmp3D.tmp.exe
    C:\Documents and Settings\Owner\Application Data\tmp3D.tmp.exe
    C:\Documents and Settings\Owner\Application Data\tmp4.tmp.exe
    C:\Documents and Settings\Owner\Application Data\tmp4.tmp.exe
    C:\Documents and Settings\Owner\Application Data\tmp4F.tmp.exe
    C:\Documents and Settings\Owner\Application Data\tmp4F.tmp.exe
    C:\Documents and Settings\Owner\Application Data\tmp6.tmp.exe
    C:\Documents and Settings\Owner\Application Data\tmp6.tmp.exe
    C:\Documents and Settings\Owner\Application Data\tmpB.tmp.exe
    C:\WINDOWS\help\wshmcepts.chm
    C:\WINDOWS\system32\dn6ee7f4a0.dat
    C:\WINDOWS\system32\mousons.dll
    C:\WINDOWS\system32\tmp25.tmp.dll
    C:\WINDOWS\system32\tmp2D3.tmp.dll
    C:\WINDOWS\system32\tmp35.tmp.dll
    C:\WINDOWS\system32\tmp35.tmp.dll
    C:\WINDOWS\system32\tmp84.tmp.dll

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

    .
    -------\LEGACY_DOMAINSERVICE
    -------\DomainService


    ((((((((((((((((((((((((( Files Created from 2007-09-13 to 2007-10-13 )))))))))))))))))))))))))))))))
    .

    2007-10-13 16:06 105,984 --a------ C:\WINDOWS\system32\mllmn.exe
    2007-10-13 16:06 88,576 --a------ C:\WINDOWS\system32\dx7rch.dll
    2007-10-13 16:06 53 --a------ C:\WINDOWS\system32\dn6ee7f4a0.dat
    2007-10-13 15:57 51,200 --a------ C:\WINDOWS\NirCmd.exe
    2007-10-13 14:46 <DIR> d-------- C:\Midi
    2007-10-13 11:09 <DIR> d-------- C:\Deckard
    2007-10-13 10:47 <DIR> d-------- C:\VundoFix Backups
    2007-10-12 21:00 <DIR> d-------- C:\Program Files\Trend Micro
    2007-10-12 20:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\MSN6
    2007-10-12 20:00 <DIR> d-------- C:\Documents and Settings\Administrator.COUGAR-CZOYQ1XS\Application Data\MSN6
    2007-10-12 17:41 498,742 -----c--- C:\WINDOWS\system32\dllcache\dxmasf.dll
    2007-10-12 17:41 246,814 -----c--- C:\WINDOWS\system32\dllcache\strmdll.dll
    2007-10-12 17:38 106,496 --a------ C:\WINDOWS\system32\pmkjj.exe
    2007-10-12 17:28 128,896 -----c--- C:\WINDOWS\system32\dllcache\fltmgr.sys
    2007-10-12 17:28 23,040 -----c--- C:\WINDOWS\system32\dllcache\fltmc.exe
    2007-10-12 17:28 16,896 -----c--- C:\WINDOWS\system32\dllcache\fltlib.dll
    2007-10-12 17:22 584,192 -----c--- C:\WINDOWS\system32\dllcache\rpcrt4.dll
    2007-10-12 16:55 <DIR> d--h----- C:\WINDOWS\$hf_mig$
    2007-10-12 16:31 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
    2007-10-12 16:27 <DIR> d-------- C:\WINDOWS\provisioning
    2007-10-12 16:27 <DIR> d-------- C:\WINDOWS\peernet
    2007-10-12 16:17 <DIR> d-------- C:\WINDOWS\ServicePackFiles
    2007-10-12 16:03 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
    2007-10-12 15:53 <DIR> d-------- C:\WINDOWS\EHome
    2007-10-12 08:14 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\iPodder
    2007-10-09 23:25 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Grisoft
    2007-10-09 23:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2007-10-09 23:25 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2007-09-18 18:10 <DIR> d-------- C:\Program Files\Fisher-Price(R)

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2007-10-12 16:42 --------- d-----w C:\Program Files\Common Files\Symantec Shared
    2007-10-09 17:39 155,648 ----a-w C:\WINDOWS\system32\NeroCheck.exe
    2007-09-18 16:10 --------- d-----w C:\Program Files\Common Files\Knowledge Adventure
    2007-08-24 15:31 --------- d-----w C:\Documents and Settings\Owner\Application Data\dvdcss
    2007-08-21 06:15 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
    2007-08-16 12:00 --------- d-----w C:\Documents and Settings\Owner\Application Data\ArcSoft
    2007-08-15 03:34 13,380 ------w C:\WINDOWS\system32\vturssp.dll
    2007-07-30 17:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
    2007-07-30 17:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
    2007-07-30 17:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
    2007-07-30 17:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
    2007-07-30 17:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
    2007-07-30 17:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
    2007-07-30 17:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll
    2007-07-30 17:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll
    2004-10-01 14:00 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe
    2001-11-23 04:08 712,704 ----a-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{85589B5D-D53D-4237-A677-46B82EA275F3}]
    C:\WINDOWS\System32\BMLdf6JI.dll

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "VTTimer "= "VTTimer.exe" [2004-01-15 14:33 C:\WINDOWS\system32\VTTimer.exe]
    "Cmaudio "= "cmicnfg.cpl" []
    "PCTVOICE "= "pctspk.exe" [2004-01-30 02:33 C:\WINDOWS\system32\pctspk.exe]
    "EPSON Stylus Photo RX620 Series "= "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9HA.exe" [2004-05-19 22:00]
    "NeroFilterCheck "= "C:\WINDOWS\system32\NeroCheck.exe" [2007-10-09 19:39]
    "InCD "= "C:\Program Files\Ahead\InCD\InCD.exe" []
    "QuickTime Task "= "C:\Program Files\QuickTime\qttask.exe" [2006-09-06 10:54]
    "TkBellExe "= "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-09-06 11:47]
    "iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [2006-06-14 16:24]
    "vptray "= "D:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe" [2002-08-28 14:12]
    "SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
    "LGODDFU "= "D:\Program Files\lg_fwupdate\fwupdate.exe" []
    "RemoteControl "= "D:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2003-12-08 18:35]
    "Adobe Reader Speed Launcher "= "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
    "!AVG Anti-Spyware "= "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:56]
    "BitTorrent "= "C:\Program Files\BitTorrent\bittorrent.exe" []
    "BitComet "= "D:\Program Files\BitLord\BitLord.exe" [2005-05-07 02:47]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
    "DisableRegistryTools "=0 (0x0)

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    "{7F4A6EE7-6EE7-F4A0-E7F4-EE74AEE7F4A0} "= C:\Program Files\Common Files\Microsoft Shared\MSINFO\6EE7F4A0.dll [ ]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dx7rch]
    dx7rch.dll 2007-10-13 16:06 88576 C:\WINDOWS\system32\dx7rch.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\inetut8]
    inetut8.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "appinit_dlls "=c:\windows\system32\vturssp.dll

    S3 SRS_SSCFilter;SRS Labs Audio Sandbox (WDM);C:\WINDOWS\system32\drivers\srs_sscfilter.sys

    *Newly Created Service* - HTTPFILTER
    .
    Contents of the 'Scheduled Tasks' folder
    "2007-10-12 22:00:00 C:\WINDOWS\Tasks\At1.job "
    - C:\WINDOWS\System32\lIKR56u3.exe
    "2007-10-13 07:00:00 C:\WINDOWS\Tasks\At10.job "
    - C:\WINDOWS\System32\lIKR56u3.exe
    "2007-10-13 08:00:00 C:\WINDOWS\Tasks\At11.job "
    "2007-10-13 09:00:02 C:\WINDOWS\Tasks\At12.job "
    - C:\WINDOWS\System32\lIKR56u3.exe
    "2007-10-13 10:00:00 C:\WINDOWS\Tasks\At13.job "
    - C:\WINDOWS\System32\lIKR56u3.exe
    "2007-10-13 11:00:00 C:\WINDOWS\Tasks\At14.job "
    - C:\WINDOWS\System32\lIKR56u3.exe
    "2007-10-13 12:00:00 C:\WINDOWS\Tasks\At15.job "
    - C:\WINDOWS\System32\lIKR56u3.exe
    "2007-10-13 13:00:00 C:\WINDOWS\Tasks\At16.job "
    - C:\WINDOWS\System32\lIKR56u3.exe
    "2007-10-13 14:00:00 C:\WINDOWS\Tasks\At17.job "
    - C:\WINDOWS\System32\lIKR56u3.exe
    "2007-10-12 15:00:00 C:\WINDOWS\Tasks\At18.job "
    - C:\WINDOWS\System32\lIKR56u3.exe
    "2007-10-12 16:00:00 C:\WINDOWS\Tasks\At19.job "
    - C:\WINDOWS\System32\lIKR56u3.exe
    "2007-10-12 23:00:00 C:\WINDOWS\Tasks\At2.job "
    - C:\WINDOWS\System32\lIKR56u3.exe
    "2007-10-12 17:00:00 C:\WINDOWS\Tasks\At20.job "
    - C:\WINDOWS\System32\lIKR56u3.exe
    "2007-10-12 14:45:43 C:\WINDOWS\Tasks\At21.job "
    - C:\WINDOWS\System32\lIKR56u3.exe
    "2007-10-12 19:00:00 C:\WINDOWS\Tasks\At22.job "
    "2007-10-12 20:00:00 C:\WINDOWS\Tasks\At23.job "
    - C:\WINDOWS\System32\lIKR56u3.exe
    "2007-10-12 21:00:00 C:\WINDOWS\Tasks\At24.job "
    - C:\WINDOWS\System32\lIKR56u3.exe
    "2007-10-13 00:00:00 C:\WINDOWS\Tasks\At3.job "
    - C:\WINDOWS\System32\lIKR56u3.exe
    "2007-10-13 01:00:00 C:\WINDOWS\Tasks\At4.job "
    - C:\WINDOWS\System32\lIKR56u3.exe
    "2007-10-13 02:00:00 C:\WINDOWS\Tasks\At5.job "
    - C:\WINDOWS\System32\lIKR56u3.exe
    "2007-10-13 03:00:00 C:\WINDOWS\Tasks\At6.job "
    - C:\WINDOWS\System32\lIKR56u3.exe
    "2007-10-13 04:00:00 C:\WINDOWS\Tasks\At7.job "
    - C:\WINDOWS\System32\lIKR56u3.exe
    "2007-10-13 05:00:00 C:\WINDOWS\Tasks\At8.job "
    - C:\WINDOWS\System32\lIKR56u3.exe
    "2007-10-13 06:00:00 C:\WINDOWS\Tasks\At9.job "
    - C:\WINDOWS\System32\lIKR56u3.exe
    "2004-07-12 11:21:14 C:\WINDOWS\Tasks\Windows Update.job "
    - C:\WINDOWS\system32\wupdmgr.exe
    .
    **************************************************************************

    catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-10-13 16:07:00
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2007-10-13 16:10:00 - machine was rebooted
    .
    --- E O F ---


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 4:13:25 PM, on 10/13/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Ahead\InCD\InCDsrv.exe
    C:\WINDOWS\system32\spoolsv.exe
    D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\System32\cisvc.exe
    D:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    D:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\fxssvc.exe
    C:\WINDOWS\system32\RunDll32.exe
    C:\WINDOWS\system32\VTTimer.exe
    C:\WINDOWS\system32\RunDll32.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9HA.EXE
    C:\Program Files\QuickTime\qttask.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    D:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
    D:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
    C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
    D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O2 - BHO: WebAssist - {85589B5D-D53D-4237-A677-46B82EA275F3} - C:\WINDOWS\System32\BMLdf6JI.dll (file missing)
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
    O4 - HKLM\..\Run: [EPSON Stylus Photo RX620 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9HA.EXE /P31 "EPSON Stylus Photo RX620 Series" /O6 "USB001" /M "Stylus Photo RX620 "
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [vptray] D:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe "
    O4 - HKLM\..\Run: [LGODDFU] "D:\Program Files\lg_fwupdate\fwupdate.exe "
    O4 - HKLM\..\Run: [RemoteControl] "D:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe "
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
    O4 - HKCU\..\Run: [BitComet] "D:\Program Files\BitLord\BitLord.exe "
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\dx7rch.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\dx7rch.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.apple.com.edgesuite.net/qtinstall.info.apple.com/lupin/us/win/QuickTimeInstaller.exe
    O20 - AppInit_DLLs: c:\windows\system32\vturssp.dll
    O20 - Winlogon Notify: dx7rch - C:\WINDOWS\SYSTEM32\dx7rch.dll
    O20 - Winlogon Notify: inetut8 - inetut8.dll (file missing)
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: DefWatch - Symantec Corporation - D:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - D:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
    O23 - Service: ÃŽ¢ÃˆÃ­ (ÃŽ¢ÃˆÃ­2007) - Unknown owner - C:\WINDOWS\inter.exe (file missing)

    --
    End of file - 6952 bytes
     
    GregoryC,
    #5
  7. 2007/10/13
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Copy the contents of the code box below and paste it into a blank notepad, then save it to your desktop as;

    Filename: CFScript.txt
    Save As Type: All Files (*.*)

    Code:
    
http://www.windowsbbs.com/showthread.php?p=368003#post368003

Collect::[22]
C:\WINDOWS\System32\lIKR56u3.exe
C:\WINDOWS\system32\mllmn.exe
C:\WINDOWS\system32\dx7rch.dll
C:\WINDOWS\system32\dn6ee7f4a0.dat
C:\WINDOWS\system32\pmkjj.exe
C:\WINDOWS\system32\vturssp.dll
C:\WINDOWS\System32\BMLdf6JI.dll
C:\WINDOWS\inter.exe

Suspect::[22]
C:\Program Files\Common Files\Microsoft Shared\MSINFO\6EE7F4A0.dll

File::
C:\WINDOWS\Tasks\At1.job
C:\WINDOWS\Tasks\At10.job
C:\WINDOWS\Tasks\At11.job
C:\WINDOWS\Tasks\At12.job
C:\WINDOWS\Tasks\At13.job
C:\WINDOWS\Tasks\At14.job
C:\WINDOWS\Tasks\At15.job
C:\WINDOWS\Tasks\At16.job
C:\WINDOWS\Tasks\At17.job
C:\WINDOWS\Tasks\At18.job
C:\WINDOWS\Tasks\At19.job
C:\WINDOWS\Tasks\At2.job
C:\WINDOWS\Tasks\At20.job
C:\WINDOWS\Tasks\At21.job
C:\WINDOWS\Tasks\At22.job
C:\WINDOWS\Tasks\At23.job
C:\WINDOWS\Tasks\At24.job
C:\WINDOWS\Tasks\At3.job
C:\WINDOWS\Tasks\At4.job
C:\WINDOWS\Tasks\At5.job
C:\WINDOWS\Tasks\At6.job
C:\WINDOWS\Tasks\At7.job
C:\WINDOWS\Tasks\At8.job
C:\WINDOWS\Tasks\At9.job

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{85589B5D-D53D-4237-A677-46B82EA275F3}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\dx7rch] 
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\inetut8] 
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
 "appinit_dlls "=-

Driver::
ÃŽ¢ÃˆÃ­
    Close all other windows and programs. Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log and a fresh HijackThis log.

    Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.

    Please note that I have instructed CFScript to collect some files. This means that at some point, likely after reboot when ComboFix finishes, you will be prompted to allow ComboFix to upload a zip file that was created on your desktop. The zip contains the aforementioned files. Please copy the path shown in the prompt and paste it into the box, then click Send. This will assist the author in adding the files for removal in future updates. Thanks!
     
    noahdfear,
    #6
  8. 2007/10/13
    GregoryC

    GregoryC Inactive Thread Starter

    Joined:
    2007/10/12
    Messages:
    7
    Likes Received:
    0
    Awesome, it worked

    I don't get the Realtime Protection Scan pop-up anymore, and the file vturssp.dll is gone. Thanks alot. Just in-case, below are the logs you requested. Also, I sent the zip like you asked.

    ComboFix 07-10-12.4 - Owner 2007-10-13 19:59:43.2 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.126 [GMT 2:00]
    Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
    Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt
    * Created a new restore point

    FILE::
    C:\WINDOWS\Tasks\At1.job
    C:\WINDOWS\Tasks\At10.job
    C:\WINDOWS\Tasks\At11.job
    C:\WINDOWS\Tasks\At12.job
    C:\WINDOWS\Tasks\At13.job
    C:\WINDOWS\Tasks\At14.job
    C:\WINDOWS\Tasks\At15.job
    C:\WINDOWS\Tasks\At16.job
    C:\WINDOWS\Tasks\At17.job
    C:\WINDOWS\Tasks\At18.job
    C:\WINDOWS\Tasks\At19.job
    C:\WINDOWS\Tasks\At2.job
    C:\WINDOWS\Tasks\At20.job
    C:\WINDOWS\Tasks\At21.job
    C:\WINDOWS\Tasks\At22.job
    C:\WINDOWS\Tasks\At23.job
    C:\WINDOWS\Tasks\At24.job
    C:\WINDOWS\Tasks\At3.job
    C:\WINDOWS\Tasks\At4.job
    C:\WINDOWS\Tasks\At5.job
    C:\WINDOWS\Tasks\At6.job
    C:\WINDOWS\Tasks\At7.job
    C:\WINDOWS\Tasks\At8.job
    C:\WINDOWS\Tasks\At9.job
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\system32\dn6ee7f4a0.dat
    C:\WINDOWS\system32\dn6ee7f4a0.dat
    C:\WINDOWS\system32\dx7rch.dll
    C:\WINDOWS\system32\mllmn.exe
    C:\WINDOWS\system32\pmkjj.exe
    C:\WINDOWS\system32\vturssp.dll
    C:\WINDOWS\Tasks\At1.job
    C:\WINDOWS\Tasks\At10.job
    C:\WINDOWS\Tasks\At11.job
    C:\WINDOWS\Tasks\At12.job
    C:\WINDOWS\Tasks\At13.job
    C:\WINDOWS\Tasks\At14.job
    C:\WINDOWS\Tasks\At15.job
    C:\WINDOWS\Tasks\At16.job
    C:\WINDOWS\Tasks\At17.job
    C:\WINDOWS\Tasks\At18.job
    C:\WINDOWS\Tasks\At19.job
    C:\WINDOWS\Tasks\At2.job
    C:\WINDOWS\Tasks\At20.job
    C:\WINDOWS\Tasks\At21.job
    C:\WINDOWS\Tasks\At22.job
    C:\WINDOWS\Tasks\At23.job
    C:\WINDOWS\Tasks\At24.job
    C:\WINDOWS\Tasks\At3.job
    C:\WINDOWS\Tasks\At4.job
    C:\WINDOWS\Tasks\At5.job
    C:\WINDOWS\Tasks\At6.job
    C:\WINDOWS\Tasks\At7.job
    C:\WINDOWS\Tasks\At8.job
    C:\WINDOWS\Tasks\At9.job

    .
    ((((((((((((((((((((((((( Files Created from 2007-09-13 to 2007-10-13 )))))))))))))))))))))))))))))))
    .

    2007-10-13 15:57 51,200 --a------ C:\WINDOWS\NirCmd.exe
    2007-10-13 14:46 <DIR> d-------- C:\Midi
    2007-10-13 11:09 <DIR> d-------- C:\Deckard
    2007-10-13 10:47 <DIR> d-------- C:\VundoFix Backups
    2007-10-12 21:00 <DIR> d-------- C:\Program Files\Trend Micro
    2007-10-12 20:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\MSN6
    2007-10-12 20:00 <DIR> d-------- C:\Documents and Settings\Administrator.COUGAR-CZOYQ1XS\Application Data\MSN6
    2007-10-12 17:41 498,742 -----c--- C:\WINDOWS\system32\dllcache\dxmasf.dll
    2007-10-12 17:41 246,814 -----c--- C:\WINDOWS\system32\dllcache\strmdll.dll
    2007-10-12 17:28 128,896 -----c--- C:\WINDOWS\system32\dllcache\fltmgr.sys
    2007-10-12 17:28 23,040 -----c--- C:\WINDOWS\system32\dllcache\fltmc.exe
    2007-10-12 17:28 16,896 -----c--- C:\WINDOWS\system32\dllcache\fltlib.dll
    2007-10-12 16:55 <DIR> d--h----- C:\WINDOWS\$hf_mig$
    2007-10-12 16:31 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
    2007-10-12 16:27 <DIR> d-------- C:\WINDOWS\provisioning
    2007-10-12 16:27 <DIR> d-------- C:\WINDOWS\peernet
    2007-10-12 16:17 <DIR> d-------- C:\WINDOWS\ServicePackFiles
    2007-10-12 16:03 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
    2007-10-12 15:53 <DIR> d-------- C:\WINDOWS\EHome
    2007-10-12 08:14 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\iPodder
    2007-10-09 23:25 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Grisoft
    2007-10-09 23:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2007-10-09 23:25 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2007-09-18 18:10 <DIR> d-------- C:\Program Files\Fisher-Price(R)

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2007-10-12 16:42 --------- d-----w C:\Program Files\Common Files\Symantec Shared
    2007-09-18 16:10 --------- d-----w C:\Program Files\Common Files\Knowledge Adventure
    2007-08-24 15:31 --------- d-----w C:\Documents and Settings\Owner\Application Data\dvdcss
    2007-08-16 12:00 --------- d-----w C:\Documents and Settings\Owner\Application Data\ArcSoft
    2004-10-01 14:00 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe
    2001-11-23 04:08 712,704 ----a-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
    .

    ((((((((((((((((((((((((((((( snapshot@2007-10-13_16.08.40.28 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2004-08-04 07:56:42 71,680 -c--a-w C:\WINDOWS\system32\dllcache\msacm32.dll
    + 2004-08-04 07:56:43 343,040 -c--a-w C:\WINDOWS\system32\dllcache\msvcrt.dll
    + 2004-08-04 07:56:36 708,096 -c--a-w C:\WINDOWS\system32\dllcache\ntdll.dll
    + 2004-08-04 07:56:45 65,536 -c--a-w C:\WINDOWS\system32\dllcache\shimeng.dll
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "VTTimer "= "VTTimer.exe" [2004-01-15 14:33 C:\WINDOWS\system32\VTTimer.exe]
    "Cmaudio "= "cmicnfg.cpl" []
    "PCTVOICE "= "pctspk.exe" [2004-01-30 02:33 C:\WINDOWS\system32\pctspk.exe]
    "EPSON Stylus Photo RX620 Series "= "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9HA.exe" [2004-05-19 22:00]
    "NeroFilterCheck "= "C:\WINDOWS\system32\NeroCheck.exe" [2007-10-09 19:39]
    "InCD "= "C:\Program Files\Ahead\InCD\InCD.exe" []
    "QuickTime Task "= "C:\Program Files\QuickTime\qttask.exe" [2006-09-06 10:54]
    "TkBellExe "= "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-09-06 11:47]
    "iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [2006-06-14 16:24]
    "vptray "= "D:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe" [2002-08-28 14:12]
    "SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
    "LGODDFU "= "D:\Program Files\lg_fwupdate\fwupdate.exe" []
    "RemoteControl "= "D:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2003-12-08 18:35]
    "Adobe Reader Speed Launcher "= "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
    "!AVG Anti-Spyware "= "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:56]
    "BitTorrent "= "C:\Program Files\BitTorrent\bittorrent.exe" []
    "BitComet "= "D:\Program Files\BitLord\BitLord.exe" [2005-05-07 02:47]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
    "DisableRegistryTools "=0 (0x0)

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    "{7F4A6EE7-6EE7-F4A0-E7F4-EE74AEE7F4A0} "= C:\Program Files\Common Files\Microsoft Shared\MSINFO\6EE7F4A0.dll [ ]

    S3 SRS_SSCFilter;SRS Labs Audio Sandbox (WDM);C:\WINDOWS\system32\drivers\srs_sscfilter.sys

    .
    Contents of the 'Scheduled Tasks' folder
    "2004-07-12 11:21:14 C:\WINDOWS\Tasks\Windows Update.job "
    - C:\WINDOWS\system32\wupdmgr.exe
    .
    **************************************************************************

    catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-10-13 20:13:49
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2007-10-13 20:16:02 - machine was rebooted
    C:\ComboFix2.txt ... 2007-10-13 16:10
    .
    --- E O F ---



    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 8:26:22 PM, on 10/13/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Ahead\InCD\InCDsrv.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    D:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    D:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\fxssvc.exe
    C:\WINDOWS\system32\VTTimer.exe
    C:\WINDOWS\system32\RunDll32.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9HA.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    D:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
    D:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
    D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\WINDOWS\system32\ctfmon.exe
    D:\Program Files\BitLord\BitLord.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
    O4 - HKLM\..\Run: [EPSON Stylus Photo RX620 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9HA.EXE /P31 "EPSON Stylus Photo RX620 Series" /O6 "USB001" /M "Stylus Photo RX620 "
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [vptray] D:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe "
    O4 - HKLM\..\Run: [LGODDFU] "D:\Program Files\lg_fwupdate\fwupdate.exe "
    O4 - HKLM\..\Run: [RemoteControl] "D:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe "
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
    O4 - HKCU\..\Run: [BitComet] "D:\Program Files\BitLord\BitLord.exe "
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.apple.com.edgesuite.net/qtinstall.info.apple.com/lupin/us/win/QuickTimeInstaller.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: DefWatch - Symantec Corporation - D:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - D:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
    O23 - Service: ÃŽ¢ÃˆÃ­ (ÃŽ¢ÃˆÃ­2007) - Unknown owner - C:\WINDOWS\inter.exe (file missing)

    --
    End of file - 6579 bytes
     
    GregoryC,
    #7
  9. 2007/10/13
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Looking much better. Still a few things left to do though. One of the files I wanted uploaded either didn't exist or was unsuccessful in the upload. If it exists, please upload the following file to my submission channel. Leave a link back to this topic.

    C:\Program Files\Common Files\Microsoft Shared\MSINFO\6EE7F4A0.dll

    Let me know if the file is not found.

    We need to remove a rogue service. Highlight and copy the first bolded command below, then click Start>Run and paste it in and hit Enter.

    sc stop ÃŽ¢ÃˆÃ­2007

    Now do the same with this command.

    sc delete ÃŽ¢ÃˆÃ­2007

    Scan with HijackThis again and save the log, then post it here.

    Thanks for the upload! Just so you know, here's the results from the files submitted.

    dx7rch.dll << infected - TR/Vundo.Gen
    mllmn.exe << infected - TR/Vundo.Gen
    pmkjj.exe << infected - TR/Vundo.Gen
    vturssp.dll << infected - TR/Crypt.XPACK.Gen
     
    noahdfear,
    #8
  10. 2007/10/14
    GregoryC

    GregoryC Inactive Thread Starter

    Joined:
    2007/10/12
    Messages:
    7
    Likes Received:
    0
    Thanks alot for your help

    I uploaded the file you requested, and removed the rogue service with the two commands you gave me. A window popped up for a brief second and then dissappeared, so I assume that means it worked. Thank you so much for your help, I've been trying for months to figure out how to get rid of this. I was about ready to format my hard drive and reload windows. I don't know if that would have solved the problem. Then I found Windows BBS. Your instructions were clear and easy to understand; polite, and best of all, solved my problem. I think I'd pull my hair out trying to explain technical stuff to someone who's not so technical. Great site, I'll recommend it to all my friends.
     
    GregoryC,
    #9
  11. 2007/10/14
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    The file you uploaded was an empty file, and doesn't belong there. Lets nuke it and the entry that points to it.
    Highlight and copy the contents of the code box below and paste it into a blank notepad, then save it to your desktop as;

    Filename: CFScript.txt
    Save As Type: All Files (*.*)

    Code:
    File::
C:\Program Files\Common Files\Microsoft Shared\MSINFO\6EE7F4A0.dll
Registry::
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\[COLOR="Black"]CurrentVersion[/COLOR]\Explorer\ShellExecuteHooks]
 "{7F4A6EE7-6EE7-F4A0-E7F4-EE74AEE7F4A0} "= -
    Close all other windows and programs. Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log.

    Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.


    Please post a new HijackThis log as well.
     
    noahdfear,
    #10
  12. 2007/10/15
    GregoryC

    GregoryC Inactive Thread Starter

    Joined:
    2007/10/12
    Messages:
    7
    Likes Received:
    0
    Regt

    Sorry I took so long replying. I thought you were done, and I was out all day yesterday.

    When I run Combofix it gives me an error about 3 or 4 time stating "Windows cannot find 'REGT'. Make sure you typed the name correctly, and then try again. To search for a file, click the Start button, and then click Search." I don't know if thats a problem or not. BTW, it didn't reboot this time.

    Below are the logs you requested.

    ComboFix 07-10-12.4 - Owner 2007-10-15 17:43:39.3 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.115 [GMT 2:00]
    Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
    Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt
    * Created a new restore point

    FILE::
    C:\Program Files\Common Files\Microsoft Shared\MSINFO\6EE7F4A0.dll
    .

    ((((((((((((((((((((((((( Files Created from 2007-09-15 to 2007-10-15 )))))))))))))))))))))))))))))))
    .

    2007-10-13 20:18 <DIR> d-------- C:\WINDOWS\system32\LogFiles
    2007-10-13 15:57 51,200 --a------ C:\WINDOWS\NirCmd.exe
    2007-10-13 14:46 <DIR> d-------- C:\Midi
    2007-10-13 11:09 <DIR> d-------- C:\Deckard
    2007-10-13 10:47 <DIR> d-------- C:\VundoFix Backups
    2007-10-12 21:00 <DIR> d-------- C:\Program Files\Trend Micro
    2007-10-12 20:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\MSN6
    2007-10-12 20:00 <DIR> d-------- C:\Documents and Settings\Administrator.COUGAR-CZOYQ1XS\Application Data\MSN6
    2007-10-12 17:41 498,742 -----c--- C:\WINDOWS\system32\dllcache\dxmasf.dll
    2007-10-12 17:41 246,814 -----c--- C:\WINDOWS\system32\dllcache\strmdll.dll
    2007-10-12 17:28 128,896 -----c--- C:\WINDOWS\system32\dllcache\fltmgr.sys
    2007-10-12 17:28 23,040 -----c--- C:\WINDOWS\system32\dllcache\fltmc.exe
    2007-10-12 17:28 16,896 -----c--- C:\WINDOWS\system32\dllcache\fltlib.dll
    2007-10-12 16:55 <DIR> d--h----- C:\WINDOWS\$hf_mig$
    2007-10-12 16:31 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
    2007-10-12 16:27 <DIR> d-------- C:\WINDOWS\provisioning
    2007-10-12 16:27 <DIR> d-------- C:\WINDOWS\peernet
    2007-10-12 16:17 <DIR> d-------- C:\WINDOWS\ServicePackFiles
    2007-10-12 16:03 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
    2007-10-12 15:53 <DIR> d-------- C:\WINDOWS\EHome
    2007-10-12 08:14 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\iPodder
    2007-10-09 23:25 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Grisoft
    2007-10-09 23:25 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2007-10-09 23:25 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2007-09-18 18:10 <DIR> d-------- C:\Program Files\Fisher-Price(R)

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2007-10-12 16:42 --------- d-----w C:\Program Files\Common Files\Symantec Shared
    2007-10-09 17:39 155,648 ----a-w C:\WINDOWS\system32\NeroCheck.exe
    2007-09-18 16:10 --------- d-----w C:\Program Files\Common Files\Knowledge Adventure
    2007-08-24 15:31 --------- d-----w C:\Documents and Settings\Owner\Application Data\dvdcss
    2007-08-21 06:15 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
    2007-08-16 12:00 --------- d-----w C:\Documents and Settings\Owner\Application Data\ArcSoft
    2007-07-30 17:19 92,504 ----a-w C:\WINDOWS\system32\cdm.dll
    2007-07-30 17:19 549,720 ----a-w C:\WINDOWS\system32\wuapi.dll
    2007-07-30 17:19 53,080 ----a-w C:\WINDOWS\system32\wuauclt.exe
    2007-07-30 17:19 43,352 ----a-w C:\WINDOWS\system32\wups2.dll
    2007-07-30 17:19 325,976 ----a-w C:\WINDOWS\system32\wucltui.dll
    2007-07-30 17:19 203,096 ----a-w C:\WINDOWS\system32\wuweb.dll
    2007-07-30 17:19 1,712,984 ----a-w C:\WINDOWS\system32\wuaueng.dll
    2007-07-30 17:18 33,624 ----a-w C:\WINDOWS\system32\wups.dll
    2004-10-01 14:00 40,960 ----a-w C:\Program Files\Uninstall_CDS.exe
    2001-11-23 04:08 712,704 ----a-w C:\WINDOWS\inf\OTHER\AUDIO3D.DLL
    .

    ((((((((((((((((((((((((((((( snapshot@2007-10-13_16.08.40.28 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2004-08-04 07:56:42 71,680 -c--a-w C:\WINDOWS\system32\dllcache\msacm32.dll
    + 2004-08-04 07:56:43 343,040 -c--a-w C:\WINDOWS\system32\dllcache\msvcrt.dll
    + 2004-08-04 07:56:36 708,096 -c--a-w C:\WINDOWS\system32\dllcache\ntdll.dll
    + 2004-08-04 07:56:45 65,536 -c--a-w C:\WINDOWS\system32\dllcache\shimeng.dll
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "VTTimer "= "VTTimer.exe" [2004-01-15 14:33 C:\WINDOWS\system32\VTTimer.exe]
    "Cmaudio "= "cmicnfg.cpl" []
    "PCTVOICE "= "pctspk.exe" [2004-01-30 02:33 C:\WINDOWS\system32\pctspk.exe]
    "EPSON Stylus Photo RX620 Series "= "C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9HA.exe" [2004-05-19 22:00]
    "NeroFilterCheck "= "C:\WINDOWS\system32\NeroCheck.exe" [2007-10-09 19:39]
    "InCD "= "C:\Program Files\Ahead\InCD\InCD.exe" []
    "QuickTime Task "= "C:\Program Files\QuickTime\qttask.exe" [2006-09-06 10:54]
    "TkBellExe "= "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2006-09-06 11:47]
    "iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [2006-06-14 16:24]
    "vptray "= "D:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe" [2002-08-28 14:12]
    "SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe" [2007-03-14 03:43]
    "LGODDFU "= "D:\Program Files\lg_fwupdate\fwupdate.exe" []
    "RemoteControl "= "D:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe" [2003-12-08 18:35]
    "Adobe Reader Speed Launcher "= "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 03:06]
    "!AVG Anti-Spyware "= "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 11:25]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:56]
    "BitTorrent "= "C:\Program Files\BitTorrent\bittorrent.exe" []
    "BitComet "= "D:\Program Files\BitLord\BitLord.exe" [2005-05-07 02:47]

    S3 SRS_SSCFilter;SRS Labs Audio Sandbox (WDM);C:\WINDOWS\system32\drivers\srs_sscfilter.sys

    .
    Contents of the 'Scheduled Tasks' folder
    "2004-07-12 11:21:14 C:\WINDOWS\Tasks\Windows Update.job "
    - C:\WINDOWS\system32\wupdmgr.exe
    .
    **************************************************************************

    catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-10-15 17:46:20
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2007-10-15 17:47:32
    C:\ComboFix2.txt ... 2007-10-13 20:16
    C:\ComboFix3.txt ... 2007-10-13 16:10
    .
    --- E O F ---


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 5:51:48 PM, on 10/15/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Ahead\InCD\InCDsrv.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\VTTimer.exe
    C:\WINDOWS\system32\RunDll32.exe
    C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9HA.EXE
    C:\Program Files\QuickTime\qttask.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    D:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
    C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe
    D:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe
    D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\WINDOWS\system32\ctfmon.exe
    D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    D:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    D:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\fxssvc.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\notepad.exe
    C:\WINDOWS\system32\mspaint.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Program Files\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [VTTimer] VTTimer.exe
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [PCTVOICE] pctspk.exe
    O4 - HKLM\..\Run: [EPSON Stylus Photo RX620 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATI9HA.EXE /P31 "EPSON Stylus Photo RX620 Series" /O6 "USB001" /M "Stylus Photo RX620 "
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [InCD] C:\Program Files\Ahead\InCD\InCD.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [vptray] D:\Program Files\Symantec_Client_Security\Symantec AntiVirus\vptray.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_01\bin\jusched.exe "
    O4 - HKLM\..\Run: [LGODDFU] "D:\Program Files\lg_fwupdate\fwupdate.exe "
    O4 - HKLM\..\Run: [RemoteControl] "D:\Program Files\CyberLink DVD Solution\PowerDVD\PDVDServ.exe "
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [BitTorrent] "C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
    O4 - HKCU\..\Run: [BitComet] "D:\Program Files\BitLord\BitLord.exe "
    O8 - Extra context menu item: &Google Search - res://c:\program files\google\GoogleToolbar2.dll/cmsearch.html
    O8 - Extra context menu item: &Translate English Word - res://c:\program files\google\GoogleToolbar2.dll/cmwordtrans.html
    O8 - Extra context menu item: Backward Links - res://c:\program files\google\GoogleToolbar2.dll/cmbacklinks.html
    O8 - Extra context menu item: Cached Snapshot of Page - res://c:\program files\google\GoogleToolbar2.dll/cmcache.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O8 - Extra context menu item: Similar Pages - res://c:\program files\google\GoogleToolbar2.dll/cmsimilar.html
    O8 - Extra context menu item: Translate Page into English - res://c:\program files\google\GoogleToolbar2.dll/cmtrans.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_01\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
    O16 - DPF: {41F17733-B041-4099-A042-B518BB6A408C} - http://appldnld.apple.com.edgesuite.net/qtinstall.info.apple.com/lupin/us/win/QuickTimeInstaller.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - D:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: DefWatch - Symantec Corporation - D:\Program Files\Symantec_Client_Security\Symantec AntiVirus\DefWatch.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: InCD Helper (InCDsrv) - Nero AG - C:\Program Files\Ahead\InCD\InCDsrv.exe
    O23 - Service: iPodService - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - D:\Program Files\Symantec_Client_Security\Symantec AntiVirus\Rtvscan.exe

    --
    End of file - 6551 bytes
     
    GregoryC,
    #11
  13. 2007/10/15
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Please post the contents of the log located at C:\QooBox\ComboFix-quarantined-files.txt
     
    noahdfear,
    #12
  14. 2007/10/16
    GregoryC

    GregoryC Inactive Thread Starter

    Joined:
    2007/10/12
    Messages:
    7
    Likes Received:
    0
    Here you go. BTW, the performance of bitlord (torrent download program) has slowed down quite a bit since we started changing things. I also performed updates to symantec antivirus and updated to windows SP2 right before I placing my first post. Would any of these things affect that? My first priority is to get virus free and restore any damage from the virus's. And Windows BBS may not get into stuff like that, just thought you might know what action may have affected it. Thanks again for all your help.

    Code:
    2007-04-09 21:21      0    --a------    C:\Qoobox\Quarantine\C\WINDOWS\Help\wshmcepts.chm.vir
2007-08-15 05:34      13380    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\vturssp.dll.vir
2007-08-15 11:41      124662    --a------    C:\Qoobox\Quarantine\C\Documents and Settings\Owner\Application Data\tmp3D.tmp.exe.vir
2007-08-16 12:51      124699    --a------    C:\Qoobox\Quarantine\C\Documents and Settings\Owner\Application Data\tmp10.tmp.exe.vir
2007-08-17 11:26      124679    --a------    C:\Qoobox\Quarantine\C\Documents and Settings\Owner\Application Data\tmp2CB.tmp.exe.vir
2007-08-17 11:27      64583    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\tmp2D3.tmp.dll.vir
2007-08-17 11:27      79609    --a------    C:\Qoobox\Quarantine\C\Documents and Settings\Owner\Application Data\tmp2D3.tmp.exe.vir
2007-09-03 18:31      124629    --a------    C:\Qoobox\Quarantine\C\Documents and Settings\Owner\Application Data\tmp4F.tmp.exe.vir
2007-09-04 15:54      64650    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\tmp84.tmp.dll.vir
2007-09-05 17:37      64558    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\tmp25.tmp.dll.vir
2007-09-05 17:37      79634    --a------    C:\Qoobox\Quarantine\C\Documents and Settings\Owner\Application Data\tmp25.tmp.exe.vir
2007-09-19 22:38      84992    --a------    C:\Qoobox\Quarantine\C\Documents and Settings\Owner\Application Data\tmp4.tmp.exe.vir
2007-10-02 19:02      67072    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\tmp35.tmp.dll.vir
2007-10-02 19:02      87040    --a------    C:\Qoobox\Quarantine\C\Documents and Settings\Owner\Application Data\tmp35.tmp.exe.vir
2007-10-09 22:26      77920    --a------    C:\Qoobox\Quarantine\C\Documents and Settings\Owner\Application Data\tmp1.tmp.exe.vir
2007-10-09 23:17      77920    --a------    C:\Qoobox\Quarantine\C\Documents and Settings\Owner\Application Data\tmp15.tmp.exe.vir
2007-10-09 23:21      77920    --a------    C:\Qoobox\Quarantine\C\Documents and Settings\Owner\Application Data\tmp1A.tmp.exe.vir
2007-10-10 07:39      77738    --a------    C:\Qoobox\Quarantine\C\Documents and Settings\Owner\Application Data\tmp6.tmp.exe.vir
2007-10-10 07:40      87040    --a------    C:\Qoobox\Quarantine\C\Documents and Settings\Owner\Application Data\tmpB.tmp.exe.vir
2007-10-12 17:38      106496    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\pmkjj.exe.vir
2007-10-12 17:38      88576    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\mousons.dll.vir
2007-10-12 21:00      350    --a------    C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At22.job.vir
2007-10-12 22:00      350    --a------    C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At23.job.vir
2007-10-12 23:00      350    --a------    C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At24.job.vir
2007-10-13 00:00      350    --a------    C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At1.job.vir
2007-10-13 01:00      350    --a------    C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At2.job.vir
2007-10-13 02:00      350    --a------    C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At3.job.vir
2007-10-13 03:00      350    --a------    C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At4.job.vir
2007-10-13 04:00      350    --a------    C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At5.job.vir
2007-10-13 05:00      350    --a------    C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At6.job.vir
2007-10-13 06:00      350    --a------    C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At7.job.vir
2007-10-13 07:00      350    --a------    C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At8.job.vir
2007-10-13 08:00      350    --a------    C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At9.job.vir
2007-10-13 09:00      350    --a------    C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At10.job.vir
2007-10-13 10:00      350    --a------    C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At11.job.vir
2007-10-13 11:00      350    --a------    C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At12.job.vir
2007-10-13 12:00      350    --a------    C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At13.job.vir
2007-10-13 13:00      350    --a------    C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At14.job.vir
2007-10-13 14:00      350    --a------    C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At15.job.vir
2007-10-13 15:00      350    --a------    C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At16.job.vir
2007-10-13 16:00      350    --a------    C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At17.job.vir
2007-10-13 16:02      3336    --a------    C:\Qoobox\Quarantine\Registry_backups\services_DomainService.reg.dat
2007-10-13 16:02      846    --a------    C:\Qoobox\Quarantine\Registry_backups\LEGACY_DOMAINSERVICE.reg.dat
2007-10-13 16:03      84403    --a------    C:\Qoobox\Quarantine\catchme2007-10-13_160640.56.zip
2007-10-13 16:06      105984    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\mllmn.exe.vir
2007-10-13 16:06      88576    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\dx7rch.dll.vir
2007-10-13 17:00      350    --a------    C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At18.job.vir
2007-10-13 18:00      350    --a------    C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At19.job.vir
2007-10-13 19:00      350    --a------    C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At20.job.vir
2007-10-13 20:00      350    --a------    C:\Qoobox\Quarantine\C\WINDOWS\Tasks\At21.job.vir
2007-10-13 20:02      53    --a------    C:\Qoobox\Quarantine\C\WINDOWS\system32\dn6ee7f4a0.dat.vir
2007-10-13 20:11      1044    --a------    C:\Qoobox\Quarantine\catchme2007-10-13_201334.98.zip
2007-10-13 20:11      468    --a------    C:\Qoobox\Quarantine\catchme.log


Folder PATH listing for volume DRV1_VOL1
Volume serial number is 6EE7-F4A0
C:\QOOBOX\QUARANTINE
|   catchme.log
|   catchme2007-10-13_160640.56.zip
|   catchme2007-10-13_201334.98.zip
|   
+---C
|   +---Documents and Settings
|   |   \---Owner
|   |       \---Application Data
|   |               tmp1.tmp.exe.vir
|   |               tmp10.tmp.exe.vir
|   |               tmp15.tmp.exe.vir
|   |               tmp1A.tmp.exe.vir
|   |               tmp25.tmp.exe.vir
|   |               tmp2CB.tmp.exe.vir
|   |               tmp2D3.tmp.exe.vir
|   |               tmp35.tmp.exe.vir
|   |               tmp3D.tmp.exe.vir
|   |               tmp4.tmp.exe.vir
|   |               tmp4F.tmp.exe.vir
|   |               tmp6.tmp.exe.vir
|   |               tmpB.tmp.exe.vir
|   |               
|   \---WINDOWS
|       +---Help
|       |       wshmcepts.chm.vir
|       |       
|       +---system32
|       |       dn6ee7f4a0.dat.vir
|       |       dx7rch.dll.vir
|       |       mllmn.exe.vir
|       |       mousons.dll.vir
|       |       pmkjj.exe.vir
|       |       tmp25.tmp.dll.vir
|       |       tmp2D3.tmp.dll.vir
|       |       tmp35.tmp.dll.vir
|       |       tmp84.tmp.dll.vir
|       |       vturssp.dll.vir
|       |       
|       \---Tasks
|               At1.job.vir
|               At10.job.vir
|               At11.job.vir
|               At12.job.vir
|               At13.job.vir
|               At14.job.vir
|               At15.job.vir
|               At16.job.vir
|               At17.job.vir
|               At18.job.vir
|               At19.job.vir
|               At2.job.vir
|               At20.job.vir
|               At21.job.vir
|               At22.job.vir
|               At23.job.vir
|               At24.job.vir
|               At3.job.vir
|               At4.job.vir
|               At5.job.vir
|               At6.job.vir
|               At7.job.vir
|               At8.job.vir
|               At9.job.vir
|               
\---Registry_backups
        LEGACY_DOMAINSERVICE.reg.dat
        services_DomainService.reg.dat
     
    GregoryC,
    #13
  15. 2007/10/16
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Please verify that the following file has been deleted.

    C:\Program Files\Common Files\Microsoft Shared\MSINFO\6EE7F4A0.dll

    Please start ComboFix again by double clicking the icon. At the Disclaimer screen, type 2 and hit Enter. This will uninstall ComboFix and remove the files and folders it created.

    Now, lets run an online scan to make sure we haven't missed something.
    Please do an online scan with Kaspersky WebScanner

    Click on Kaspersky Online Scanner

    You will be promted to install an ActiveX component from Kaspersky, Click Yes.
    • The program will launch and then begin downloading the latest definition files:
    • Once the files have been downloaded click on NEXT
    • Now click on Scan Settings
    • In the scan settings make that the following are selected:
      • Scan using the following Anti-Virus database:
      • Extended (if available otherwise Standard)
      • Scan Options:
      • Scan Archives
        Scan Mail Bases
    • Click OK
    • Now under select a target to scan:
      • Select My Computer
    • This will program will start and scan your system.
    • The scan will take a while so be patient and let it run.
    • Once the scan is complete it will display if your system has been infected.
      • Now click on the Save as Text button:
    • Save the file to your desktop.

    Post the Kaspersky log here.


    Quite frankly, since P2P file sharing applications such as Bit Torrent are known for spreading infections, which I spend a lot of my valuable time helping to remove, I don't help make those apps work properly. I'd much rather see them removed. ;)
     
    noahdfear,
    #14

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...