1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved persistent malware (keeps coming back)

Discussion in 'Malware and Virus Removal Archive' started by mtaffer, 2008/01/09.

  1. 2008/01/09
    mtaffer

    mtaffer Well-Known Member Thread Starter

    Joined:
    2006/10/20
    Messages:
    63
    Likes Received:
    0
    [Resolved] persistent malware (keeps coming back)

    I need some help. I spent about 5 hours last night trying to clean a machine that was infected with (among other things) Malware Crush and Ultimate Cleaner 2007. All appeared to be ok, but then I got a call today that everything was back and worse than ever.

    I have the softwarereferral.com browser hijack and the "windows has detected an Internet attack attempt download spyware remover, and had several new icons on the desktop.

    The only thing I can figure out is, I did not disable system restore...but there are actually new instances of malware today.

    Here is the log from safe mode

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 8:57:20 PM, on 1/9/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Safe mode with network support

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
    C:\Documents and Settings\All Users\Desktop\HiJackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
    R3 - Default URLSearchHook is missing
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe "
    O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKCU\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by106fd.bay106.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1155070753414
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1155080451402
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O21 - SSODL: bgntlvo - {5941D3F5-D636-4CE9-BD82-8C015D27988C} - C:\WINDOWS\bgntlvo.dll
    O21 - SSODL: asvdnmo - {76977719-DACD-4C0A-8A54-979EB0368790} - C:\WINDOWS\asvdnmo.dll
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe

    --
    End of file - 5685 bytes

    Thanks,
    mtaffer
     
    mtaffer,
    #1
  2. 2008/01/09
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Welcome to WindowsBBS mtaffer :)

    Please create the following log in normal mode. Download Deckard's System Scanner (dss.exe) and save it to your desktop.
    • Close all applications and windows.
    • Double click on dss.exe to run it and follow the prompts.
    • When the scan is complete, two text files will open; main.txt, which will be maximized and extra.txt, which will be minimized.
    Post the contents of main.txt only for now.


    Just for the record, the machine is more prone to becoming further infected while in safe mode with networking than in normal mode, due to the antivirus not running in safe mode.
     
    noahdfear,
    #2


  3. to hide this advert.

  4. 2008/01/10
    mtaffer

    mtaffer Well-Known Member Thread Starter

    Joined:
    2006/10/20
    Messages:
    63
    Likes Received:
    0
    here is the deckard log

    Thanks!

    Deckard's System Scanner v20071014.68
    Run by ronald on 2008-01-10 20:22:42
    Computer is in Normal Mode.
    --------------------------------------------------------------------------------

    -- System Restore --------------------------------------------------------------

    System Restore is disabled; attempting to re-enable...success.


    -- Last 1 Restore Point(s) --
    1: 2008-01-11 02:22:48 UTC - RP1 - System Checkpoint


    Backed up registry hives.
    Performed disk cleanup.



    -- HijackThis (run as ronald.exe) ----------------------------------------------

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 8:24:40 PM, on 1/10/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
    C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\BroadJump\Client Foundation\CFD.exe
    C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\PROGRA~1\Grisoft\AVG7\avgcc.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe
    C:\PROGRA~1\Magentic\bin\MgApp.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\WINDOWS\runservice.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\explorer.exe
    C:\Documents and Settings\ronald\Desktop\dss.exe
    C:\WINDOWS\system32\taskmgr.exe
    C:\DOCUME~1\ronald\Desktop\ronald.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe "
    O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [Magentic] C:\PROGRA~1\Magentic\bin\Magentic.exe /c
    O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    O4 - HKCU\..\Run: [XP Antivirus] C:\Program Files\XP Antivirus\xpantiviruspro.exe
    O4 - HKCU\..\Run: [SysCleaner] "C:\Program Files\SysCleaner\SysCleaner.exe" hide
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by106fd.bay106.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1155070753414
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1155080451402
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O21 - SSODL: asvdnmo - {D58F0AE9-DAF4-485E-82D3-2844D27F7D7C} - C:\WINDOWS\asvdnmo.dll
    O21 - SSODL: bgntlvo - {7EAC1949-6A2E-473A-ADF7-346569B085DA} - C:\WINDOWS\bgntlvo.dll
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe

    --
    End of file - 7222 bytes

    -- HijackThis Fixed Entries (C:\DOCUME~1\ronald\Desktop\backups\) --------------

    backup-20080108-230413-266 O20 - Winlogon Notify: bcabbddccfacdfb - C:\WINDOWS\system32\bcabbddccfacdfb.dll (file missing)
    backup-20080108-233405-468 O2 - BHO: Simple Search Assistant - {0391AAD0-AB5A-4338-B6DC-BB8405EB1C58} - C:\WINDOWS\system32\ssa.dll
    backup-20080109-201246-331 O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    backup-20080109-201249-442 O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    backup-20080109-201249-799 O16 - DPF: {B1E2B96C-12FE-45E2-BEF1-44A219113CDD} (SABScanProcesses Class) - http://www.superadblocker.com/activex/sabspx.cab
    backup-20080109-201250-765 O20 - Winlogon Notify: drmvocma - C:\WINDOWS\system32\drmvocma.dll (file missing)
    backup-20080109-201250-835 O21 - SSODL: bgntlvo - {804CE20B-7B02-47BE-8E22-184B1A65757D} - C:\WINDOWS\bgntlvo.dll
    backup-20080109-201250-928 O21 - SSODL: asvdnmo - {7B778CCA-21A3-4FE9-9C05-F5FE3EB4AB93} - C:\WINDOWS\asvdnmo.dll
    backup-20080109-201250-950 O20 - AppInit_DLLs: slbrusrs.dll confbrw.dll brwstat.dll C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
    backup-20080109-201251-246 O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe
    backup-20080109-201251-908 O24 - Desktop Component 0: Privacy Protection - file:///C:\WINDOWS\privacy_danger\index.htm
    backup-20080109-201251-915 O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    backup-20080109-212648-122 O21 - SSODL: bgntlvo - {5941D3F5-D636-4CE9-BD82-8C015D27988C} - C:\WINDOWS\bgntlvo.dll
    backup-20080109-212648-254 R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://softwarereferral.com/jump.php?wmid=6010&mid=MjI6Ojg5&lid=2
    backup-20080109-212648-276 O21 - SSODL: asvdnmo - {76977719-DACD-4C0A-8A54-979EB0368790} - C:\WINDOWS\asvdnmo.dll
    backup-20080109-212648-859 O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe

    -- File Associations -----------------------------------------------------------

    All associations okay.


    -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

    R1 SASDIFSV - c:\program files\superantispyware\sasdifsv.sys
    R1 SASKUTIL - c:\program files\superantispyware\saskutil.sys
    R2 LBeepKE - c:\windows\system32\drivers\lbeepke.sys <Not Verified; Logitech Inc.; Logitech SetPoint>
    R3 SASENUM - c:\program files\superantispyware\sasenum.sys <Not Verified; SuperAdBlocker, Inc.; SuperAntiSpyware>

    S3 SABProcEnum - c:\program files\internet explorer\sabprocenum.sys (file missing)


    -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

    R2 LicCtrlService (LicCtrl Service) - c:\windows\runservice.exe


    -- Device Manager: Disabled ----------------------------------------------------

    Class GUID: {4D36E97E-E325-11CE-BFC1-08002BE10318}
    Description: USB Host To Host Bridge
    Device ID: USB\VID_05E3&PID_0502\5&5AB336B&0&2
    Manufacturer:
    Name: USB Host To Host Bridge
    PNP Device ID: USB\VID_05E3&PID_0502\5&5AB336B&0&2
    Service:


    -- Scheduled Tasks -------------------------------------------------------------

    2008-01-10 20:05:04 256 --a------ C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job
    2008-01-05 21:11:02 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
    2007-02-27 18:58:58 402 --ah----- C:\WINDOWS\Tasks\MP Scheduled Quick Scan.job
    2006-11-24 19:20:19 344 --a------ C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1155140818.job


    -- Files created between 2007-12-10 and 2008-01-10 -----------------------------

    2008-01-10 15:25:38 0 d-------- C:\Documents and Settings\ronald\Application Data\SysCleaner
    2008-01-10 15:14:34 0 d-------- C:\Program Files\XP Antivirus
    2008-01-10 08:23:01 0 dr-h----- C:\Documents and Settings\ronald\Recent
    2008-01-09 20:41:21 0 d-------- C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com
    2008-01-09 20:25:27 0 d-------- C:\Documents and Settings\Administrator\Application Data\Macromedia
    2008-01-09 20:25:27 0 d-------- C:\Documents and Settings\Administrator\Application Data\Adobe
    2008-01-09 20:24:16 0 d-------- C:\Documents and Settings\Administrator\Application Data\Mozilla
    2008-01-09 08:53:14 1158 --a------ C:\WINDOWS\mozver.dat
    2008-01-08 22:47:36 0 dr-h----- C:\$VAULT$.AVG
    2008-01-08 22:44:07 0 d-------- C:\Documents and Settings\ronald\Application Data\AVG7
    2008-01-08 22:43:50 0 d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
    2008-01-08 22:29:17 0 d-------- C:\Documents and Settings\ronald\Application Data\Grisoft
    2008-01-08 22:28:52 0 d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2008-01-08 22:23:19 0 d-------- C:\Program Files\EsetOnlineScanner
    2008-01-08 21:04:12 0 d--hs---- C:\WINDOWS\CSC
    2008-01-08 20:00:36 0 --a------ C:\WINDOWS\nsreg.dat
    2008-01-08 20:00:31 0 d-------- C:\Documents and Settings\ronald\Application Data\Mozilla
    2008-01-08 15:41:36 0 d-------- C:\Program Files\RogueRemover FREE
    2008-01-07 18:15:15 1291662 --a------ C:\Install
    2008-01-07 18:11:42 0 d-------- C:\Program Files\SysCleaner
    2008-01-07 18:09:34 0 d-------- C:\Program Files\AdwareRemover2007
    2008-01-07 16:46:01 0 d-------- C:\Documents and Settings\ronald\Application Data\SecurePCCleaner
    2008-01-07 16:40:59 0 d-------- C:\Documents and Settings\All Users\Application Data\SecurePCCleaner
    2008-01-07 16:40:58 0 d-------- C:\Program Files\Common Files\SecurePCCleaner
    2008-01-07 09:01:31 0 d--hs---- C:\TrustedAntivirus
    2008-01-07 09:01:06 0 dr------- C:\Documents and Settings\All Users\Application Data\SalesMon
    2008-01-07 08:32:09 81920 --a------ C:\WINDOWS\fqwmwdn.exe
    2008-01-07 08:32:09 217088 --a------ C:\WINDOWS\bgntlvo.dll
    2008-01-07 08:32:09 200704 --a------ C:\WINDOWS\asvdnmo.dll <Not Verified; ; asvdnmo>
    2008-01-07 08:31:36 0 d-------- C:\Program Files\MediaStarCodec
    2007-12-13 17:50:43 0 d-------- C:\Program Files\Windows Live Toolbar


    -- Find3M Report ---------------------------------------------------------------

    2008-01-09 21:30:31 697 --ahs---- C:\WINDOWS\system32\mmf.sys
    2008-01-09 20:42:15 0 d-------- C:\Program Files\SUPERAntiSpyware
    2008-01-09 20:32:22 2598 --a------ C:\WINDOWS\system32\tmp.reg
    2008-01-09 08:53:30 0 d-------- C:\Documents and Settings\ronald\Application Data\Adobe
    2008-01-08 19:53:44 0 d-------- C:\Documents and Settings\ronald\Application Data\MSN6
    2008-01-07 16:40:58 0 d-------- C:\Program Files\Common Files
    2008-01-07 11:31:13 2174 --a------ C:\Documents and Settings\ronald\Application Data\update.log
    2007-12-13 21:44:13 0 d-------- C:\Program Files\Java


    -- Registry Dump ---------------------------------------------------------------

    *Note* empty entries & legit default entries are not shown


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ATICCC "= "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [05/10/2006 09:12 AM]
    "Google Desktop Search "= "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [08/01/2007 08:35 PM]
    "iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [10/30/2006 08:36 AM]
    "BJCFD "= "C:\Program Files\BroadJump\Client Foundation\CFD.exe" [09/10/2002 07:26 PM]
    "QuickTime Task "= "C:\Program Files\QuickTime\QTTask.exe" [06/29/2007 05:24 AM]
    "Adobe Reader Speed Launcher "= "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [10/10/2007 07:51 PM]
    "SunJavaUpdateSched "= "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" [10/12/2006 02:10 AM]
    "!AVG Anti-Spyware "= "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [06/11/2007 03:25 AM]
    "AVG7_CC "= "C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [01/08/2008 10:43 PM]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 01:56 AM]
    "swg "= "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [06/17/2007 12:26 PM]
    "Magentic "= "C:\PROGRA~1\Magentic\bin\Magentic.exe" [03/29/2007 10:22 AM]
    "SUPERAntiSpyware "= "C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [08/02/2007 06:29 AM]
    "XP Antivirus "= "C:\Program Files\XP Antivirus\xpantiviruspro.exe" [01/10/2008 03:14 PM]
    "SysCleaner "= "C:\Program Files\SysCleaner\SysCleaner.exe" [01/10/2008 03:25 PM]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
    "DisableRegistryTools "=0 (0x0)

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [12/20/2006 12:55 PM 77824]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
    "asvdnmo "= {D58F0AE9-DAF4-485E-82D3-2844D27F7D7C} - C:\WINDOWS\asvdnmo.dll [01/07/2008 04:44 AM 200704]
    "bgntlvo "= {7EAC1949-6A2E-473A-ADF7-346569B085DA} - C:\WINDOWS\bgntlvo.dll [01/07/2008 04:45 AM 217088]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 04/19/2007 12:41 PM 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
    @= "Volume shadow copy "

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp psc 1000 series.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hp psc 1000 series.lnk
    backup=C:\WINDOWS\pss\hp psc 1000 series.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hpoddt01.exe.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk
    backup=C:\WINDOWS\pss\hpoddt01.exe.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^KODAK Picture Transfer Software.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\KODAK Picture Transfer Software.lnk
    backup=C:\WINDOWS\pss\KODAK Picture Transfer Software.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^KODAK Software Updater.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\KODAK Software Updater.lnk
    backup=C:\WINDOWS\pss\KODAK Software Updater.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk
    backup=C:\WINDOWS\pss\Logitech SetPoint.lnkCommon Startup


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe /STARTUP

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\brwdiag]
    C:\WINDOWS\system32\brwconf.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Canyon3D2]
    RunDll32 essprops.cpl,TaskbarIconWnd

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
    C:\WINDOWS\system32\ctfmon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IncrediMail]
    C:\Program Files\IncrediMail\bin\IncMail.exe /c

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]
    KHALMNPR.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
    "C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE "

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
    Logi_MwX.Exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
    "C:\Program Files\Messenger\msmsgs.exe" /background

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe "




    -- End of Deckard's System Scanner: finished at 2008-01-10 20:26:49 ------------


    Thanks,
    mtaffer
     
    mtaffer,
    #3
  5. 2008/01/10
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Download SmitfraudFix by S!Ri, saving it to the desktop.

    • Restart the computer in Safe Mode by tapping the F8 key upon startup and selecting Safe Mode from the Advanced Startup Menu. Logon to your account.
    • Double-click SmitfraudFix.exe to start the tool and press 2, then hit Enter.
    • You will be prompted 'Do you want to clean the registry?' answer Y (yes) and hit Enter.
    • If prompted to replace the infected wininet.dll file (if found), answer Y (yes) and hit Enter to restore a clean file.
    • Reboot to normal mode when the tool completes.

    Post the contents of C:\rapport.txt


    Once you have that done, download ComboFix by sUBs from here, saving the file to your desktop.

    It's best disable realtime protection applications as they sometime interfere with the tool. Check this link for your applicable programs.

    • Close all open programs and windows
    • Double click combofix.exe and follow the prompts.
    • It may reboot your computer and resume running when you logon. Wait for it to complete. When finished, it will open a log for you. Post that log and a new HijackThis log in your next reply.
    Note: Do not mouseclick combofix's window while its running. That may cause it to stall

    Note - Your internet connection will be terminated while ComboFix runs. Do Not attempt to re-enable it. Should ComboFix terminate prematurely or your internet does not connect afterward, restart the computer to restore connectivity.
     
    noahdfear,
    #4
  6. 2008/01/10
    mtaffer

    mtaffer Well-Known Member Thread Starter

    Joined:
    2006/10/20
    Messages:
    63
    Likes Received:
    0
    here are the logs you requested in order

    rapport.txt

    SmitFraudFix v2.274

    Scan done at 21:20:12.90, Thu 01/10/2008
    Run from C:\Documents and Settings\ronald\Desktop\SmitfraudFix
    OS: Microsoft Windows XP [Version 5.1.2600] - Windows_NT
    The filesystem type is NTFS
    Fix run in safe mode

    »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler Before SmitFraudFix
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll

    »»»»»»»»»»»»»»»»»»»»»»»» Killing process


    »»»»»»»»»»»»»»»»»»»»»»»» hosts


    127.0.0.1 localhost

    »»»»»»»»»»»»»»»»»»»»»»»» Winsock2 Fix

    S!Ri's WS2Fix: LSP not Found.


    »»»»»»»»»»»»»»»»»»»»»»»» Generic Renos Fix

    GenericRenosFix by S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» Deleting infected files

    C:\DOCUME~1\ronald\Desktop\Error Cleaner.url Deleted
    C:\DOCUME~1\ronald\Desktop\Privacy Protector.url Deleted
    C:\DOCUME~1\ronald\Desktop\Spyware?Malware Protection.url Deleted
    C:\DOCUME~1\ronald\FAVORI~1\Error Cleaner.url Deleted
    C:\DOCUME~1\ronald\FAVORI~1\Privacy Protector.url Deleted
    C:\DOCUME~1\ronald\FAVORI~1\Spyware?Malware Protection.url Deleted

    »»»»»»»»»»»»»»»»»»»»»»»» IEDFix

    IEDFix.exe by S!Ri


    »»»»»»»»»»»»»»»»»»»»»»»» DNS

    HKLM\SYSTEM\CCS\Services\Tcpip\..\{12C45106-D432-4218-A555-F388DA740A21}: DhcpNameServer=192.168.1.254
    HKLM\SYSTEM\CS2\Services\Tcpip\..\{12C45106-D432-4218-A555-F388DA740A21}: DhcpNameServer=192.168.1.254
    HKLM\SYSTEM\CS3\Services\Tcpip\..\{12C45106-D432-4218-A555-F388DA740A21}: DhcpNameServer=192.168.1.254
    HKLM\SYSTEM\CCS\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.254
    HKLM\SYSTEM\CS2\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.254
    HKLM\SYSTEM\CS3\Services\Tcpip\Parameters: DhcpNameServer=192.168.1.254


    »»»»»»»»»»»»»»»»»»»»»»»» Deleting Temp Files


    »»»»»»»»»»»»»»»»»»»»»»»» Winlogon.System
    !!!Attention, following keys are not inevitably infected!!!

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon]
    "System "=" "


    »»»»»»»»»»»»»»»»»»»»»»»» Registry Cleaning

    Registry Cleaning done.

    »»»»»»»»»»»»»»»»»»»»»»»» SharedTaskScheduler After SmitFraudFix
    !!!Attention, following keys are not inevitably infected!!!

    SrchSTS.exe by S!Ri
    Search SharedTaskScheduler's .dll


    »»»»»»»»»»»»»»»»»»»»»»»» End


    Combofix log

    ComboFix 08-01-10.2 - ronald 2008-01-10 21:38:42.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.208 [GMT -6:00]
    Running from: C:\Documents and Settings\ronald\Desktop\ComboFix.exe
    * Created a new restore point
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\asvdnmo.dll
    C:\WINDOWS\bgntlvo.dll
    C:\WINDOWS\dat.txt
    C:\WINDOWS\fqwmwdn.exe
    C:\WINDOWS\rs.txt
    C:\WINDOWS\search_res.txt

    .
    ((((((((((((((((((((((((( Files Created from 2007-12-11 to 2008-01-11 )))))))))))))))))))))))))))))))
    .

    2008-01-10 21:38 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
    2008-01-10 20:22 . 2008-01-10 20:22 <DIR> d-------- C:\Deckard
    2008-01-10 15:36 . 2008-01-10 15:36 0 --a------ C:\Program Filesxpantiviruspro.exe.tmp
    2008-01-10 15:25 . 2008-01-10 15:25 <DIR> d-------- C:\Documents and Settings\ronald\Application Data\SysCleaner
    2008-01-10 15:14 . 2008-01-10 15:27 <DIR> d-------- C:\Program Files\XP Antivirus
    2008-01-09 20:41 . 2008-01-09 20:41 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com
    2008-01-09 08:53 . 2008-01-09 08:53 1,158 --a------ C:\WINDOWS\mozver.dat
    2008-01-08 22:44 . 2008-01-08 22:49 <DIR> d-------- C:\Documents and Settings\ronald\Application Data\AVG7
    2008-01-08 22:43 . 2008-01-08 22:43 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
    2008-01-08 22:29 . 2008-01-08 22:29 <DIR> d-------- C:\Documents and Settings\ronald\Application Data\Grisoft
    2008-01-08 22:28 . 2008-01-08 22:43 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2008-01-08 22:28 . 2007-05-30 06:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2008-01-08 22:23 . 2008-01-08 22:25 <DIR> d-------- C:\Program Files\EsetOnlineScanner
    2008-01-08 20:00 . 2008-01-08 20:00 0 --a------ C:\WINDOWS\nsreg.dat
    2008-01-08 15:41 . 2008-01-09 20:30 <DIR> d-------- C:\Program Files\RogueRemover FREE
    2008-01-07 18:15 . 2008-01-07 18:15 1,291,662 --a------ C:\Install
    2008-01-07 18:11 . 2008-01-10 15:25 <DIR> d-------- C:\Program Files\SysCleaner
    2008-01-07 18:09 . 2008-01-07 18:09 <DIR> d-------- C:\Program Files\AdwareRemover2007
    2008-01-07 16:46 . 2008-01-07 16:46 <DIR> d-------- C:\Documents and Settings\ronald\Application Data\SecurePCCleaner
    2008-01-07 16:40 . 2008-01-08 13:07 <DIR> d-------- C:\Program Files\Common Files\SecurePCCleaner
    2008-01-07 16:40 . 2008-01-07 16:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SecurePCCleaner
    2008-01-07 09:01 . 2008-01-07 09:01 <DIR> d--hs---- C:\TrustedAntivirus
    2008-01-07 09:01 . 2008-01-07 09:01 <DIR> dr------- C:\Documents and Settings\All Users\Application Data\SalesMon
    2008-01-07 09:00 . 2004-10-07 13:39 1,060,864 --a------ C:\WINDOWS\system32\mfc71.dll
    2008-01-07 09:00 . 2004-10-07 13:39 89,088 --a------ C:\WINDOWS\system32\atl71.dll
    2008-01-07 09:00 . 2001-03-08 18:30 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll
    2008-01-07 08:31 . 2008-01-07 08:31 <DIR> d-------- C:\Program Files\MediaStarCodec
    2007-12-13 21:46 . 2007-12-13 21:46 230 --a------ C:\WINDOWS\system32\spupdsvc.inf
    2007-12-13 17:50 . 2007-12-13 17:50 <DIR> d-------- C:\Program Files\Windows Live Toolbar

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-01-11 03:33 --------- d-----w C:\Program Files\SUPERAntiSpyware
    2008-01-09 04:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avg7
    2008-01-09 01:53 --------- d-----w C:\Documents and Settings\ronald\Application Data\MSN6
    2007-12-14 03:44 --------- d-----w C:\Program Files\Java
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:56 15360]
    "swg "= "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-17 12:26 68856]
    "Magentic "= "C:\PROGRA~1\Magentic\bin\Magentic.exe" [2007-03-29 10:22 462892]
    "SUPERAntiSpyware "= "C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-08-02 06:29 1318912]
    "XP Antivirus "= "C:\Program Files\XP Antivirus\xpantiviruspro.exe" [2008-01-10 15:14 494592]
    "SysCleaner "= "C:\Program Files\SysCleaner\SysCleaner.exe" [2008-01-10 15:25 1282048]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ATICCC "= "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 09:12 90112]
    "Google Desktop Search "= "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-08-01 20:35 1836544]
    "iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 08:36 256576]
    "BJCFD "= "C:\Program Files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 19:26 368706]
    "QuickTime Task "= "C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 05:24 286720]
    "Adobe Reader Speed Launcher "= "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
    "SunJavaUpdateSched "= "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 02:10 49263]
    "AVG7_CC "= "C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-08 22:43 579072]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "AVG7_Run "= "C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-08 22:43 219136]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp psc 1000 series.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hp psc 1000 series.lnk
    backup=C:\WINDOWS\pss\hp psc 1000 series.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hpoddt01.exe.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk
    backup=C:\WINDOWS\pss\hpoddt01.exe.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^KODAK Picture Transfer Software.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\KODAK Picture Transfer Software.lnk
    backup=C:\WINDOWS\pss\KODAK Picture Transfer Software.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^KODAK Software Updater.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\KODAK Software Updater.lnk
    backup=C:\WINDOWS\pss\KODAK Software Updater.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk
    backup=C:\WINDOWS\pss\Logitech SetPoint.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\brwdiag]
    C:\WINDOWS\system32\brwconf.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Canyon3D2]
    -ra------ 2001-07-23 15:19 306647 C:\WINDOWS\system32\essprops.cpl

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
    --a------ 2004-08-04 01:56 15360 C:\WINDOWS\system32\ctfmon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IncrediMail]
    --a------ 2006-12-07 14:11 204843 C:\Program Files\IncrediMail\bin\IncMail.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]
    --a------ 2006-07-19 11:03 94208 C:\WINDOWS\KHALMNPR.Exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
    --a------ 2006-07-19 11:03 94208 C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
    --------- 2003-12-17 08:50 19968 C:\WINDOWS\LOGI_MWX.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
    ---hs---- 2004-10-13 10:24 1694208 C:\Program Files\Messenger\msmsgs.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    --a------ 2006-10-12 02:10 49263 C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe

    R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys [2006-02-23 10:38]
    R2 LBeepKE;LBeepKE;C:\WINDOWS\system32\Drivers\LBeepKE.sys [2006-09-01 11:32]
    R2 LicCtrlService;LicCtrl Service;C:\WINDOWS\runservice.exe [2006-09-03 17:29]
    S3 Camdrv30;Philips ToUcam XS;C:\WINDOWS\system32\Drivers\camdrv30.sys [2001-08-17 08:04]

    *Newly Created Service* - PROCEXP90
    .
    Contents of the 'Scheduled Tasks' folder
    "2008-01-06 03:11:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job "
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    "2008-01-11 03:05:00 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job "
    - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
    "2006-11-25 01:20:19 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1155140818.job "
    - C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe4-I
    "2007-02-28 00:58:58 C:\WINDOWS\Tasks\MP Scheduled Quick Scan.job "
    - C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MpCmdRun.exe%Scan -RestrictPrivileges -ScanType 1
    .
    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-01-10 21:40:40
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-01-10 21:41:28
    ComboFix-quarantined-files.txt 2008-01-11 03:41:13


    New HijackThis log

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:44:03 PM, on 1/10/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\BroadJump\Client Foundation\CFD.exe
    C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
    C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\XP Antivirus\xpantiviruspro.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\WINDOWS\runservice.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\WINDOWS\explorer.exe
    C:\Documents and Settings\ronald\Desktop\HiJackThis.exe

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe "
    O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [Magentic] C:\PROGRA~1\Magentic\bin\Magentic.exe /c
    O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    O4 - HKCU\..\Run: [XP Antivirus] C:\Program Files\XP Antivirus\xpantiviruspro.exe
    O4 - HKCU\..\Run: [SysCleaner] "C:\Program Files\SysCleaner\SysCleaner.exe" hide
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by106fd.bay106.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1155070753414
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1155080451402
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe

    --
    End of file - 6578 bytes

    Thanks again
    mtaffer
     
    mtaffer,
    #5
  7. 2008/01/10
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Highlight and copy the contents of the code box below and paste it into a blank notepad, then save it to your desktop as;

    Filename: CFScript.txt
    Save As Type: All Files (*.*)

    Code:
    File::
C:\Program Filesxpantiviruspro.exe.tmp
C:\Install
Folder::
C:\Documents and Settings\ronald\Application Data\SysCleaner
C:\Program Files\XP Antivirus
C:\Program Files\SysCleaner
C:\Program Files\AdwareRemover2007
C:\Documents and Settings\ronald\Application Data\SecurePCCleaner
C:\Program Files\Common Files\SecurePCCleaner
C:\Documents and Settings\All Users\Application Data\SecurePCCleaner
C:\TrustedAntivirus
C:\Documents and Settings\All Users\Application Data\SalesMon
C:\Program Files\MediaStarCodec
Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
 "XP Antivirus "=-
 "SysCleaner "=-
    Close all other windows and programs. Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log.

    Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.
     
    noahdfear,
    #6
  8. 2008/01/11
    mtaffer

    mtaffer Well-Known Member Thread Starter

    Joined:
    2006/10/20
    Messages:
    63
    Likes Received:
    0
    Combofix Log

    Here is the log that was created. :)

    ComboFix 08-01-10.2 - ronald 2008-01-11 9:40:56.2 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.177 [GMT -6:00]
    Running from: C:\Documents and Settings\ronald\Desktop\ComboFix.exe
    Command switches used :: C:\Documents and Settings\ronald\Desktop\CFScript.txt
    * Created a new restore point

    FILE
    C:\Install
    C:\Program Filesxpantiviruspro.exe.tmp
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Documents and Settings\All Users\Application Data\SalesMon
    C:\Documents and Settings\All Users\Application Data\SecurePCCleaner
    C:\Documents and Settings\All Users\Application Data\SecurePCCleaner\Abbr
    C:\Documents and Settings\All Users\Application Data\SecurePCCleaner\ProdCode
    C:\Documents and Settings\ronald\Application Data\SecurePCCleaner
    C:\Documents and Settings\ronald\Application Data\SecurePCCleaner\Logs\update.log
    C:\Documents and Settings\ronald\Application Data\SysCleaner
    C:\Documents and Settings\ronald\Application Data\SysCleaner\settings.dat
    C:\Install
    C:\Program Files\AdwareRemover2007
    C:\Program Files\AdwareRemover2007\AdwareRemover2007.exe
    C:\Program Files\AdwareRemover2007\AdwareRemover2007.lic
    C:\Program Files\AdwareRemover2007\AdwareRemover20070.ar
    C:\Program Files\AdwareRemover2007\AdwareRemover20071.ar
    C:\Program Files\AdwareRemover2007\Uninstall.exe
    C:\Program Files\Common Files\SecurePCCleaner
    C:\Program Files\MediaStarCodec
    C:\Program Files\MediaStarCodec\install.ico
    C:\Program Files\MediaStarCodec\MediaStarCodec.ocx
    C:\Program Files\MediaStarCodec\Uninstall.exe
    C:\Program Files\SysCleaner
    C:\Program Files\SysCleaner\com\scsdelete.dll
    C:\Program Files\SysCleaner\program.info
    C:\Program Files\SysCleaner\SysCleaner.db
    C:\Program Files\SysCleaner\SysCleaner.exe
    C:\Program Files\SysCleaner\SysCleaner.pkg
    C:\Program Files\SysCleaner\Uninstall.exe
    C:\Program Files\XP Antivirus
    C:\Program Files\XP Antivirus\xpantiviruspro.exe
    C:\Program Files\XP Antivirus\xpantiviruspro.exe.tmp
    C:\Program Filesxpantiviruspro.exe.tmp
    C:\TrustedAntivirus

    .
    ((((((((((((((((((((((((( Files Created from 2007-12-11 to 2008-01-11 )))))))))))))))))))))))))))))))
    .

    2008-01-11 09:37 . 2004-08-04 02:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
    2008-01-11 08:26 . 2004-08-04 01:58 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
    2008-01-11 08:26 . 2004-08-04 01:58 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys
    2008-01-10 21:38 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
    2008-01-10 20:22 . 2008-01-10 20:22 <DIR> d-------- C:\Deckard
    2008-01-09 20:41 . 2008-01-09 20:41 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\SUPERAntiSpyware.com
    2008-01-09 08:53 . 2008-01-09 08:53 1,158 --a------ C:\WINDOWS\mozver.dat
    2008-01-08 22:44 . 2008-01-08 22:49 <DIR> d-------- C:\Documents and Settings\ronald\Application Data\AVG7
    2008-01-08 22:43 . 2008-01-08 22:43 <DIR> d-------- C:\Documents and Settings\LocalService\Application Data\AVG7
    2008-01-08 22:29 . 2008-01-08 22:29 <DIR> d-------- C:\Documents and Settings\ronald\Application Data\Grisoft
    2008-01-08 22:28 . 2008-01-08 22:43 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2008-01-08 22:28 . 2007-05-30 06:10 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2008-01-08 22:23 . 2008-01-08 22:25 <DIR> d-------- C:\Program Files\EsetOnlineScanner
    2008-01-08 20:00 . 2008-01-08 20:00 0 --a------ C:\WINDOWS\nsreg.dat
    2008-01-08 15:41 . 2008-01-09 20:30 <DIR> d-------- C:\Program Files\RogueRemover FREE
    2008-01-07 09:00 . 2004-10-07 13:39 1,060,864 --a------ C:\WINDOWS\system32\mfc71.dll
    2008-01-07 09:00 . 2004-10-07 13:39 89,088 --a------ C:\WINDOWS\system32\atl71.dll
    2008-01-07 09:00 . 2001-03-08 18:30 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll
    2007-12-13 21:46 . 2007-12-13 21:46 230 --a------ C:\WINDOWS\system32\spupdsvc.inf
    2007-12-13 17:50 . 2007-12-13 17:50 <DIR> d-------- C:\Program Files\Windows Live Toolbar

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-01-11 03:33 --------- d-----w C:\Program Files\SUPERAntiSpyware
    2008-01-09 04:49 --------- d-----w C:\Documents and Settings\All Users\Application Data\Avg7
    2008-01-09 01:53 --------- d-----w C:\Documents and Settings\ronald\Application Data\MSN6
    2007-12-14 03:44 --------- d-----w C:\Program Files\Java
    .

    ((((((((((((((((((((((((((((( snapshot@2008-01-10_21.40.49.03 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2008-01-11 03:38:27 233,472 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT
    + 2008-01-11 15:40:50 233,472 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000001\NTUSER.DAT
    - 2008-01-11 03:38:27 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat
    + 2008-01-11 15:40:50 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000002\UsrClass.dat
    - 2008-01-11 03:38:27 3,866,624 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\NTUSER.DAT
    + 2008-01-11 15:40:50 233,472 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000003\NTUSER.DAT
    - 2008-01-11 03:38:27 106,496 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat
    + 2008-01-11 15:40:50 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000004\UsrClass.dat
    - 2008-01-11 03:38:27 233,472 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\NTUSER.DAT
    + 2008-01-11 15:40:51 3,866,624 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000005\NTUSER.DAT
    - 2008-01-11 03:38:27 8,192 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat
    + 2008-01-11 15:40:51 106,496 ----a-w C:\WINDOWS\ERDNT\Hiv-backup\Users\00000006\UsrClass.dat
    + 2004-08-04 08:08:46 26,496 ----a-w C:\WINDOWS\system32\drivers\USBSTOR.SYS
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 01:56 15360]
    "swg "= "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-06-17 12:26 68856]
    "Magentic "= "C:\PROGRA~1\Magentic\bin\Magentic.exe" [2007-03-29 10:22 462892]
    "SUPERAntiSpyware "= "C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-08-02 06:29 1318912]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ATICCC "= "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe" [2006-05-10 09:12 90112]
    "Google Desktop Search "= "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" [2007-08-01 20:35 1836544]
    "iTunesHelper "= "C:\Program Files\iTunes\iTunesHelper.exe" [2006-10-30 08:36 256576]
    "BJCFD "= "C:\Program Files\BroadJump\Client Foundation\CFD.exe" [2002-09-10 19:26 368706]
    "QuickTime Task "= "C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 05:24 286720]
    "Adobe Reader Speed Launcher "= "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
    "SunJavaUpdateSched "= "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 02:10 49263]
    "AVG7_CC "= "C:\PROGRA~1\Grisoft\AVG7\avgcc.exe" [2008-01-08 22:43 579072]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "AVG7_Run "= "C:\PROGRA~1\Grisoft\AVG7\avgw.exe" [2008-01-08 22:43 219136]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
    "{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} "= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 12:55 77824]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
    C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 12:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hp psc 1000 series.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hp psc 1000 series.lnk
    backup=C:\WINDOWS\pss\hp psc 1000 series.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^hpoddt01.exe.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\hpoddt01.exe.lnk
    backup=C:\WINDOWS\pss\hpoddt01.exe.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^KODAK Picture Transfer Software.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\KODAK Picture Transfer Software.lnk
    backup=C:\WINDOWS\pss\KODAK Picture Transfer Software.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^KODAK Software Updater.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\KODAK Software Updater.lnk
    backup=C:\WINDOWS\pss\KODAK Software Updater.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk
    backup=C:\WINDOWS\pss\Logitech SetPoint.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AVG7_CC]
    C:\PROGRA~1\Grisoft\AVGFRE~1\avgcc.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\brwdiag]
    C:\WINDOWS\system32\brwconf.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Canyon3D2]
    -ra------ 2001-07-23 15:19 306647 C:\WINDOWS\system32\essprops.cpl

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
    --a------ 2004-08-04 01:56 15360 C:\WINDOWS\system32\ctfmon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IncrediMail]
    --a------ 2006-12-07 14:11 204843 C:\Program Files\IncrediMail\bin\IncMail.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]
    --a------ 2006-07-19 11:03 94208 C:\WINDOWS\KHALMNPR.Exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
    --a------ 2006-07-19 11:03 94208 C:\Program Files\Common Files\Logitech\khalshared\KHALMNPR.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Utility]
    --------- 2003-12-17 08:50 19968 C:\WINDOWS\LOGI_MWX.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSMSGS]
    ---hs---- 2004-10-13 10:24 1694208 C:\Program Files\Messenger\msmsgs.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    --a------ 2006-10-12 02:10 49263 C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe

    R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys [2006-02-23 10:38]
    R2 LBeepKE;LBeepKE;C:\WINDOWS\system32\Drivers\LBeepKE.sys [2006-09-01 11:32]
    R2 LicCtrlService;LicCtrl Service;C:\WINDOWS\runservice.exe [2006-09-03 17:29]
    S3 Camdrv30;Philips ToUcam XS;C:\WINDOWS\system32\Drivers\camdrv30.sys [2001-08-17 08:04]

    .
    Contents of the 'Scheduled Tasks' folder
    "2008-01-06 03:11:02 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job "
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    "2008-01-11 15:05:00 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job "
    - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE
    "2006-11-25 01:20:19 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 1200 series#1155140818.job "
    - C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe4-I
    "2007-02-28 00:58:58 C:\WINDOWS\Tasks\MP Scheduled Quick Scan.job "
    - C:\Program Files\Microsoft Windows OneCare Live\Antivirus\MpCmdRun.exe%Scan -RestrictPrivileges -ScanType 1
    .
    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-01-11 09:43:15
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-01-11 9:44:07
    ComboFix-quarantined-files.txt 2008-01-11 15:43:52
    ComboFix2.txt 2008-01-11 03:41:29


    Thanks,
    mtaffer
     
    mtaffer,
    #7
  9. 2008/01/11
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Great! Lets make sure we haven't missed anything. Please do an online scan with Kaspersky WebScanner

    http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html (link for US and others not listed below)
    http://www.kaspersky.com.au/online-scanner/# (Australian link)
    http://www.kaspersky.co.uk/virusscanner (UK link)


    You will be promted to install an ActiveX component from Kaspersky, Click Yes.
    • The program will launch and then begin downloading the latest definition files:
    • Once the files have been downloaded click on NEXT
    • Now click on Scan Settings
    • In the scan settings make that the following are selected:
      • Scan using the following Anti-Virus database:
      • Extended (if available otherwise Standard)
      • Scan Options:
      • Scan Archives
        Scan Mail Bases
    • Click OK
    • Now under select a target to scan:
      • Select My Computer
    • This will program will start and scan your system.
    • The scan will take a while so be patient and let it run.
    • Once the scan is complete it will display if your system has been infected.
      • Now click on the Save as Text button:
    • Save the file to your desktop.

    Post the Kaspersky log and one more fresh dss log.
     
    noahdfear,
    #8
  10. 2008/01/11
    mtaffer

    mtaffer Well-Known Member Thread Starter

    Joined:
    2006/10/20
    Messages:
    63
    Likes Received:
    0
    things are already running better

    Here are the logs you requested. :)

    Kaspersky log

    -------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER REPORT
    Friday, January 11, 2008 9:42:39 PM
    Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
    Kaspersky Online Scanner version: 5.0.98.0
    Kaspersky Anti-Virus database last update: 11/01/2008
    Kaspersky Anti-Virus database records: 507941
    -------------------------------------------------------------------------------

    Scan Settings:
    Scan using the following antivirus database: extended
    Scan Archives: true
    Scan Mail Bases: true

    Scan Target - My Computer:
    A:\
    C:\
    D:\

    Scan Statistics:
    Total number of scanned objects: 45200
    Number of viruses found: 4
    Number of infected objects: 13
    Number of suspicious objects: 0
    Duration of the scan process: 01:34:07

    Infected Object Name / Virus Name / Last Action
    C:\Documents and Settings\Administrator\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
    C:\Documents and Settings\All Users\Application Data\Avg7\Log\emc.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Grisoft\Avg7Data\avg7log.log.lck Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\ronald\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\ronald\Desktop\anti-malware programs\SmitfraudFix.exe/data.rar/SmitfraudFix/Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
    C:\Documents and Settings\ronald\Desktop\anti-malware programs\SmitfraudFix.exe/data.rar Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
    C:\Documents and Settings\ronald\Desktop\anti-malware programs\SmitfraudFix.exe RarSFX: infected - 2 skipped
    C:\Documents and Settings\ronald\Desktop\SmitfraudFix\Reboot.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
    C:\Documents and Settings\ronald\Local Settings\Application Data\Google\Google Desktop\8debe95e2798\dbc2e.ht1 Object is locked skipped
    C:\Documents and Settings\ronald\Local Settings\Application Data\Google\Google Desktop\8debe95e2798\dbdam Object is locked skipped
    C:\Documents and Settings\ronald\Local Settings\Application Data\Google\Google Desktop\8debe95e2798\dbdao Object is locked skipped
    C:\Documents and Settings\ronald\Local Settings\Application Data\Google\Google Desktop\8debe95e2798\dbeam Object is locked skipped
    C:\Documents and Settings\ronald\Local Settings\Application Data\Google\Google Desktop\8debe95e2798\dbeao Object is locked skipped
    C:\Documents and Settings\ronald\Local Settings\Application Data\Google\Google Desktop\8debe95e2798\dbm Object is locked skipped
    C:\Documents and Settings\ronald\Local Settings\Application Data\Google\Google Desktop\8debe95e2798\dbu2d.ht1 Object is locked skipped
    C:\Documents and Settings\ronald\Local Settings\Application Data\Google\Google Desktop\8debe95e2798\dbvm.cf1 Object is locked skipped
    C:\Documents and Settings\ronald\Local Settings\Application Data\Google\Google Desktop\8debe95e2798\dbvmh.ht1 Object is locked skipped
    C:\Documents and Settings\ronald\Local Settings\Application Data\Google\Google Desktop\8debe95e2798\fii.cf1 Object is locked skipped
    C:\Documents and Settings\ronald\Local Settings\Application Data\Google\Google Desktop\8debe95e2798\fiih.ht1 Object is locked skipped
    C:\Documents and Settings\ronald\Local Settings\Application Data\Google\Google Desktop\8debe95e2798\hp Object is locked skipped
    C:\Documents and Settings\ronald\Local Settings\Application Data\Google\Google Desktop\8debe95e2798\hpt2i.ht1 Object is locked skipped
    C:\Documents and Settings\ronald\Local Settings\Application Data\Google\Google Desktop\8debe95e2798\rpm.cf1 Object is locked skipped
    C:\Documents and Settings\ronald\Local Settings\Application Data\Google\Google Desktop\8debe95e2798\rpm1m.cf1 Object is locked skipped
    C:\Documents and Settings\ronald\Local Settings\Application Data\Google\Google Desktop\8debe95e2798\rpm1mh.ht1 Object is locked skipped
    C:\Documents and Settings\ronald\Local Settings\Application Data\Google\Google Desktop\8debe95e2798\rpmh.ht1 Object is locked skipped
    C:\Documents and Settings\ronald\Local Settings\Application Data\Google\Google Desktop\8debe95e2798\safeweb\goog-black-enchashm.cf1 Object is locked skipped
    C:\Documents and Settings\ronald\Local Settings\Application Data\Google\Google Desktop\8debe95e2798\safeweb\goog-black-enchashmh.ht1 Object is locked skipped
    C:\Documents and Settings\ronald\Local Settings\Application Data\Google\Google Desktop\8debe95e2798\safeweb\goog-black-urlm.cf1 Object is locked skipped
    C:\Documents and Settings\ronald\Local Settings\Application Data\Google\Google Desktop\8debe95e2798\safeweb\goog-black-urlmh.ht1 Object is locked skipped
    C:\Documents and Settings\ronald\Local Settings\Application Data\Google\Google Desktop\8debe95e2798\safeweb\goog-malware-domainm.cf1 Object is locked skipped
    C:\Documents and Settings\ronald\Local Settings\Application Data\Google\Google Desktop\8debe95e2798\safeweb\goog-malware-domainmh.ht1 Object is locked skipped
    C:\Documents and Settings\ronald\Local Settings\Application Data\Google\Google Desktop\8debe95e2798\safeweb\goog-white-domainm.cf1 Object is locked skipped
    C:\Documents and Settings\ronald\Local Settings\Application Data\Google\Google Desktop\8debe95e2798\safeweb\goog-white-domainmh.ht1 Object is locked skipped
    C:\Documents and Settings\ronald\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\ronald\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\ronald\Local Settings\Application Data\Mozilla\Firefox\Profiles\l20v9gkk.default\Cache\B09F12BEd01 Infected: not-a-virus:Downloader.Win32.AdvancedCleaner.b skipped
    C:\Documents and Settings\ronald\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\ronald\Local Settings\Temp\~DF7B31.tmp Object is locked skipped
    C:\Documents and Settings\ronald\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\ronald\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\ronald\NTUSER.DAT.LOG Object is locked skipped
    C:\QooBox\Quarantine\C\Program Files\AdwareRemover2007\AdwareRemover2007.exe.vir Infected: not-a-virus:FraudTool.Win32.DrAntispy.aa skipped
    C:\QooBox\Quarantine\C\Program Files\XP Antivirus\xpantiviruspro.exe.tmp.vir Infected: not-a-virus:FraudTool.Win32.XPAntivirus.f skipped
    C:\QooBox\Quarantine\C\Program Files\XP Antivirus\xpantiviruspro.exe.vir Infected: not-a-virus:FraudTool.Win32.XPAntivirus.f skipped
    C:\RECYCLER\S-1-5-21-1292428093-1383384898-839522115-1003\Dc9.exe Infected: not-a-virus:Downloader.Win32.AdvancedCleaner.b skipped
    C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    C:\System Volume Information\_restore{4A3269F0-72DC-42EB-A2A6-B81436EB5D05}\RP3\A0000067.exe Infected: not-a-virus:FraudTool.Win32.DrAntispy.aa skipped
    C:\System Volume Information\_restore{4A3269F0-72DC-42EB-A2A6-B81436EB5D05}\RP3\A0000078.exe Infected: not-a-virus:FraudTool.Win32.XPAntivirus.f skipped
    C:\System Volume Information\_restore{4A3269F0-72DC-42EB-A2A6-B81436EB5D05}\RP3\A0000117.exe Infected: not-a-virus:Downloader.Win32.AdvancedCleaner.b skipped
    C:\System Volume Information\_restore{4A3269F0-72DC-42EB-A2A6-B81436EB5D05}\RP3\change.log Object is locked skipped
    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
    C:\WINDOWS\SchedLgU.Txt Object is locked skipped
    C:\WINDOWS\Sti_Trace.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
    C:\WINDOWS\system32\config\ACEEvent.evt Object is locked skipped
    C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\default Object is locked skipped
    C:\WINDOWS\system32\config\default.LOG Object is locked skipped
    C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
    C:\WINDOWS\system32\config\SAM Object is locked skipped
    C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
    C:\WINDOWS\system32\config\software Object is locked skipped
    C:\WINDOWS\system32\config\software.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\system Object is locked skipped
    C:\WINDOWS\system32\config\system.LOG Object is locked skipped
    C:\WINDOWS\system32\config\Windows_OneCare_Evt.evt Object is locked skipped
    C:\WINDOWS\system32\mmf.sys Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
    C:\WINDOWS\wiadebug.log Object is locked skipped
    C:\WINDOWS\wiaservc.log Object is locked skipped

    Scan process completed.


    DSS log

    Deckard's System Scanner v20071014.68
    Run by ronald on 2008-01-11 21:43:03
    Computer is in Normal Mode.
    --------------------------------------------------------------------------------



    -- HijackThis (run as ronald.exe) ----------------------------------------------

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:43:08 PM, on 1/11/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\BroadJump\Client Foundation\CFD.exe
    C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
    C:\Program Files\ATI Technologies\ATI.ACE\CLI.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\WINDOWS\runservice.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\ATI Technologies\ATI.ACE\cli.exe
    C:\Program Files\internet explorer\iexplore.exe
    C:\Documents and Settings\ronald\Desktop\dss.exe
    C:\DOCUME~1\ronald\Desktop\ronald.exe

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar4.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.0.301.7164\swg.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar4.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O4 - HKLM\..\Run: [ATICCC] "C:\Program Files\ATI Technologies\ATI.ACE\CLIStart.exe "
    O4 - HKLM\..\Run: [Google Desktop Search] "C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKLM\..\Run: [BJCFD] C:\Program Files\BroadJump\Client Foundation\CFD.exe
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
    O4 - HKLM\..\Run: [AVG7_CC] C:\PROGRA~1\Grisoft\AVG7\avgcc.exe /STARTUP
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [Magentic] C:\PROGRA~1\Magentic\bin\Magentic.exe /c
    O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/partner/default/kavwebscan_unicode.cab
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://by106fd.bay106.hotmail.msn.com/resources/MsnPUpld.cab
    O16 - DPF: {56762DEC-6B0D-4AB4-A8AD-989993B5D08B} (OnlineScanner Control) - http://www.eset.eu/buxus/docs/OnlineScanner.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1155070753414
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1155080451402
    O16 - DPF: {9A9307A0-7DA4-4DAF-B042-5009F29E09E1} (ActiveScan Installer Class) - http://acs.pandasoftware.com/activescan/as5free/asinst.cab
    O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: iPod Service - Apple Computer, Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LicCtrl Service (LicCtrlService) - Unknown owner - C:\WINDOWS\runservice.exe

    --
    End of file - 6539 bytes

    Thank you for all your help! :)

    mtaffer:)
     
    mtaffer,
    #9
  11. 2008/01/11
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Looks great! Lets tidy up now.

    Click Start>Run and type ComboFix /u then hit enter. That will uninstall ComboFix and remove the infected files it has in quarantine.

    Delete the SmitfraudFix file and folder in the following locations.

    C:\Documents and Settings\Administrator\Desktop\SmitfraudFix
    C:\Documents and Settings\ronald\Desktop\anti-malware programs\SmitfraudFix.exe

    Download ATF Cleaner by Atribune and save it to your Desktop.
    • Double click ATF-Cleaner.exe to run the program.
    • Check the boxes to the left of:

      • Windows Temp
      • Current User Temp
      • All Users Temp
      • Temporary Internet Files (TIFs)
      • Prefetch
      • Java Cache
      • Recycle bin

    • The rest are optional - if you want it to remove everything check "Select All ".
    • Finally, click Empty Selected.
    • When you get the "Done Cleaning" message, select the Mozilla tab and clear out the TIFs and Cookies.
    • Click OK then exit.
    Reboot


    If you're satisfied that the computer is working properly, clear the System Restore points. They are infected.

    Clear past system restore points and create a new one.
    Right click My Computer and select Properties. On the System Restore tab, check the box to turn System Restore off. Click Apply. Now, uncheck the box and click Apply. Click OK, then OK to close the System Properties dialog.

    Verify a new restore point was created.
    Click Start>All Programs>Accessories>System Tools>System Restore
    Select 'Restore my computer to an earlier time', then click next.
    You should have a newly created System Checkpoint available. If so, click Cancel. If not, click Back and select 'Create a restore point' then click Next. Give the restore point a name and click next.


    Your computer is now clean! Geri has posted some very helpful information and recommendations regarding future protection in the following link.

    http://www.windowsbbs.com/showthread.php?t=67958

    Surf safe!
     
    noahdfear,
    #10
  12. 2008/01/14
    mtaffer

    mtaffer Well-Known Member Thread Starter

    Joined:
    2006/10/20
    Messages:
    63
    Likes Received:
    0
    Thanks again

    Everything is working great now.

    Thanks for all of your help! :)

    mtaffer
     
    mtaffer,
    #11
  13. 2008/01/14
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Glad to hear it! You're most welcome. :)
     
    noahdfear,
    #12

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...