1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

HELP! This computer is slow, accounts are locked out, millions of popups...

Discussion in 'Malware and Virus Removal Archive' started by tylerho, 2008/05/17.

  1. 2008/05/17
    tylerho

    tylerho Inactive Thread Starter

    Joined:
    2008/02/26
    Messages:
    87
    Likes Received:
    0
    I hope someone can please help me clean this computer. It is a mess...

    Here is the HiJack This log...

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:35:48 AM, on 5/17/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\csrss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\wmsdkns.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    C:\WINDOWS\TG9uZ3Rpbg\command.exe
    C:\WINDOWS\b2new.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Network Monitor\netmon.exe
    C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
    C:\Program Files\Norton AntiVirus\SAVScan.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\System32\alg.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\QuickTime\qttask .exe
    C:\WINDOWS\mrofinu72.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\Program Files\webHancer\Programs\whagent.exe
    C:\Program Files\AntiSpywareMaster\asm.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\JavaCore\JavaCore.exe
    C:\Program Files\NoDNS\NoDNS.exe
    C:\Program Files\??stem32\d?xplore.exe
    C:\Program Files\QdrPack\QdrPack16.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
    C:\Program Files\Svconr\Svconr.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\QdrModule\QdrModule16.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://c:/windows/homepage.html
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file://c:/windows/homepage.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://c:/windows/homepage.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = file://c:/windows/homepage.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://c:/windows/homepage.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = file://c:/windows/homepage.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,First Home Page = file://c:/windows/homepage.html
    F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\lpcywinp.exe,C:\WINDOWS\system32\userinit.exe,C:\WINDOWS\system32\wmsdkns.exe,
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask .exe" -atboottime
    O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu72.exe 61A847B5BBF72815308B2B27128065E9C084320161C4661227A755E9C2933154389A284662E901F3D2933202228B284662E901F3D293320221C46402788A1B8FA5FA5C664DFC5B3A2FBB4EB59BDD671530856D1E27
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe "
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
    O4 - HKLM\..\Run: [webHancer Agent] C:\Program Files\webHancer\Programs\whagent.exe
    O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
    O4 - HKLM\..\Run: [AntiSpywareMaster] C:\Program Files\AntiSpywareMaster\asm.exe
    O4 - HKLM\..\Run: [641cb8cb] rundll32.exe "C:\WINDOWS\system32\odcdcdet.dll ",b
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [Ixodry] "C:\Documents and Settings\Owner\My Documents\??crosoft.NET\r?ndll32.exe "
    O4 - HKCU\..\Run: [WinTouch] C:\Documents and Settings\Owner\Application Data\WinTouch\WinTouch.exe
    O4 - HKCU\..\Run: [Awola] "C:\Documents and Settings\Owner\Application Data\Awola\Awola.exe" /MIN
    O4 - HKCU\..\Run: [Qwpofaf] "C:\Documents and Settings\Owner\Application Data\??sembly\??oolsv.exe "
    O4 - HKCU\..\Run: [JavaCore] C:\Program Files\JavaCore\JavaCore.exe
    O4 - HKCU\..\Run: [Xkpmfm] "C:\Documents and Settings\Owner\My Documents\s?curity\s?rvices.exe "
    O4 - HKCU\..\Run: [NoDNS] C:\Program Files\\NoDNS\\NoDNS.exe
    O4 - HKCU\..\Run: [Fhfiq] "C:\Program Files\??stem32\d?xplore.exe "
    O4 - HKCU\..\Run: [QdrPack16] "C:\Program Files\QdrPack\QdrPack16.exe "
    O4 - HKCU\..\Run: [Svconr] C:\Program Files\Svconr\Svconr.exe
    O4 - HKCU\..\Run: [QdrModule16] "C:\Program Files\QdrModule\QdrModule16.exe "
    O4 - HKUS\S-1-5-19\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'SYSTEM')
    O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9d.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [AVG7_Run] C:\PROGRA~1\Grisoft\AVG7\avgw.exe /RUNONCE (User 'Default user')
    O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9d.exe (User 'Default user')
    O4 - Startup: LimeWire On Startup.lnk = C:\Program Files\LimeWire\LimeWire.exe
    O4 - Startup: Picture Motion Browser Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
    O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O10 - Hijacked Internet access by WebHancer
    O10 - Hijacked Internet access by WebHancer
    O10 - Hijacked Internet access by WebHancer
    O12 - Plugin for .spop: C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u5-windows-i586-jc.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Filter hijack: text/html - {07851C6A-1C43-41d9-8319-BC89154A8C00} - C:\Program Files\RcvSystem\httpdchk.dll
    O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
    O21 - SSODL: WebProxy - {66186F05-BBBB-4a39-864F-72D84615C679} - sockins32.dll (file missing)
    O23 - Service: AVG7 Alert Manager Server (Avg7Alrt) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgamsvr.exe
    O23 - Service: AVG7 Update Service (Avg7UpdSvc) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgupsvc.exe
    O23 - Service: AVG E-mail Scanner (AVGEMS) - GRISOFT, s.r.o. - C:\PROGRA~1\Grisoft\AVG7\avgemc.exe
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Command Service (cmdService) - Unknown owner - C:\WINDOWS\TG9uZ3Rpbg\command.exe
    O23 - Service: DomainService - Unknown owner - C:\WINDOWS\system32\gxmihytc.exe (file missing)
    O23 - Service: GoogleDesktopManager - Google - C:\Program Files\Google\Google Desktop Search\GoogleDesktopManager.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: MsSecurity Updated (MsSecurity1.209.4) - Unknown owner - C:\WINDOWS\b2new.exe
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
    O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

    --
    End of file - 10271 bytes
     
    tylerho,
    #1
  2. 2008/05/17
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi tylerho
    Yes you do have a mess here.
    Make sure you follow these steps in the order give.

    It may be helpful to print or save these instructions to a text file. You can use it as a checklist to make sure all tasks are completed, in the order given, and all logs are available for posting. Since you have been asked to run multiple tasks and post several logs, please re-read all instructions prior to posting back, to make sure all requested actions have been completed and all requested logs are available. This will help save us both time. Thanks!

    I see you have P2P software ([color= "Red"] Limewire, BitTorrent uTorrent etc… [/color]) installed on your machine. We are not here to pass judgment on file-sharing as a concept. However, we will warn you that engaging in this activity and having this kind of software installed on your machine will always make you more susceptible to re-infections. It may be contributing to your current situation. This page will give you further information.

    Please note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected. The bad guys use P2P filesharing as a major conduit to spread their wares and their infections.

    References for the risk of these programs are here,
    here and here.

    I would strongly recommend that you uninstall them, however that choice is up to you. If you choose to remove these programs, you can do so via Control Panel >> Add or Remove Programs.

    Note: Please be advised that continued use of these programs after being warned of the danger of infections from them, may result in the discontinued help of future cleaning of your system here at Windowsbbs Virus and Spyware removal.



    Please re-open HiJackThis and scan only. Check the boxes next to all the entries listed below.

    O7 - HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System, DisableRegedit=1

    Now close all windows other than HiJackThis, then click Fix Checked.

    Close HJT.


    You are running two anti-virus programs, this is not a good idea, they can conflict with each other and actually give you less protection
    Please remove one ( 1 ) of them.
    AVG7
    Norton AntiVirus     <<If you decide on Removing Norton Stop Here and let me know.


    Please go to Start > Control Panel > Add/Remove Programs (Windows Vista it’s Programs and Features) and remove the following (if present):


    AntiSpywareMaster <<This is a rogue anti-spyware program
    webHancer Survey Companion <<If present
    webHancer Customer Companion <<Any webHancers present.
    LimeWire <<I strongly suggest you remove this !


    Please note any other programs that you don't recognize in that list and post them in your next response


    Download SDFix and save it to your Desktop.

    Double click SDFix.exe and it will extract the files to %systemdrive%
    (Drive that contains the Windows Directory, typically C:\SDFix)

    Please then reboot your computer in Safe Mode by doing the following :
    • Restart your computer
    • After hearing your computer beep once during startup, but before the Windows icon appears, tap the F8 key continually;
    • Instead of Windows loading as normal, the Advanced Options Menu should appear;
    • Select the first option, to run Windows in Safe Mode, then press Enter.
    • Choose your usual account.
    • Open the extracted SDFix folder and double click RunThis.bat to start the script.
    • Type Y to begin the cleanup process.
    • It will remove any Trojan Services and Registry Entries that it finds then prompt you to press any key to Reboot.
    • Press any Key and it will restart the PC.
    • When the PC restarts the Fixtool will run again and complete the removal process then display Finished, press any key to end the script and load your desktop icons.
    • Once the desktop icons load the SDFix report will open on screen and also save into the SDFix folder as Report.txt
      (Report.txt will also be copied to Clipboard ready for posting back on the forum).
    • Finally paste the contents of the Report.txt back on the forum with a new HijackThis log

    Now this.

    Now download Malwarebytes' Anti-Malware (MBAM) from here or here and save the file to your desktop.

    Double click mbam-setup.exe to install the application.
    • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    • If an update is found, it will download and install the latest version.
    • Once the program has loaded, select 'Perform Quick Scan', then click Scan.
    • The scan may take some time to finish,so please be patient.
    • When the scan is complete, click OK, then Show Results to view the results.
    • Make sure that everything is checked, and click Remove Selected.
    • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note below)
    • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
    • Post the entire report in your next reply along with a fresh HijackThis log. Let me know what issues still exist.

    Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.


    Now do this please.

    Download ComboFix from Here to your Desktop.

    It's best to disable realtime protection applications as they sometimes interfere with the tool.
    Check this link for any applicable programs you may have.
    • Close all open programs and windows
    • Double click combofix.exe and follow the prompts.
    • Vista users right click Combofix.exe and select Run As Administrator.
    • When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply
    Note: Do not mouseclick combofix's window while its running. That may cause it to stall

    Note - ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.

    Note - Combofix makes some changes when run to prevent autorun/autoplay of ALL CDs, floppies and USB devices, to assist with malware removal & increase security. If this is an issue or makes it difficult for you to use those devices, please ask how to reset it.

    Please post the SDFix log the MBAM log The ComboFix log and a New HJT log.

    Thanks
    Geri
     
    Geri,
    #2


  3. to hide this advert.

  4. 2008/05/17
    tylerho

    tylerho Inactive Thread Starter

    Joined:
    2008/02/26
    Messages:
    87
    Likes Received:
    0
    SDFix: Version 1.183
    Run by Administrator on Sat 05/17/2008 at 01:33 PM

    Microsoft Windows XP [Version 5.1.2600]
    Running From: C:\SDFix

    Checking Services :

    Name :
    cmdService
    MsSecurity1.209.4
    Network Monitor

    Path :
    C:\WINDOWS\TG9uZ3Rpbg\command.exe
    C:\WINDOWS\b2new.exe service
    C:\Program Files\Network Monitor\netmon.exe service

    cmdService - Deleted
    MsSecurity1.209.4 - Deleted
    Network Monitor - Deleted

    Killing PID 764 'wmsdkns.exe'
    Killing PID 764 'wmsdkns.exe'
    Killing PID 764 'wmsdkns.exe'
    Killing PID 764 'wmsdkns.exe'


    Restoring Windows Registry Values
    Restoring Windows Default Hosts File
    Restoring Default Desktop Wallpaper

    Rebooting


    Checking Files :

    Trojan Files Found:

    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat - Contains Links to Malware Sites! - Deleted
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat - Contains Links to Malware Sites! - Deleted
    C:\WINDOWS\TG9uZ3Rpbg\asappsrv.dll - Deleted
    C:\WINDOWS\TG9uZ3Rpbg\command.exe - Deleted
    C:\WINDOWS\TG9uZ3Rpbg\n36RtalDv0.vbs - Deleted
    C:\Documents and Settings\All Users\Start Menu\Programs\AntiSpywareMaster\AntiSpywareMaster.lnk - Deleted
    C:\Documents and Settings\All Users\Start Menu\Programs\AntiSpywareMaster\Uninstall AntiSpywareMaster.lnk - Deleted
    C:\Documents and Settings\LocalService\Application Data\NetMon\domains.txt - Deleted
    C:\Documents and Settings\LocalService\Application Data\NetMon\log.txt - Deleted
    C:\WINDOWS\system32\acespy\systune.exe - Deleted
    C:\WINDOWS\system32\acespy\__acelog.ndx - Deleted
    C:\Program Files\3721\helper.dll - Deleted
    C:\Program Files\3721\assist\asbar.dll - Deleted
    C:\Program Files\Accoona\ASearchAssist.dll - Deleted
    C:\Program Files\akl\akl.dll - Deleted
    C:\Program Files\akl\akl.exe - Deleted
    C:\Program Files\akl\curlog.htm - Deleted
    C:\Program Files\akl\keylog.txt - Deleted
    C:\Program Files\akl\readme.txt - Deleted
    C:\Program Files\akl\uninstall.exe - Deleted
    C:\Program Files\akl\unsetup.dat - Deleted
    C:\Program Files\akl\unsetup.exe - Deleted
    C:\Program Files\amsys\awmsg.dat - Deleted
    C:\Program Files\amsys\guid.dat - Deleted
    C:\Program Files\amsys\ijl15.dll - Deleted
    C:\Program Files\amsys\mfc42.dll - Deleted
    C:\Program Files\amsys\msvcrt.dll - Deleted
    C:\Program Files\amsys\unins000.dat - Deleted
    C:\Program Files\amsys\unis000.exe - Deleted
    C:\Program Files\amsys\winam.dat - Deleted
    C:\Program Files\AntiSpywareMaster\asm.exe - Deleted
    C:\Program Files\AntiSpywareMaster\install_asm_update_scanner.exe - Deleted
    C:\Program Files\CPV\CPV7.dll.lzma - Deleted
    C:\Program Files\CPV\CPV8.dll.lzma - Deleted
    C:\Program Files\e-zshopper\BarLcher.dll - Deleted
    C:\Program Files\ISM\ism.exe - Deleted
    C:\Program Files\ISM\Uninstall.exe - Deleted
    C:\Program Files\JavaCore\JavaCore.exe - Deleted
    C:\Program Files\JavaCore\UnInstall.exe - Deleted
    C:\Program Files\MapEDC\IDE.stt - Deleted
    C:\Program Files\NoDNS\NoDNS.exe - Deleted
    C:\Program Files\NoDNS\UnInstall.exe - Deleted
    C:\Program Files\p2pnetworks\amp2pl.exe - Deleted
    C:\Program Files\QdrDrive\QdrDrive10.dll - Deleted
    C:\Program Files\QdrDrive\QdrDrive15.dll - Deleted
    C:\Program Files\QdrDrive\QdrDrive9.dll - Deleted
    C:\Program Files\QdrDrive\qdrloader.exe - Deleted
    C:\Program Files\QdrPack\dicts.gz - Deleted
    C:\Program Files\QdrPack\dictys.gz - Deleted
    C:\Program Files\QdrPack\QdrPack11 .exe - Deleted
    C:\Program Files\QdrPack\QdrPack12.exe - Deleted
    C:\Program Files\QdrPack\QdrPack13.exe - Deleted
    C:\Program Files\QdrPack\QdrPack15.exe - Deleted
    C:\Program Files\QdrPack\QdrPack16.exe - Deleted
    C:\Program Files\QdrPack\trgts.gz - Deleted
    C:\Program Files\QdrModule\dic.gz - Deleted
    C:\Program Files\QdrModule\dicy.gz - Deleted
    C:\Program Files\QdrModule\kwd.gz - Deleted
    C:\Program Files\QdrModule\pckr.dat - Deleted
    C:\Program Files\QdrModule\QdrModule11 .exe - Deleted
    C:\Program Files\QdrModule\QdrModule12.exe - Deleted
    C:\Program Files\QdrModule\QdrModule15.exe - Deleted
    C:\Program Files\QdrModule\QdrModule16.exe - Deleted
    C:\Program Files\Spcron\Spc.dll - Deleted
    C:\Program Files\Spcron\Spcron.dll.lzma - Deleted
    C:\Program Files\Twain\Twain.exe - Deleted
    C:\Program Files\Twain\Twain.exe.lzma - Deleted
    C:\Program Files\Words\list.txt - Deleted
    C:\Program Files\Words\script.txt - Deleted
    C:\Program Files\Words\UnInstall.exe - Deleted
    C:\Program Files\Words\Words .exe - Deleted
    C:\Program Files\Common Files\Yazzle1552OinAdmin.exe - Deleted
    C:\Program Files\Common Files\Yazzle1552OinUninstaller.exe - Deleted
    C:\WINDOWS\b104.exe - Deleted
    C:\WINDOWS\b138.exe - Deleted
    C:\WINDOWS\b143.exe - Deleted
    C:\WINDOWS\b151.exe - Deleted
    C:\WINDOWS\b152.exe - Deleted
    C:\WINDOWS\b153.exe - Deleted
    C:\WINDOWS\b154.exe - Deleted
    C:\WINDOWS\b155.exe - Deleted
    C:\WINDOWS\b156.exe - Deleted
    C:\WINDOWS\b157.exe - Deleted
    C:\WINDOWS\mrofinu72.exe - Deleted
    C:\WINDOWS\system32\000060.exe - Deleted
    C:\WINDOWS\system32\000080.exe - Deleted
    C:\WINDOWS\system32\000090.exe - Deleted
    C:\Program Files\Network Monitor\netmon.exe - Deleted
    C:\Program Files\Setup.exe - Deleted
    C:\WINDOWS\123messenger.per - Deleted
    C:\WINDOWS\2020search.dll - Deleted
    C:\WINDOWS\2020search2.dll - Deleted
    C:\WINDOWS\764.exe - Deleted
    C:\WINDOWS\7search.dll - Deleted
    C:\WINDOWS\absolute key logger.lnk - Deleted
    C:\WINDOWS\aconti.exe - Deleted
    C:\WINDOWS\aconti.ini - Deleted
    C:\WINDOWS\aconti.log - Deleted
    C:\WINDOWS\aconti.sdb - Deleted
    C:\WINDOWS\acontidialer.txt - Deleted
    C:\WINDOWS\adbar.dll - Deleted
    C:\WINDOWS\apphelp32.dll - Deleted
    C:\WINDOWS\asferror32.dll - Deleted
    C:\WINDOWS\asycfilt32.dll - Deleted
    C:\WINDOWS\athprxy32.dll - Deleted
    C:\WINDOWS\ati2dvaa32.dll - Deleted
    C:\WINDOWS\ati2dvag32.dll - Deleted
    C:\WINDOWS\audiosrv32.dll - Deleted
    C:\WINDOWS\autodisc32.dll - Deleted
    C:\WINDOWS\avifile32.dll - Deleted
    C:\WINDOWS\avisynthex32.dll - Deleted
    C:\WINDOWS\aviwrap32.dll - Deleted
    C:\WINDOWS\bjam.dll - Deleted
    C:\WINDOWS\bokja.exe - Deleted
    C:\WINDOWS\browserad.dll - Deleted
    C:\WINDOWS\cbinst$.exe - Deleted
    C:\WINDOWS\cdsm32.dll - Deleted
    C:\WINDOWS\changeurl_30.dll - Deleted
    C:\WINDOWS\daxtime.dll - Deleted
    C:\WINDOWS\default.htm - Deleted
    C:\WINDOWS\didduid.ini - Deleted
    C:\WINDOWS\dp0.dll - Deleted
    C:\WINDOWS\eventlowg.dll - Deleted
    C:\WINDOWS\fhfmm.exe - Deleted
    C:\WINDOWS\fhfmm-Uninstaller.exe - Deleted
    C:\WINDOWS\flt.dll - Deleted
    C:\WINDOWS\hcwprn.exe - Deleted
    C:\WINDOWS\hotporn.exe - Deleted
    C:\WINDOWS\ie_32.exe - Deleted
    C:\WINDOWS\iexplorr23.dll - Deleted
    C:\WINDOWS\index.html - Deleted
    C:\WINDOWS\jd2002.dll - Deleted
    C:\WINDOWS\kkcomp$.exe - Deleted
    C:\WINDOWS\kkcomp.dll - Deleted
    C:\WINDOWS\kkcomp.exe - Deleted
    C:\WINDOWS\kvnab$.exe - Deleted
    C:\WINDOWS\kvnab.dll - Deleted
    C:\WINDOWS\kvnab.exe - Deleted
    C:\WINDOWS\licencia.txt - Deleted
    C:\WINDOWS\liqad$.exe - Deleted
    C:\WINDOWS\liqad.dll - Deleted
    C:\WINDOWS\liqad.exe - Deleted
    C:\WINDOWS\liqui.dll - Deleted
    C:\WINDOWS\liqui.exe - Deleted
    C:\WINDOWS\liqui-Uninstaller.exe - Deleted
    C:\WINDOWS\megavid.cdt - Deleted
    C:\WINDOWS\msa64chk.dll - Deleted
    C:\WINDOWS\msapasrc.dll - Deleted
    C:\WINDOWS\mspphe.dll - Deleted
    C:\WINDOWS\mssvr.exe - Deleted
    C:\WINDOWS\muotr.so - Deleted
    C:\WINDOWS\ngd.dll - Deleted
    C:\WINDOWS\ntnut.exe - Deleted
    C:\WINDOWS\pbar.dll - Deleted
    C:\WINDOWS\pbsysie.dll - Deleted
    C:\WINDOWS\saiemod.dll - Deleted
    C:\WINDOWS\settn.dll - Deleted
    C:\WINDOWS\shdocpe.dll - Deleted
    C:\WINDOWS\shdocpl.dll - Deleted
    C:\WINDOWS\stcloader.exe - Deleted
    C:\WINDOWS\swin32.dll - Deleted
    C:\WINDOWS\system32\ace16win.dll - Deleted
    C:\WINDOWS\system32\adult.txt - Deleted
    C:\WINDOWS\system32\atmtd.dll - Deleted
    C:\WINDOWS\system32\atmtd.dll._ - Deleted
    C:\WINDOWS\system32\ESHOPEE.exe - Deleted
    C:\WINDOWS\system32\finance.txt - Deleted
    C:\WINDOWS\system32\lt.res - Deleted
    C:\WINDOWS\system32\msole32.exe - Deleted
    C:\WINDOWS\system32\other.txt - Deleted
    C:\WINDOWS\system32\pharma.txt - Deleted
    C:\WINDOWS\system32\sft.res - Deleted
    C:\WINDOWS\system32\sockins32.dll - Deleted
    C:\WINDOWS\system32\vxddsk.exe - Deleted
    C:\WINDOWS\system32\winfrun32.bin - Deleted
    C:\WINDOWS\system32\wml.exe - Deleted
    C:\WINDOWS\system32\wmsdkns.exe - Deleted
    C:\WINDOWS\telefonos.txt - Deleted
    C:\WINDOWS\Temp\removalfile.bat - Deleted
    C:\WINDOWS\textos.txt - Deleted
    C:\WINDOWS\uninstall_nmon.vbs - Deleted
    C:\WINDOWS\voiceip.dll - Deleted
    C:\WINDOWS\vxddsk.exe - Deleted
    C:\WINDOWS\wbeCheck.exe - Deleted
    C:\WINDOWS\wbeInst$.exe - Deleted
    C:\WINDOWS\winsb.dll - Deleted
    C:\WINDOWS\wml.exe - Deleted
    C:\WINDOWS\xadbrk.dll - Deleted
    C:\WINDOWS\xadbrk.exe - Deleted
    C:\WINDOWS\xadbrk_.exe - Deleted
    C:\WINDOWS\xxxvideo.exe - Deleted



    Folder C:\Documents and Settings\All Users\Start Menu\Programs\SecurePCCleaner - Removed
    Folder C:\Program Files\3721 - Removed
    Folder C:\Program Files\Accoona - Removed
    Folder C:\Program Files\akl - Removed
    Folder C:\Program Files\amsys - Removed
    Folder C:\Program Files\AntiSpywareMaster - Removed
    Folder C:\Program Files\CPV - Removed
    Folder C:\Program Files\e-zshopper - Removed
    Folder C:\Program Files\InetGet2 - Removed
    Folder C:\Program Files\ISM - Removed
    Folder C:\Program Files\JavaCore - Removed
    Folder C:\Program Files\MapEDC - Removed
    Folder C:\Program Files\Network Monitor - Removed
    Folder C:\Program Files\NoDNS - Removed
    Folder C:\Program Files\p2pnetworks - Removed
    Folder C:\Program Files\QdrDrive - Removed
    Folder C:\Program Files\QdrPack - Removed
    Folder C:\Program Files\QdrModule - Removed
    Folder C:\Program Files\Router - Removed
    Folder C:\Program Files\Spcron - Removed
    Folder C:\Program Files\Temporary - Removed
    Folder C:\Program Files\Twain - Removed
    Folder C:\Program Files\Words - Removed
    Folder C:\Documents and Settings\LocalService\Application Data\NetMon - Removed
    Folder C:\WINDOWS\system32\acespy - Removed


    Removing Temp Files

    ADS Check :



    Final Check :

    catchme 0.3.1359.2 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-05-17 13:47:12
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden services & system hive ...

    scanning hidden registry entries ...

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Prefetcher]
    "TracesProcessed "=dword:0000013f
    "TracesSuccessful "=dword:00000006

    scanning hidden files ...

    scan completed successfully
    hidden processes: 0
    hidden services: 0
    hidden files: 0


    Remaining Services :




    Authorized Application Key Export:

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe "= "%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019 "
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "= "%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000 "
    "C:\\Program Files\\LimeWire\\LimeWire.exe "= "C:\\Program Files\\LimeWire\\LimeWire.exe:*:Enabled:LimeWire "
    "C:\\Program Files\\Windows Live\\Messenger\\MsnMsgr .Exe "= "C:\\Program Files\\Windows Live\\Messenger\\MsnMsgr .Exe:*:Enabled:Windows Live Messenger "
    "C:\\WINDOWS\\system32\\gxmihytc.exe "= "C:\\WINDOWS\\system32\\gxm "
    "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe "= "C:\\Program Files\\Grisoft\\AVG7\\avginet.exe:*:Enabled:avginet.exe "
    "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe "= "C:\\Program Files\\Grisoft\\AVG7\\avgamsvr.exe:*:Enabled:avgamsvr.exe "
    "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe "= "C:\\Program Files\\Grisoft\\AVG7\\avgcc.exe:*:Enabled:avgcc.exe "
    "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe "= "C:\\Program Files\\Grisoft\\AVG7\\avgemc.exe:*:Enabled:avgemc.exe "
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger "
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe "= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone) "
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr .exe "= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr .exe:*:Enabled:Windows Live Messenger "
    "C:\\Program Files\\Best Buy Rhapsody\\rhapsody.exe "= "C:\\Program Files\\Best Buy Rhapsody\\rhapsody.exe:*:Enabled:Rhapsody Media Player "

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
    "%windir%\\system32\\sessmgr.exe "= "%windir%\\system32\\sessmgr.exe:*:enabled:mad:xpsp2res.dll,-22019 "
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "= "%windir%\\Network Diagnostic\\xpnetdiag.exe:*:Enabled:mad:xpsp3res.dll,-20000 "
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "= "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe:*:Enabled:Windows Live Messenger "
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe "= "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe:*:Enabled:Windows Live Messenger (Phone) "

    Remaining Files :


    File Backups: - C:\SDFix\backups\backups.zip

    Files with Hidden Attributes :

    Mon 28 Jan 2008 230,400 ..SHR --- "C:\Program Files\??stem32\d?xplore.exe "
    Tue 26 Feb 2008 28,160 A..H. --- "C:\RECYCLER\S-1-5-21-2025429265-884357618-725345543-1003\Dc129.tmp "
    Sat 22 Mar 2008 0 A..H. --- "C:\WINDOWS\system32\BIT2C53.tmp "
    Tue 4 Dec 2007 4,348 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv1.bak "
    Tue 4 Dec 2007 401 ..SH. --- "C:\Documents and Settings\All Users\DRM\DRMv15.bak "
    Tue 4 Dec 2007 4,348 ...H. --- "C:\Documents and Settings\Owner\My Documents\My Music\License Backup\drmv1key.bak "
    Tue 4 Dec 2007 401 A..H. --- "C:\Documents and Settings\Owner\My Documents\My Music\License Backup\drmv1lic.bak "
    Tue 4 Dec 2007 312 ...H. --- "C:\Documents and Settings\Owner\My Documents\My Music\License Backup\drmv2key.bak "
    Tue 4 Dec 2007 1,536 A..H. --- "C:\Documents and Settings\Owner\My Documents\My Music\License Backup\drmv2lic.bak "
    Tue 4 Dec 2007 4,348 ...H. --- "C:\Documents and Settings\Owner\Application Data\Real\rhapsody\wmlicbackup\drmv1key.bak "
    Tue 22 Apr 2008 401 A..H. --- "C:\Documents and Settings\Owner\Application Data\Real\rhapsody\wmlicbackup\drmv1lic.bak "
    Tue 4 Dec 2007 312 ...H. --- "C:\Documents and Settings\Owner\Application Data\Real\rhapsody\wmlicbackup\drmv2key.bak "
    Tue 22 Apr 2008 1,536 A..H. --- "C:\Documents and Settings\Owner\Application Data\Real\rhapsody\wmlicbackup\drmv2lic.bak "

    Finished!
     
    tylerho,
    #3
  5. 2008/05/17
    tylerho

    tylerho Inactive Thread Starter

    Joined:
    2008/02/26
    Messages:
    87
    Likes Received:
    0
    Malwarebytes' Anti-Malware 1.12
    Database version: 759

    Scan type: Quick Scan
    Objects scanned: 53274
    Time elapsed: 21 minute(s), 23 second(s)

    Memory Processes Infected: 1
    Memory Modules Infected: 7
    Registry Keys Infected: 61
    Registry Values Infected: 6
    Registry Data Items Infected: 2
    Folders Infected: 12
    Files Infected: 120

    Memory Processes Infected:
    c:\program files\webhancer\Programs\whagent.exe (Adware.WebHancer) -> No action taken.

    Memory Modules Infected:
    c:\program files\webhancer\Programs\webhdll.dll (Adware.WebHancer) -> No action taken.
    c:\program files\webhancer\Programs\whiehlpr.dll (Adware.WebHancer) -> No action taken.
    C:\WINDOWS\system32\cvxtmkue.dll (Trojan.Vundo) -> No action taken.
    C:\WINDOWS\system32\geBqRhHB.dll (Trojan.Vundo) -> No action taken.
    C:\WINDOWS\system32\rqRIbbaa.dll (Trojan.Vundo) -> No action taken.
    C:\WINDOWS\system32\wvUkLETN.dll (Trojan.Vundo) -> No action taken.
    C:\WINDOWS\system32\jkkKebXN.dll (Trojan.Vundo) -> No action taken.

    Registry Keys Infected:
    HKEY_CLASSES_ROOT\CLSID\{c900b400-cdfe-11d3-976a-00e02913a9e0} (Adware.WebHancer) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c900b400-cdfe-11d3-976a-00e02913a9e0} (Adware.WebHancer) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b71b32f3-bbd5-441d-acb6-0add5f622314} (Trojan.Vundo) -> No action taken.
    HKEY_CLASSES_ROOT\CLSID\{b71b32f3-bbd5-441d-acb6-0add5f622314} (Trojan.Vundo) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cae41607-a20c-4592-8104-f7d81fc55e5a} (Trojan.Vundo) -> No action taken.
    HKEY_CLASSES_ROOT\CLSID\{cae41607-a20c-4592-8104-f7d81fc55e5a} (Trojan.Vundo) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ea3c0ac7-fe15-4ae6-99e5-9dd42939abfd} (Trojan.Vundo) -> No action taken.
    HKEY_CLASSES_ROOT\CLSID\{ea3c0ac7-fe15-4ae6-99e5-9dd42939abfd} (Trojan.Vundo) -> No action taken.
    HKEY_CURRENT_USER\Software\{5222008a-dd62-49c7-a735-7bd18ecc7350} (Rogue.AntiMalwareGuard) -> No action taken.
    HKEY_CLASSES_ROOT\AppID\{ff46f4ab-a85f-487e-b399-3f191ac0fe23} (Trojan.BHO) -> No action taken.
    HKEY_CLASSES_ROOT\Interface\{2e4a04a1-a24d-45ae-aca4-949778400813} (Trojan.BHO) -> No action taken.
    HKEY_CLASSES_ROOT\Typelib\{63334394-3da3-4b29-a041-03535909d361} (Trojan.BHO) -> No action taken.
    HKEY_CLASSES_ROOT\testcpv6.bho (Trojan.Agent) -> No action taken.
    HKEY_CLASSES_ROOT\testcpv6.bho.1 (Trojan.Agent) -> No action taken.
    HKEY_CLASSES_ROOT\AppID\{543bd811-f148-4b3a-a0b9-177014555bf9} (Adware.ISM) -> No action taken.
    HKEY_CLASSES_ROOT\bndblock5.band (Adware.ISM) -> No action taken.
    HKEY_CLASSES_ROOT\bndblock5.band.1 (Adware.ISM) -> No action taken.
    HKEY_CLASSES_ROOT\CLSID\{1f2f95d9-bafd-4769-85a2-4169957db67e} (Adware.ISM) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{1f2f95d9-bafd-4769-85a2-4169957db67e} (Adware.ISM) -> No action taken.
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{1f2f95d9-bafd-4769-85a2-4169957db67e} (Adware.ISM) -> No action taken.
    HKEY_CLASSES_ROOT\bndblock5.bho (Adware.ISM) -> No action taken.
    HKEY_CLASSES_ROOT\bndblock5.bho.1 (Adware.ISM) -> No action taken.
    HKEY_CLASSES_ROOT\bndblock4.band (Adware.ISM) -> No action taken.
    HKEY_CLASSES_ROOT\bndblock4.band.1 (Adware.ISM) -> No action taken.
    HKEY_CLASSES_ROOT\CLSID\{1fe2ebe5-42ff-4586-a144-ca420c84ff6a} (Adware.ISM) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{1fe2ebe5-42ff-4586-a144-ca420c84ff6a} (Adware.ISM) -> No action taken.
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{1fe2ebe5-42ff-4586-a144-ca420c84ff6a} (Adware.ISM) -> No action taken.
    HKEY_CLASSES_ROOT\bndblock4.bho (Adware.ISM) -> No action taken.
    HKEY_CLASSES_ROOT\bndblock4.bho.1 (Adware.ISM) -> No action taken.
    HKEY_CLASSES_ROOT\Interface\{fc6e3735-57b3-48b8-9002-54c155215632} (Trojan.Vundo) -> No action taken.
    HKEY_CLASSES_ROOT\Typelib\{4a9967ab-4c5c-4325-b8c9-4f2be9142c81} (Trojan.Vundo) -> No action taken.
    HKEY_CLASSES_ROOT\whiehelperobj.whiehelperobj.1 (Adware.WebHancer) -> No action taken.
    HKEY_CLASSES_ROOT\Interface\{c89435b0-cdfe-11d3-976a-00e02913a9e0} (Adware.WebHancer) -> No action taken.
    HKEY_CLASSES_ROOT\Typelib\{c8cb3870-cdfe-11d3-976a-00e02913a9e0} (Adware.WebHancer) -> No action taken.
    HKEY_CLASSES_ROOT\CLSID\{66186f05-bbbb-4a39-864f-72d84615c679} (Trojan.FakeAlert) -> No action taken.
    HKEY_CLASSES_ROOT\egmulhxk.msdn_hlp (Trojan.FakeAlert) -> No action taken.
    HKEY_CLASSES_ROOT\CLSID\{ca4f0d8d-5f2b-4f16-838a-8d52249eab21} (Trojan.Vundo) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ca4f0d8d-5f2b-4f16-838a-8d52249eab21} (Trojan.Vundo) -> No action taken.
    HKEY_CLASSES_ROOT\AppID\testCPV6.DLL (Trojan.BHO) -> No action taken.
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\CPV (Trojan.Downloader) -> No action taken.
    HKEY_CURRENT_USER\Software\QdrDrive (Adware.ISM) -> No action taken.
    HKEY_CLASSES_ROOT\AppID\BndBlock4.DLL (Adware.ISM) -> No action taken.
    HKEY_CLASSES_ROOT\AppID\BndBlock5.DLL (Adware.ISM) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TSA (Adware.TargetSaver) -> No action taken.
    HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> No action taken.
    HKEY_CURRENT_USER\Software\Microsoft\affltid (Malware.Trace) -> No action taken.
    HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> No action taken.
    HKEY_CLASSES_ROOT\CLSID\{c7bbc1fa-e415-4926-9a47-9ab58d0b3bc8} (Trojan.Vundo) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c7bbc1fa-e415-4926-9a47-9ab58d0b3bc8} (Trojan.Vundo) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\jkkkebxn (Trojan.Vundo) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> No action taken.
    HKEY_CLASSES_ROOT\whiehelperobj.whiehelperobj (Adware.WebHancer) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\webHancer Agent (Adware.WebHancer) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\webHancer (Adware.WebHancer) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DomainService (Trojan.Agent) -> No action taken.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DomainService (Trojan.Agent) -> No action taken.

    Registry Values Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\webHancer Agent (Adware.WebHancer) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\641cb8cb (Trojan.Vundo) -> No action taken.
    HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions\{59a40ac9-e67d-4155-b31d-4b7330fcd2d6} (Adware.PurityScan) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{ca4f0d8d-5f2b-4f16-838a-8d52249eab21} (Trojan.Vundo) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BM672f8b57 (Trojan.Agent) -> No action taken.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{c7bbc1fa-e415-4926-9a47-9ab58d0b3bc8} (Trojan.Vundo) -> No action taken.

    Registry Data Items Infected:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\wvukletn -> No action taken.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\wvukletn -> No action taken.

    Folders Infected:
    C:\Program Files\Outerinfo (Adware.Outerinfo) -> No action taken.
    C:\Program Files\Outerinfo\FF (Adware.Outerinfo) -> No action taken.
    C:\Program Files\Outerinfo\FF\components (Adware.Outerinfo) -> No action taken.
    C:\Program Files\webHancer (Adware.Webhancer) -> No action taken.
    C:\Program Files\webHancer\Programs (Adware.Webhancer) -> No action taken.
    C:\Program Files\Svconr (Trojan.Agent) -> No action taken.
    C:\Documents and Settings\Owner\Start Menu\Programs\Internet Speed Monitor (Adware.AdSponsor) -> No action taken.
    C:\Documents and Settings\LocalService\Start Menu\Programs\Internet Speed Monitor (Adware.AdSponsor) -> No action taken.
    C:\Documents and Settings\Owner\Start Menu\Programs\Outerinfo (Malware.Trace) -> No action taken.
    C:\Documents and Settings\Owner\Application Data\WinTouch (Adware.WinPop) -> No action taken.
    C:\Documents and Settings\Owner\Application Data\Awola (Rogue.Awola) -> No action taken.
    C:\Documents and Settings\Owner\Start Menu\Programs\Awola (Rogue.Awola) -> No action taken.

    Files Infected:
    c:\program files\webhancer\Programs\webhdll.dll (Adware.WebHancer) -> No action taken.
    c:\program files\webhancer\Programs\whiehlpr.dll (Adware.WebHancer) -> No action taken.
    c:\program files\webhancer\Programs\whagent.exe (Adware.WebHancer) -> No action taken.
    C:\WINDOWS\system32\cvxtmkue.dll (Trojan.Vundo) -> No action taken.
    C:\WINDOWS\system32\eukmtxvc.ini (Trojan.Vundo) -> No action taken.
    C:\WINDOWS\system32\ddbcsoxo.dll (Trojan.Vundo) -> No action taken.
    C:\WINDOWS\system32\oxoscbdd.ini (Trojan.Vundo) -> No action taken.
    C:\WINDOWS\system32\geBqRhHB.dll (Trojan.Vundo) -> No action taken.
    C:\WINDOWS\system32\BHhRqBeg.ini (Trojan.Vundo) -> No action taken.
    C:\WINDOWS\system32\BHhRqBeg.ini2 (Trojan.Vundo) -> No action taken.
    C:\WINDOWS\system32\rqRIbbaa.dll (Trojan.Vundo) -> No action taken.
    C:\WINDOWS\system32\aabbIRqr.ini (Trojan.Vundo) -> No action taken.
    C:\WINDOWS\system32\aabbIRqr.ini2 (Trojan.Vundo) -> No action taken.
    C:\WINDOWS\system32\wvUkLETN.dll (Trojan.Vundo) -> No action taken.
    C:\WINDOWS\system32\NTELkUvw.ini (Trojan.Vundo) -> No action taken.
    C:\WINDOWS\system32\NTELkUvw.ini2 (Trojan.Vundo) -> No action taken.
    C:\WINDOWS\system32\LB6D6.tmp (Trojan.Downloader) -> No action taken.
    C:\WINDOWS\system32\tsuninst.exe (Spyware.TargetSaver) -> No action taken.
    C:\WINDOWS\b2new.exe (Trojan.Downloader) -> No action taken.
    C:\WINDOWS\lfn.exe (Trojan.FakeAlert) -> No action taken.
    C:\Documents and Settings\Owner\Local Settings\Temp\cmdinst.exe (Trojan.Proxy) -> No action taken.
    C:\Documents and Settings\Owner\Local Settings\Temp\D75.tmp (Adware.PurityScan) -> No action taken.
    C:\Documents and Settings\Owner\Local Settings\Temp\outerinfo.ico (Malware.Trace) -> No action taken.
    C:\Documents and Settings\Owner\Local Settings\Temp\TMP98.tmp (Trojan.Agent) -> No action taken.
    C:\Documents and Settings\Owner\Local Settings\Temp\tsupdate_4_0_4_1_b3.exe (Trojan.Downloader) -> No action taken.
    C:\Documents and Settings\Owner\Local Settings\Temp\Update.exe (Trojan.Agent) -> No action taken.
    C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\NHSR157S\!update-4495[1].0000 (Adware.PurityScan) -> No action taken.
    C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\USHQPULT\718f466754402ac597de014577627f96[1].zip (Trojan.Downloader) -> No action taken.
    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\GNE1WJTH\b2new[1].exe (Trojan.Downloader) -> No action taken.
    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\QEVWX7CH\syswcc32[1].exe (Adware.Webhancer) -> No action taken.
    C:\Program Files\Outerinfo\Terms.rtf (Adware.Outerinfo) -> No action taken.
    C:\Program Files\Outerinfo\FF\chrome.manifest (Adware.Outerinfo) -> No action taken.
    C:\Program Files\Outerinfo\FF\install.rdf (Adware.Outerinfo) -> No action taken.
    C:\Program Files\Outerinfo\FF\components\OuterinfoAds.xpt (Adware.Outerinfo) -> No action taken.
    C:\Program Files\webHancer\Programs\license.txt (Adware.Webhancer) -> No action taken.
    C:\Program Files\webHancer\Programs\readme.txt (Adware.Webhancer) -> No action taken.
    C:\Program Files\webHancer\Programs\sporder.dll (Adware.Webhancer) -> No action taken.
    C:\Program Files\webHancer\Programs\whagent.ini (Adware.Webhancer) -> No action taken.
    C:\Program Files\webHancer\Programs\whinstaller.exe (Adware.Webhancer) -> No action taken.
    C:\Program Files\Svconr\Svconr.exe (Trojan.Agent) -> No action taken.
    C:\Documents and Settings\Owner\Start Menu\Programs\Internet Speed Monitor\Check Now.lnk (Adware.AdSponsor) -> No action taken.
    C:\Documents and Settings\Owner\Start Menu\Programs\Internet Speed Monitor\Uninstall.lnk (Adware.AdSponsor) -> No action taken.
    C:\Documents and Settings\LocalService\Start Menu\Programs\Internet Speed Monitor\Check Now.lnk (Adware.AdSponsor) -> No action taken.
    C:\Documents and Settings\LocalService\Start Menu\Programs\Internet Speed Monitor\Uninstall.lnk (Adware.AdSponsor) -> No action taken.
    C:\Documents and Settings\Owner\Start Menu\Programs\Outerinfo\Terms.lnk (Malware.Trace) -> No action taken.
    C:\Documents and Settings\Owner\Start Menu\Programs\Outerinfo\Uninstall.lnk (Malware.Trace) -> No action taken.
    C:\Documents and Settings\Owner\Application Data\WinTouch\wintouch.cfg (Adware.WinPop) -> No action taken.
    C:\Documents and Settings\Owner\Application Data\WinTouch\WTUninstaller.exe (Adware.WinPop) -> No action taken.
    C:\Documents and Settings\Owner\Application Data\Awola\Awola001.bas (Rogue.Awola) -> No action taken.
    C:\Documents and Settings\Owner\Application Data\Awola\settings.ini (Rogue.Awola) -> No action taken.
    C:\Documents and Settings\Owner\Start Menu\Programs\Awola\Awola Anti-Spyware 6.0.lnk (Rogue.Awola) -> No action taken.
    C:\Documents and Settings\Owner\Start Menu\Programs\Awola\Uninstall Awola Anti-Spyware 6.0.lnk (Rogue.Awola) -> No action taken.
    C:\WINDOWS\homepage.html (Malware.Trace) -> No action taken.
    C:\WINDOWS\promo1.html (Malware.Trace) -> No action taken.
    C:\WINDOWS\promo2.html (Malware.Trace) -> No action taken.
    C:\WINDOWS\promo3.html (Malware.Trace) -> No action taken.
    C:\WINDOWS\promo4.html (Malware.Trace) -> No action taken.
    C:\WINDOWS\promo5.html (Malware.Trace) -> No action taken.
    C:\WINDOWS\promo6.html (Malware.Trace) -> No action taken.
    C:\WINDOWS\promogif1.gif (Malware.Trace) -> No action taken.
    C:\WINDOWS\promogif2.gif (Malware.Trace) -> No action taken.
    C:\WINDOWS\promogif3.gif (Malware.Trace) -> No action taken.
    C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiSpywareMaster.lnk (Rogue.AntiSpywareMaster) -> No action taken.
    C:\WINDOWS\system32\ywveirxm.dll (Trojan.Agent) -> No action taken.
    C:\WINDOWS\b116.exe.bin (Trojan.Dropper) -> No action taken.
    C:\WINDOWS\system32\jkkKebXN.dll (Trojan.Vundo) -> No action taken.
    C:\WINDOWS\system32\stfv.bin (Fake.Dropped.Malware) -> No action taken.
    C:\WINDOWS\system32\din.ip (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\blank.gif (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\box_2.gif (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\button_buynow.gif (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\button_freescan.gif (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\cell_bg.gif (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\cell_footer.gif (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\cell_header_block.gif (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\cell_header_remove.gif (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\cell_header_scan.gif (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\detect.htm (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\download_btn.jpg (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\download_now_btn.gif (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\footer_back.jpg (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\header_1.gif (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\header_2.gif (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\header_3.gif (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\header_4.gif (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\header_red_bg.gif (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\header_red_free_scan.gif (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\header_red_free_scan_bg.gif (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\header_red_protect_your_pc.gif (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\infected.gif (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\main_back.gif (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\product_2_header.gif (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\product_2_name_small.gif (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\product_features.gif (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\pt.htm (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\rating.gif (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\s_detect.htm (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\screenshot.jpg (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\sep_hor.gif (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\sep_vert.gif (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\shadow.jpg (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\shadow_bg.gif (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\spacer.gif (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\star.gif (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\star_gray.gif (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\star_gray_small.gif (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\star_small.gif (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\style.css (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\v.gif (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\warning_icon.gif (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\win_logo.gif (Malware.Trace) -> No action taken.
    C:\WINDOWS\system32\drivers\x.gif (Malware.Trace) -> No action taken.
    C:\WINDOWS\spredirect.dll (Fake.Dropped.Malware) -> No action taken.
    C:\WINDOWS\system32\dpqaqlqx.bin (Fake.Dropped.Malware) -> No action taken.
    C:\WINDOWS\system32\jpewocmz.ini (Fake.Dropped.Malware) -> No action taken.
    C:\Documents and Settings\Owner\Desktop\AntiSpywareMaster.lnk (Rogue.AntiSpywareMaster) -> No action taken.
    C:\Documents and Settings\Owner\Local Settings\Temp\!update.exe (Trojan.Downloader) -> No action taken.
    C:\Documents and Settings\Owner\~.exe (Trojan.Agent) -> No action taken.
    C:\Documents and Settings\Owner\Local Settings\Temp\ismtpa15.exe (Adware.ISM) -> No action taken.
    C:\Documents and Settings\Owner\Local Settings\Temp\ismtpa16.exe (Adware.ISM) -> No action taken.
     
    tylerho,
    #4
  6. 2008/05/17
    tylerho

    tylerho Inactive Thread Starter

    Joined:
    2008/02/26
    Messages:
    87
    Likes Received:
    0
    I am unable to run ComboFix. The website will not display. Also, the only major symptoms I am getting now is I am unable to access task manager and other system controls. Thank you for all of your help!!


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 3:01:15 PM, on 5/17/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
    C:\Program Files\Norton AntiVirus\SAVScan.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\QuickTime\qttask .exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
    C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://c:/windows/homepage.html
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file://c:/windows/homepage.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://c:/windows/homepage.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = file://c:/windows/homepage.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://c:/windows/homepage.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = file://c:/windows/homepage.html
    O2 - BHO: (no name) - {0199CD2D-45AF-4B00-86D9-D5656DE67011} - C:\WINDOWS\system32\awvvs.dll (file missing)
    O2 - BHO: {c3073a68-f4b9-0a29-7014-cc866854a0d5} - {5d0a4586-68cc-4107-92a0-9b4f86a3703c} - C:\WINDOWS\system32\ipjekuqy.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: (no name) - {90ABFF40-6DF9-1C5E-8B2E-4FE678885B94} - C:\WINDOWS\system32\bqitjgn.dll (file missing)
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask .exe" -atboottime
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe "
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
    O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [Ixodry] "C:\Documents and Settings\Owner\My Documents\??crosoft.NET\r?ndll32.exe "
    O4 - HKCU\..\Run: [Awola] "C:\Documents and Settings\Owner\Application Data\Awola\Awola.exe" /MIN
    O4 - HKCU\..\Run: [Qwpofaf] "C:\Documents and Settings\Owner\Application Data\??sembly\??oolsv.exe "
    O4 - HKCU\..\Run: [Xkpmfm] "C:\Documents and Settings\Owner\My Documents\s?curity\s?rvices.exe "
    O4 - HKCU\..\Run: [Fhfiq] "C:\Program Files\??stem32\d?xplore.exe "
    O4 - HKCU\..\Run: [QdrPack16] "C:\Program Files\QdrPack\QdrPack16.exe "
    O4 - HKCU\..\Run: [QdrModule16] "C:\Program Files\QdrModule\QdrModule16.exe "
    O4 - HKUS\S-1-5-18\..\Run: [QdrModule15] "C:\Program Files\QdrModule\QdrModule15.exe" (User 'SYSTEM')
    O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9d.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [QdrModule15] "C:\Program Files\QdrModule\QdrModule15.exe" (User 'Default user')
    O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9d.exe (User 'Default user')
    O4 - Startup: Picture Motion Browser Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u5-windows-i586-jc.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Filter hijack: text/html - {07851C6A-1C43-41d9-8319-BC89154A8C00} - C:\Program Files\RcvSystem\httpdchk.dll
    O20 - Winlogon Notify: gebyvsp - gebyvsp.dll (file missing)
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

    --
    End of file - 7583 bytes
     
    tylerho,
    #5
  7. 2008/05/17
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi
    Please run MBAM again.
    See here..
    No action taken.

    Make sure you follow the instruction exacly as given

    Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    If an update is found, it will download and install the latest version.
    Once the program has loaded, select 'Perform Quick Scan', then click Scan.
    The scan may take some time to finish,so please be patient.
    When the scan is complete, click OK, then Show Results to view the results.
    Make sure that everything is checked, and click Remove Selected.
    When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note below)
    The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
    Post the entire report in your next reply along with a fresh HijackThis log. Let me know what issues still exist.

    I don't understand? What web site?

    Please tell me what happens.

    Thanks
    Geri
     
    Geri,
    #6
  8. 2008/05/17
    tylerho

    tylerho Inactive Thread Starter

    Joined:
    2008/02/26
    Messages:
    87
    Likes Received:
    0
    Malwarebytes' Anti-Malware 1.12
    Database version: 759

    Scan type: Quick Scan
    Objects scanned: 53274
    Time elapsed: 21 minute(s), 23 second(s)

    Memory Processes Infected: 1
    Memory Modules Infected: 7
    Registry Keys Infected: 61
    Registry Values Infected: 6
    Registry Data Items Infected: 2
    Folders Infected: 12
    Files Infected: 120

    Memory Processes Infected:
    c:\program files\webhancer\Programs\whagent.exe (Adware.WebHancer) -> Unloaded process successfully.

    Memory Modules Infected:
    c:\program files\webhancer\Programs\webhdll.dll (Adware.WebHancer) -> Unloaded module successfully.
    c:\program files\webhancer\Programs\whiehlpr.dll (Adware.WebHancer) -> Unloaded module successfully.
    C:\WINDOWS\system32\cvxtmkue.dll (Trojan.Vundo) -> Unloaded module successfully.
    C:\WINDOWS\system32\geBqRhHB.dll (Trojan.Vundo) -> Unloaded module successfully.
    C:\WINDOWS\system32\rqRIbbaa.dll (Trojan.Vundo) -> Unloaded module successfully.
    C:\WINDOWS\system32\wvUkLETN.dll (Trojan.Vundo) -> Unloaded module successfully.
    C:\WINDOWS\system32\jkkKebXN.dll (Trojan.Vundo) -> Unloaded module successfully.

    Registry Keys Infected:
    HKEY_CLASSES_ROOT\CLSID\{c900b400-cdfe-11d3-976a-00e02913a9e0} (Adware.WebHancer) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c900b400-cdfe-11d3-976a-00e02913a9e0} (Adware.WebHancer) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{b71b32f3-bbd5-441d-acb6-0add5f622314} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{b71b32f3-bbd5-441d-acb6-0add5f622314} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cae41607-a20c-4592-8104-f7d81fc55e5a} (Trojan.Vundo) -> Delete on reboot.
    HKEY_CLASSES_ROOT\CLSID\{cae41607-a20c-4592-8104-f7d81fc55e5a} (Trojan.Vundo) -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ea3c0ac7-fe15-4ae6-99e5-9dd42939abfd} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{ea3c0ac7-fe15-4ae6-99e5-9dd42939abfd} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\{5222008a-dd62-49c7-a735-7bd18ecc7350} (Rogue.AntiMalwareGuard) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\AppID\{ff46f4ab-a85f-487e-b399-3f191ac0fe23} (Trojan.BHO) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{2e4a04a1-a24d-45ae-aca4-949778400813} (Trojan.BHO) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{63334394-3da3-4b29-a041-03535909d361} (Trojan.BHO) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\testcpv6.bho (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\testcpv6.bho.1 (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\AppID\{543bd811-f148-4b3a-a0b9-177014555bf9} (Adware.ISM) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\bndblock5.band (Adware.ISM) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\bndblock5.band.1 (Adware.ISM) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{1f2f95d9-bafd-4769-85a2-4169957db67e} (Adware.ISM) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{1f2f95d9-bafd-4769-85a2-4169957db67e} (Adware.ISM) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{1f2f95d9-bafd-4769-85a2-4169957db67e} (Adware.ISM) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\bndblock5.bho (Adware.ISM) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\bndblock5.bho.1 (Adware.ISM) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\bndblock4.band (Adware.ISM) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\bndblock4.band.1 (Adware.ISM) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{1fe2ebe5-42ff-4586-a144-ca420c84ff6a} (Adware.ISM) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Explorer Bars\{1fe2ebe5-42ff-4586-a144-ca420c84ff6a} (Adware.ISM) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Explorer Bars\{1fe2ebe5-42ff-4586-a144-ca420c84ff6a} (Adware.ISM) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\bndblock4.bho (Adware.ISM) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\bndblock4.bho.1 (Adware.ISM) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{fc6e3735-57b3-48b8-9002-54c155215632} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{4a9967ab-4c5c-4325-b8c9-4f2be9142c81} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\whiehelperobj.whiehelperobj.1 (Adware.WebHancer) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Interface\{c89435b0-cdfe-11d3-976a-00e02913a9e0} (Adware.WebHancer) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\Typelib\{c8cb3870-cdfe-11d3-976a-00e02913a9e0} (Adware.WebHancer) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{66186f05-bbbb-4a39-864f-72d84615c679} (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\egmulhxk.msdn_hlp (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{ca4f0d8d-5f2b-4f16-838a-8d52249eab21} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{ca4f0d8d-5f2b-4f16-838a-8d52249eab21} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\AppID\testCPV6.DLL (Trojan.BHO) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Uninstall\CPV (Trojan.Downloader) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\QdrDrive (Adware.ISM) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\AppID\BndBlock4.DLL (Adware.ISM) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\AppID\BndBlock5.DLL (Adware.ISM) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\aoprndtws (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\TSA (Adware.TargetSaver) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Microsoft\rdfa (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affltid (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\affri (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\CLSID\{c7bbc1fa-e415-4926-9a47-9ab58d0b3bc8} (Trojan.Vundo) -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c7bbc1fa-e415-4926-9a47-9ab58d0b3bc8} (Trojan.Vundo) -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\jkkkebxn (Trojan.Vundo) -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CLASSES_ROOT\whiehelperobj.whiehelperobj (Adware.WebHancer) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\webHancer Agent (Adware.WebHancer) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\webHancer (Adware.WebHancer) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DomainService (Trojan.Agent) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\DomainService (Trojan.Agent) -> Quarantined and deleted successfully.

    Registry Values Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\webHancer Agent (Adware.WebHancer) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\641cb8cb (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\Software\Mozilla\Firefox\Extensions\{59a40ac9-e67d-4155-b31d-4b7330fcd2d6} (Adware.PurityScan) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{ca4f0d8d-5f2b-4f16-838a-8d52249eab21} (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BM672f8b57 (Trojan.Agent) -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{c7bbc1fa-e415-4926-9a47-9ab58d0b3bc8} (Trojan.Vundo) -> Delete on reboot.

    Registry Data Items Infected:
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\LSA\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\wvukletn -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Lsa\Authentication Packages (Trojan.Vundo) -> Data: c:\windows\system32\wvukletn -> Delete on reboot.

    Folders Infected:
    C:\Program Files\Outerinfo (Adware.Outerinfo) -> Quarantined and deleted successfully.
    C:\Program Files\Outerinfo\FF (Adware.Outerinfo) -> Quarantined and deleted successfully.
    C:\Program Files\Outerinfo\FF\components (Adware.Outerinfo) -> Quarantined and deleted successfully.
    C:\Program Files\webHancer (Adware.Webhancer) -> Delete on reboot.
    C:\Program Files\webHancer\Programs (Adware.Webhancer) -> Delete on reboot.
    C:\Program Files\Svconr (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Owner\Start Menu\Programs\Internet Speed Monitor (Adware.AdSponsor) -> Quarantined and deleted successfully.
    C:\Documents and Settings\LocalService\Start Menu\Programs\Internet Speed Monitor (Adware.AdSponsor) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Owner\Start Menu\Programs\Outerinfo (Malware.Trace) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Owner\Application Data\WinTouch (Adware.WinPop) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Owner\Application Data\Awola (Rogue.Awola) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Owner\Start Menu\Programs\Awola (Rogue.Awola) -> Quarantined and deleted successfully.

    Files Infected:
    c:\program files\webhancer\Programs\webhdll.dll (Adware.WebHancer) -> Delete on reboot.
    c:\program files\webhancer\Programs\whiehlpr.dll (Adware.WebHancer) -> Delete on reboot.
    c:\program files\webhancer\Programs\whagent.exe (Adware.WebHancer) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\cvxtmkue.dll (Trojan.Vundo) -> Delete on reboot.
    C:\WINDOWS\system32\eukmtxvc.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\ddbcsoxo.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\oxoscbdd.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\geBqRhHB.dll (Trojan.Vundo) -> Delete on reboot.
    C:\WINDOWS\system32\BHhRqBeg.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\BHhRqBeg.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\rqRIbbaa.dll (Trojan.Vundo) -> Delete on reboot.
    C:\WINDOWS\system32\aabbIRqr.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\aabbIRqr.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\wvUkLETN.dll (Trojan.Vundo) -> Delete on reboot.
    C:\WINDOWS\system32\NTELkUvw.ini (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\NTELkUvw.ini2 (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\LB6D6.tmp (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\tsuninst.exe (Spyware.TargetSaver) -> Quarantined and deleted successfully.
    C:\WINDOWS\b2new.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\WINDOWS\lfn.exe (Trojan.FakeAlert) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Owner\Local Settings\Temp\cmdinst.exe (Trojan.Proxy) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Owner\Local Settings\Temp\D75.tmp (Adware.PurityScan) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Owner\Local Settings\Temp\outerinfo.ico (Malware.Trace) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Owner\Local Settings\Temp\TMP98.tmp (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Owner\Local Settings\Temp\tsupdate_4_0_4_1_b3.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Owner\Local Settings\Temp\Update.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\NHSR157S\!update-4495[1].0000 (Adware.PurityScan) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\Content.IE5\USHQPULT\718f466754402ac597de014577627f96[1].zip (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\GNE1WJTH\b2new[1].exe (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\QEVWX7CH\syswcc32[1].exe (Adware.Webhancer) -> Quarantined and deleted successfully.
    C:\Program Files\Outerinfo\Terms.rtf (Adware.Outerinfo) -> Quarantined and deleted successfully.
    C:\Program Files\Outerinfo\FF\chrome.manifest (Adware.Outerinfo) -> Quarantined and deleted successfully.
    C:\Program Files\Outerinfo\FF\install.rdf (Adware.Outerinfo) -> Quarantined and deleted successfully.
    C:\Program Files\Outerinfo\FF\components\OuterinfoAds.xpt (Adware.Outerinfo) -> Quarantined and deleted successfully.
    C:\Program Files\webHancer\Programs\license.txt (Adware.Webhancer) -> Quarantined and deleted successfully.
    C:\Program Files\webHancer\Programs\readme.txt (Adware.Webhancer) -> Quarantined and deleted successfully.
    C:\Program Files\webHancer\Programs\sporder.dll (Adware.Webhancer) -> Quarantined and deleted successfully.
    C:\Program Files\webHancer\Programs\whagent.ini (Adware.Webhancer) -> Quarantined and deleted successfully.
    C:\Program Files\webHancer\Programs\whinstaller.exe (Adware.Webhancer) -> Quarantined and deleted successfully.
    C:\Program Files\Svconr\Svconr.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Owner\Start Menu\Programs\Internet Speed Monitor\Check Now.lnk (Adware.AdSponsor) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Owner\Start Menu\Programs\Internet Speed Monitor\Uninstall.lnk (Adware.AdSponsor) -> Quarantined and deleted successfully.
    C:\Documents and Settings\LocalService\Start Menu\Programs\Internet Speed Monitor\Check Now.lnk (Adware.AdSponsor) -> Quarantined and deleted successfully.
    C:\Documents and Settings\LocalService\Start Menu\Programs\Internet Speed Monitor\Uninstall.lnk (Adware.AdSponsor) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Owner\Start Menu\Programs\Outerinfo\Terms.lnk (Malware.Trace) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Owner\Start Menu\Programs\Outerinfo\Uninstall.lnk (Malware.Trace) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Owner\Application Data\WinTouch\wintouch.cfg (Adware.WinPop) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Owner\Application Data\WinTouch\WTUninstaller.exe (Adware.WinPop) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Owner\Application Data\Awola\Awola001.bas (Rogue.Awola) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Owner\Application Data\Awola\settings.ini (Rogue.Awola) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Owner\Start Menu\Programs\Awola\Awola Anti-Spyware 6.0.lnk (Rogue.Awola) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Owner\Start Menu\Programs\Awola\Uninstall Awola Anti-Spyware 6.0.lnk (Rogue.Awola) -> Quarantined and deleted successfully.
    C:\WINDOWS\homepage.html (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\promo1.html (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\promo2.html (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\promo3.html (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\promo4.html (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\promo5.html (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\promo6.html (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\promogif1.gif (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\promogif2.gif (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\promogif3.gif (Malware.Trace) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Owner\Application Data\Microsoft\Internet Explorer\Quick Launch\AntiSpywareMaster.lnk (Rogue.AntiSpywareMaster) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\ywveirxm.dll (Trojan.Agent) -> Delete on reboot.
    C:\WINDOWS\b116.exe.bin (Trojan.Dropper) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\jkkKebXN.dll (Trojan.Vundo) -> Delete on reboot.
    C:\WINDOWS\system32\stfv.bin (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\din.ip (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\blank.gif (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\box_2.gif (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\button_buynow.gif (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\button_freescan.gif (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\cell_bg.gif (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\cell_footer.gif (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\cell_header_block.gif (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\cell_header_remove.gif (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\cell_header_scan.gif (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\detect.htm (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\download_btn.jpg (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\download_now_btn.gif (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\footer_back.jpg (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\header_1.gif (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\header_2.gif (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\header_3.gif (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\header_4.gif (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\header_red_bg.gif (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\header_red_free_scan.gif (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\header_red_free_scan_bg.gif (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\header_red_protect_your_pc.gif (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\infected.gif (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\main_back.gif (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\product_2_header.gif (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\product_2_name_small.gif (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\product_features.gif (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\pt.htm (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\rating.gif (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\s_detect.htm (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\screenshot.jpg (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\sep_hor.gif (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\sep_vert.gif (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\shadow.jpg (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\shadow_bg.gif (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\spacer.gif (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\star.gif (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\star_gray.gif (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\star_gray_small.gif (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\star_small.gif (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\style.css (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\v.gif (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\warning_icon.gif (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\win_logo.gif (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\drivers\x.gif (Malware.Trace) -> Quarantined and deleted successfully.
    C:\WINDOWS\spredirect.dll (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\dpqaqlqx.bin (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\jpewocmz.ini (Fake.Dropped.Malware) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Owner\Desktop\AntiSpywareMaster.lnk (Rogue.AntiSpywareMaster) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Owner\Local Settings\Temp\!update.exe (Trojan.Downloader) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Owner\~.exe (Trojan.Agent) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Owner\Local Settings\Temp\ismtpa15.exe (Adware.ISM) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Owner\Local Settings\Temp\ismtpa16.exe (Adware.ISM) -> Quarantined and deleted successfully.
     
    tylerho,
    #7
  9. 2008/05/17
    tylerho

    tylerho Inactive Thread Starter

    Joined:
    2008/02/26
    Messages:
    87
    Likes Received:
    0
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 6:10:32 PM, on 5/17/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
    C:\Program Files\Norton AntiVirus\SAVScan.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\QuickTime\qttask .exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
    C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = file://c:/windows/homepage.html
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file://c:/windows/homepage.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = file://c:/windows/homepage.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = file://c:/windows/homepage.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = file://c:/windows/homepage.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = file://c:/windows/homepage.html
    O2 - BHO: (no name) - {0199CD2D-45AF-4B00-86D9-D5656DE67011} - C:\WINDOWS\system32\awvvs.dll (file missing)
    O2 - BHO: {c3073a68-f4b9-0a29-7014-cc866854a0d5} - {5d0a4586-68cc-4107-92a0-9b4f86a3703c} - C:\WINDOWS\system32\ipjekuqy.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: (no name) - {90ABFF40-6DF9-1C5E-8B2E-4FE678885B94} - C:\WINDOWS\system32\bqitjgn.dll (file missing)
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask .exe" -atboottime
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe "
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
    O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
    O4 - HKLM\..\RunOnce: [getPlusUninstall_ocx] rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS\inf\GETPLUSo.INF, DefaultUninstall
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [Ixodry] "C:\Documents and Settings\Owner\My Documents\??crosoft.NET\r?ndll32.exe "
    O4 - HKCU\..\Run: [Awola] "C:\Documents and Settings\Owner\Application Data\Awola\Awola.exe" /MIN
    O4 - HKCU\..\Run: [Qwpofaf] "C:\Documents and Settings\Owner\Application Data\??sembly\??oolsv.exe "
    O4 - HKCU\..\Run: [Xkpmfm] "C:\Documents and Settings\Owner\My Documents\s?curity\s?rvices.exe "
    O4 - HKCU\..\Run: [Fhfiq] "C:\Program Files\??stem32\d?xplore.exe "
    O4 - HKCU\..\Run: [QdrPack16] "C:\Program Files\QdrPack\QdrPack16.exe "
    O4 - HKCU\..\Run: [QdrModule16] "C:\Program Files\QdrModule\QdrModule16.exe "
    O4 - HKUS\S-1-5-18\..\Run: [QdrModule15] "C:\Program Files\QdrModule\QdrModule15.exe" (User 'SYSTEM')
    O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9d.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [QdrModule15] "C:\Program Files\QdrModule\QdrModule15.exe" (User 'Default user')
    O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9d.exe (User 'Default user')
    O4 - Startup: Picture Motion Browser Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u5-windows-i586-jc.cab
    O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Filter hijack: text/html - {07851C6A-1C43-41d9-8319-BC89154A8C00} - C:\Program Files\RcvSystem\httpdchk.dll
    O20 - Winlogon Notify: gebyvsp - gebyvsp.dll (file missing)
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

    --
    End of file - 7805 bytes
     
    tylerho,
    #8
  10. 2008/05/17
    tylerho

    tylerho Inactive Thread Starter

    Joined:
    2008/02/26
    Messages:
    87
    Likes Received:
    0
    ComboFix 08-05-15.3 - Owner 2008-05-17 18:15:50.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.267 [GMT -5:00]
    Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Documents and Settings\Owner\Application Data\CROSOF~1
    C:\Documents and Settings\Owner\Application Data\FNTS~1
    C:\Documents and Settings\Owner\Application Data\RACLE~1
    C:\Documents and Settings\Owner\Application Data\RACLE~1\?racle\
    C:\Documents and Settings\Owner\Application Data\RACLE~1\rundll .exe
    C:\Documents and Settings\Owner\Application Data\SEMBLY~1
    C:\Documents and Settings\Owner\Application Data\SKS~1
    C:\Documents and Settings\Owner\Application Data\SSEMBL~1
    C:\Documents and Settings\Owner\Application Data\STEM32~1
    C:\Documents and Settings\Owner\Application Data\YMANTE~1
    C:\Documents and Settings\Owner\My Documents\CROSOF~1.NET
    C:\Documents and Settings\Owner\My Documents\PPATCH~1
    C:\Documents and Settings\Owner\My Documents\RACLE~1
    C:\Documents and Settings\Owner\My Documents\SCURIT~1
    C:\Documents and Settings\Owner\My Documents\SEMBLY~1
    C:\Documents and Settings\Owner\My Documents\STEM32~1
    C:\Documents and Settings\Owner\My Documents\YMANTE~1
    C:\kmd.exe
    C:\Program Files\Common Files\asks~1
    C:\Program Files\Common Files\icroso~1.net
    C:\Program Files\Common Files\smante~1
    C:\Program Files\Common Files\smbols~1
    C:\Program Files\Common Files\stem32~1
    C:\Program Files\Common Files\ymbols~1
    C:\Program Files\Common Files\ystem~1
    C:\Program Files\icroso~1.net
    C:\Program Files\sembly~1
    C:\Program Files\sstem3~1
    C:\Program Files\stem32~1
    C:\Program Files\stem32~1\d?xplore.exe
    C:\Program Files\webhancer
    C:\Program Files\webhancer\Programs\webhdll.dll
    C:\Program Files\webhancer\Programs\whiehlpr.dll
    C:\Program Files\wnsxs~1
    C:\Program Files\ystem3~1
    C:\WINDOWS\cookies.ini
    C:\WINDOWS\fnts~1
    C:\WINDOWS\fnts~2
    C:\WINDOWS\mainms.vpi
    C:\WINDOWS\pskt.ini
    C:\WINDOWS\sstem~1
    C:\WINDOWS\system32\abjhsxlg.dll
    C:\WINDOWS\system32\bbmhdtrc.dll
    C:\WINDOWS\system32\cfbbsaqx.dll
    C:\WINDOWS\system32\clksbjkn.ini
    C:\WINDOWS\system32\crosof~1
    C:\WINDOWS\system32\cvxtmkue.dll
    C:\WINDOWS\system32\dqcrerhe.ini
    C:\WINDOWS\system32\ffcaogjj.dll
    C:\WINDOWS\system32\geBqRhHB.dll
    C:\WINDOWS\system32\hiobphbf.exe
    C:\WINDOWS\system32\hlkwdfgo.exe
    C:\WINDOWS\system32\hqofoeop.ini
    C:\WINDOWS\system32\icroso~1
    C:\WINDOWS\system32\icroso~1.net
    C:\WINDOWS\system32\ilslxrqe.dll
    C:\WINDOWS\system32\ipjekuqy.dll
    C:\WINDOWS\system32\jcoaichm.dll
    C:\WINDOWS\system32\jkkKebXN.dll
    C:\WINDOWS\system32\lsotcptt.dll
    C:\WINDOWS\system32\mcrh.tmp
    C:\WINDOWS\system32\ndugwyud.dll
    C:\WINDOWS\system32\NTELkUvw.ini
    C:\WINDOWS\system32\ppatch~1
    C:\WINDOWS\system32\qgjvlhbt.ini
    C:\WINDOWS\system32\qrmykfda.ini
    C:\WINDOWS\system32\rqRIbbaa.dll
    C:\WINDOWS\system32\sfpjyetn.exe
    C:\WINDOWS\system32\sstem~1
    C:\WINDOWS\system32\svvwa.ini
    C:\WINDOWS\system32\svvwa.ini2
    C:\WINDOWS\system32\sznf.ascii
    C:\WINDOWS\system32\tedcdcdo.ini
    C:\WINDOWS\system32\ukgnjnnt.exe
    C:\WINDOWS\system32\uqhhcuae.dll
    C:\WINDOWS\system32\wcmanvle.dll
    C:\WINDOWS\system32\xbugjrcc.dll
    C:\WINDOWS\system32\xjybgftf.exe
    C:\WINDOWS\system32\yaunkfpf.exe
    C:\WINDOWS\system32\yhufowni.dll
    C:\WINDOWS\system32\ystem3~1
    C:\WINDOWS\system32\ywekqxtp.dll
    C:\WINDOWS\system32\ywveirxm.dll
    C:\WINDOWS\wnsxs~1
    C:\WINDOWS\ymbols~1

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_DOMAINSERVICE


    ((((((((((((((((((((((((( Files Created from 2008-04-17 to 2008-05-17 )))))))))))))))))))))))))))))))
    .

    2008-05-17 18:15 . 2008-05-17 18:15 1,024 --ah----- C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG
    2008-05-17 14:50 . 2008-05-17 14:50 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg7
    2008-05-17 14:14 . 2008-05-05 20:46 27,048 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
    2008-05-17 14:14 . 2008-05-05 20:46 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-05-17 13:58 . 2008-05-17 13:58 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Malwarebytes
    2008-05-17 13:57 . 2008-05-17 14:14 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-05-17 13:57 . 2008-05-17 13:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-05-17 13:19 . 2008-05-17 13:19 <DIR> d-------- C:\WINDOWS\ERUNT
    2008-05-17 13:18 . 2008-05-17 13:18 <DIR> d-------- C:\Documents and Settings\Administrator.CD043221501-1
    2008-05-17 13:18 . 2008-05-17 18:15 1,024 --ah----- C:\Documents and Settings\Administrator.CD043221501-1\ntuser.dat.LOG
    2008-05-17 13:15 . 2008-05-17 13:52 <DIR> d-------- C:\SDFix
    2008-05-17 09:30 . 2008-05-17 09:30 <DIR> d-------- C:\Program Files\Trend Micro
    2008-05-10 21:17 . 2008-05-17 14:40 316,480 --------- C:\WINDOWS\system32\wvUkLETN.dll
    2008-05-10 19:16 . 2008-05-17 13:14 109,803 --a------ C:\WINDOWS\BM672f8b57.xml
    2008-05-10 14:20 . 2008-05-17 09:35 54,156 --ah----- C:\WINDOWS\QTFont.qfn
    2008-05-10 14:20 . 2008-05-10 14:20 1,409 --a------ C:\WINDOWS\QTFont.for
    2008-04-30 23:45 . 2008-05-08 21:17 22 --a------ C:\WINDOWS\b148.exe.bin
    2008-04-23 15:31 . 2008-05-07 16:08 22 --a------ C:\WINDOWS\b999.exe.bin

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-05-17 23:21 --------- d-----w C:\Program Files\Google
    2008-05-17 19:51 --------- d-----w C:\Program Files\LimeWire
    2008-05-17 19:48 --------- d-----w C:\Program Files\Common Files\Adobe
    2008-05-17 14:25 --------- d-----w C:\Program Files\Common Files\Symantec Shared
    2008-05-15 00:44 --------- d-----w C:\Program Files\Norton Security Scan
    2008-04-23 03:16 --------- d-----w C:\Program Files\Best Buy Rhapsody
    2008-04-13 21:19 --------- d-----w C:\Documents and Settings\Owner\Application Data\LimeWire
    2008-03-31 04:01 133,197,120 ----a-w C:\Program Files\OOo_2.4.0_Win32Intel_install_wJRE_en-US.exe
    2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll
    2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
    2008-03-01 13:06 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
    2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
    2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
    2008-02-17 08:21 1,094,772 ----a-w C:\Program Files\Whennottocleanyourglasses.wmv
    2008-01-21 05:03 57,016 ----a-w C:\Documents and Settings\Owner\Application Data\GDIPFONTCACHEV1.DAT
    2008-01-08 03:38 0 --sha-w C:\Documents and Settings\Owner\Application Data\9a7bbc2d8ea004cd121fa278e6c2fc740ba1e2bc.dat
    2008-01-08 01:46 32,981,120 ----a-w C:\Program Files\avg75free_516a1225.exe
    2007-12-25 01:50 20 ---h--w C:\Documents and Settings\All Users\Application Data\PKP_DLec.DAT
    2007-12-25 01:50 20 ---h--w C:\Documents and Settings\All Users\Application Data\PKP_DLds.DAT
    2007-12-16 07:07 3,381,280 ----a-w C:\Program Files\LimeWireWin.exe
    2007-12-03 20:44 2,400,784 ----a-w C:\Program Files\WLinstaller.exe
    2007-12-03 20:33 15,452,536 ----a-w C:\Program Files\IE7-WindowsXP-x86-enu.exe
    .
    Code:
    <pre>
----a-w            39,792 2008-01-08 21:47:56  C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl .exe
----a-w            28,672 2008-01-08 21:48:08  C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind .exe
----a-w            70,816 2008-01-08 21:47:49  C:\Program Files\Common Files\Symantec Shared\ccApp .exe
----a-w           171,448 2008-01-08 21:48:39  C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier .exe
----a-w           579,072 2008-01-08 21:48:24  C:\Program Files\Grisoft\AVG7\avgcc .exe
----a-w           132,496 2008-01-08 21:48:14  C:\Program Files\Java\jre1.6.0_02\bin\jusched .exe
----a-w           131,072 2008-01-08 21:48:05  C:\Program Files\Multimedia Card Reader\readericon10 .exe
----a-w            74,696 2008-01-08 21:47:49  C:\Program Files\Norton AntiVirus\AdvTools\ADVCHK .EXE
----a-w           282,624 2008-01-08 21:48:02  C:\Program Files\QuickTime\qttask         .exe
----a-w         5,724,184 2008-01-01 16:22:29  C:\Program Files\Windows Live\Messenger\msnmsgr     .exe
----a-w         5,724,184 2008-01-08 21:49:02  C:\Program Files\Windows Live\Messenger\msnmsgr  .exe
----a-w            15,360 2008-01-08 21:47:28  C:\WINDOWS\system32\ctfmon .exe
----a-w           126,976 2008-01-08 21:47:56  C:\WINDOWS\system32\hkcmd .exe
----a-w           155,648 2008-01-08 21:47:53  C:\WINDOWS\system32\igfxtray .exe
</pre>

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0199CD2D-45AF-4B00-86D9-D5656DE67011}]
    C:\WINDOWS\system32\awvvs.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{90ABFF40-6DF9-1C5E-8B2E-4FE678885B94}]
    C:\WINDOWS\system32\bqitjgn.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 05:00 15360]
    "MsnMsgr "= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]
    "Ixodry "= "C:\Documents and Settings\Owner\My Documents\??crosoft.NET\r?ndll32.exe" [ ]
    "Qwpofaf "= "C:\Documents and Settings\Owner\Application Data\??sembly\??oolsv.exe" [ ]
    "Xkpmfm "= "C:\Documents and Settings\Owner\My Documents\s?curity\s?rvices.exe" [ ]
    "Fhfiq "= "C:\Program Files\??stem32\d?xplore.exe" [ ]
    "QdrPack16 "= "C:\Program Files\QdrPack\QdrPack16.exe" [ ]
    "QdrModule16 "= "C:\Program Files\QdrModule\QdrModule16.exe" [ ]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "QuickTime Task "= "C:\Program Files\QuickTime\qttask .exe" [2008-01-08 16:48 282624]
    "SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
    "Adobe Reader Speed Launcher "= "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 22:16 39792]
    "UserFaultCheck "= "C:\WINDOWS\system32\dumprep 0 -u" [ ]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "QdrModule15 "= "C:\Program Files\QdrModule\QdrModule15.exe" [ ]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "FlashPlayerUpdate "= "C:\WINDOWS\system32\Macromed\Flash\FlashUtil9d.exe" [2007-06-11 14:04 190696]

    C:\Documents and Settings\Owner\Start Menu\Programs\Startup\
    Picture Motion Browser Media Check Tool.lnk - C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2007-12-04 16:45:49 368640]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 02:01:04 83360]
    NkbMonitor.exe.lnk - C:\Program Files\Nikon\PictureProject\NkbMonitor.exe [2007-12-04 19:19:40 118784]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebyvsp]
    gebyvsp.dll

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe "=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr .exe "=
    "C:\\Program Files\\Best Buy Rhapsody\\rhapsody.exe "=


    .
    Contents of the 'Scheduled Tasks' folder
    "2008-05-10 01:00:21 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer - Owner.job "
    - C:\PROGRA~1\NORTON~1\Navw32.exeh/task:
    "2008-05-17 14:05:52 C:\WINDOWS\Tasks\Norton Security Scan.job "
    - C:\Program Files\Norton Security Scan\Nss.exe
    "2008-05-17 23:25:41 C:\WINDOWS\Tasks\Symantec NetDetect.job "
    - C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-05-17 18:22:02
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    ------------------------ Other Running Processes ------------------------
    .
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
    C:\Program Files\Norton AntiVirus\SAVScan.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\system32\wscntfy.exe
    .
    **************************************************************************
    .
    Completion time: 2008-05-17 18:28:01 - machine was rebooted [Owner]
    ComboFix-quarantined-files.txt 2008-05-17 23:27:55

    Pre-Run: 41,239,986,176 bytes free
    Post-Run: 42,511,208,448 bytes free

    236 --- E O F --- 2008-05-17 20:06:01
     
    tylerho,
    #9
  11. 2008/05/17
    tylerho

    tylerho Inactive Thread Starter

    Joined:
    2008/02/26
    Messages:
    87
    Likes Received:
    0
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 6:32:28 PM, on 5/17/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
    C:\Program Files\Norton AntiVirus\SAVScan.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\QuickTime\qttask .exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
    C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Internet Explorer\IEXPLORE.EXE
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = file://c:/windows/homepage.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = file://c:/windows/homepage.html
    O2 - BHO: (no name) - {0199CD2D-45AF-4B00-86D9-D5656DE67011} - C:\WINDOWS\system32\awvvs.dll (file missing)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: (no name) - {90ABFF40-6DF9-1C5E-8B2E-4FE678885B94} - C:\WINDOWS\system32\bqitjgn.dll (file missing)
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask .exe" -atboottime
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe "
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
    O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [Ixodry] "C:\Documents and Settings\Owner\My Documents\??crosoft.NET\r?ndll32.exe "
    O4 - HKCU\..\Run: [Qwpofaf] "C:\Documents and Settings\Owner\Application Data\??sembly\??oolsv.exe "
    O4 - HKCU\..\Run: [Xkpmfm] "C:\Documents and Settings\Owner\My Documents\s?curity\s?rvices.exe "
    O4 - HKCU\..\Run: [Fhfiq] "C:\Program Files\??stem32\d?xplore.exe "
    O4 - HKCU\..\Run: [QdrPack16] "C:\Program Files\QdrPack\QdrPack16.exe "
    O4 - HKCU\..\Run: [QdrModule16] "C:\Program Files\QdrModule\QdrModule16.exe "
    O4 - HKUS\S-1-5-18\..\Run: [QdrModule15] "C:\Program Files\QdrModule\QdrModule15.exe" (User 'SYSTEM')
    O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9d.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [QdrModule15] "C:\Program Files\QdrModule\QdrModule15.exe" (User 'Default user')
    O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9d.exe (User 'Default user')
    O4 - Startup: Picture Motion Browser Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u5-windows-i586-jc.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O20 - Winlogon Notify: gebyvsp - gebyvsp.dll (file missing)
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

    --
    End of file - 7203 bytes
     
    tylerho,
    #10
  12. 2008/05/17
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi tylerho

    Please do the following.

    Highlight and copy the contents of the code box below and paste it into a blank notepad, then save it to your desktop as;

    Filename: CFScript.txt
    Save As Type: All Files (*.*)

    Close all other windows and programs. Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button.
    Click here to see how to use CFScript.txt
    Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log and another fresh HijackThis log.

    Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.

    Code:
    File::
C:\WINDOWS\system32\wvUkLETN.dll
C:\WINDOWS\BM672f8b57.xml
C:\WINDOWS\QTFont.qfn
C:\WINDOWS\QTFont.for
C:\WINDOWS\b148.exe.bin
C:\WINDOWS\b999.exe.bin
C:\Documents and Settings\Owner\Application Data\9a7bbc2d8ea004cd121fa278e6c2fc740ba1e2bc.dat

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0199CD2D-45AF-4B00-86D9-D5656DE67011}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{90ABFF40-6DF9-1C5E-8B2E-4FE678885B94}]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
 "Ixodry "=-
 "Qwpofaf "=-
 "Xkpmfm "=-
 "Fhfiq "=-
 "QdrPack16 "=-
 "QdrModule16 "=-
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
 "QdrModule15 "=-
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\gebyvsp]

RenV::
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl .exe 
C:\Program Files\Common Files\Microsoft Shared\Works Shared\WkUFind .exe 
C:\Program Files\Common Files\Symantec Shared\ccApp .exe 
C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier .exe 
C:\Program Files\Grisoft\AVG7\avgcc .exe 
C:\Program Files\Java\jre1.6.0_02\bin\jusched .exe 
C:\Program Files\Multimedia Card Reader\readericon10 .exe 
C:\Program Files\Norton AntiVirus\AdvTools\ADVCHK .EXE 
C:\Program Files\QuickTime\qttask .exe 
C:\Program Files\Windows Live\Messenger\msnmsgr .exe 
C:\Program Files\Windows Live\Messenger\msnmsgr .exe 
C:\WINDOWS\system32\ctfmon .exe 
C:\WINDOWS\system32\hkcmd .exe 
C:\WINDOWS\system32\igfxtray .exe
    Please post the combofix log and a New HJT log.

    Thanks
    Geri
     
    Geri,
    #11
  13. 2008/05/19
    tylerho

    tylerho Inactive Thread Starter

    Joined:
    2008/02/26
    Messages:
    87
    Likes Received:
    0
    ComboFix 08-05-15.3 - Owner 2008-05-19 17:10:13.2 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.225 [GMT -5:00]
    Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
    Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

    FILE ::
    C:\Documents and Settings\Owner\Application Data\9a7bbc2d8ea004cd121fa278e6c2fc740ba1e2bc.dat
    C:\WINDOWS\b148.exe.bin
    C:\WINDOWS\b999.exe.bin
    C:\WINDOWS\BM672f8b57.xml
    C:\WINDOWS\QTFont.for
    C:\WINDOWS\QTFont.qfn
    C:\WINDOWS\system32\wvUkLETN.dll
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\CPV.stt
    C:\Documents and Settings\Owner\Application Data\9a7bbc2d8ea004cd121fa278e6c2fc740ba1e2bc.dat
    C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\bestwiner.stt
    C:\Documents and Settings\Owner\Local Settings\Temporary Internet Files\CPV.stt
    C:\WINDOWS\b103.exe.bin
    C:\WINDOWS\b111.exe.bin
    C:\WINDOWS\b148.exe.bin
    C:\WINDOWS\b149.exe.bin
    C:\WINDOWS\b999.exe.bin
    C:\WINDOWS\BM672f8b57.xml
    C:\WINDOWS\QTFont.for
    C:\WINDOWS\QTFont.qfn
    C:\WINDOWS\system32\wnsintisv.exe
    C:\WINDOWS\system32\wvUkLETN.dll

    .
    ((((((((((((((((((((((((( Files Created from 2008-04-19 to 2008-05-19 )))))))))))))))))))))))))))))))
    .

    2008-05-17 18:56 . 2008-05-17 19:17 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak
    2008-05-17 18:15 . 2008-05-17 18:15 1,024 --ah----- C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG
    2008-05-17 14:50 . 2008-05-17 14:50 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg7
    2008-05-17 14:14 . 2008-05-05 20:46 27,048 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
    2008-05-17 14:14 . 2008-05-05 20:46 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-05-17 13:58 . 2008-05-17 13:58 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Malwarebytes
    2008-05-17 13:57 . 2008-05-17 14:14 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-05-17 13:57 . 2008-05-17 13:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-05-17 13:19 . 2008-05-17 13:19 <DIR> d-------- C:\WINDOWS\ERUNT
    2008-05-17 13:18 . 2008-05-17 13:18 <DIR> d-------- C:\Documents and Settings\Administrator.CD043221501-1
    2008-05-17 13:18 . 2008-05-17 18:15 1,024 --ah----- C:\Documents and Settings\Administrator.CD043221501-1\ntuser.dat.LOG
    2008-05-17 13:15 . 2008-05-17 13:52 <DIR> d-------- C:\SDFix
    2008-05-17 09:30 . 2008-05-17 09:30 <DIR> d-------- C:\Program Files\Trend Micro

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-05-19 22:10 --------- d-----w C:\Program Files\Multimedia Card Reader
    2008-05-19 22:10 --------- d-----w C:\Program Files\Common Files\Symantec Shared
    2008-05-17 23:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
    2008-05-17 23:21 --------- d-----w C:\Program Files\Google
    2008-05-17 19:51 --------- d-----w C:\Program Files\LimeWire
    2008-05-17 19:48 --------- d-----w C:\Program Files\Common Files\Adobe
    2008-05-15 00:44 --------- d-----w C:\Program Files\Norton Security Scan
    2008-04-23 03:16 --------- d-----w C:\Program Files\Best Buy Rhapsody
    2008-04-13 21:19 --------- d-----w C:\Documents and Settings\Owner\Application Data\LimeWire
    2008-03-31 04:01 133,197,120 ----a-w C:\Program Files\OOo_2.4.0_Win32Intel_install_wJRE_en-US.exe
    2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll
    2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
    2008-03-01 13:06 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
    2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
    2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
    2008-02-17 08:21 1,094,772 ----a-w C:\Program Files\Whennottocleanyourglasses.wmv
    2008-01-21 05:03 57,016 ----a-w C:\Documents and Settings\Owner\Application Data\GDIPFONTCACHEV1.DAT
    2008-01-08 01:46 32,981,120 ----a-w C:\Program Files\avg75free_516a1225.exe
    2007-12-25 01:50 20 ---h--w C:\Documents and Settings\All Users\Application Data\PKP_DLec.DAT
    2007-12-25 01:50 20 ---h--w C:\Documents and Settings\All Users\Application Data\PKP_DLds.DAT
    2007-12-16 07:07 3,381,280 ----a-w C:\Program Files\LimeWireWin.exe
    2007-12-03 20:44 2,400,784 ----a-w C:\Program Files\WLinstaller.exe
    2007-12-03 20:33 15,452,536 ----a-w C:\Program Files\IE7-WindowsXP-x86-enu.exe
    .
    Code:
    <pre>
----a-w           282,624 2008-01-08 21:48:02  C:\Program Files\QuickTime\qttask         .exe
----a-w         5,724,184 2008-01-01 16:22:29  C:\Program Files\Windows Live\Messenger\msnmsgr     .exe
----a-w         5,724,184 2008-01-08 21:49:02  C:\Program Files\Windows Live\Messenger\msnmsgr  .exe
</pre>

    ((((((((((((((((((((((((((((( snapshot@2008-05-17_18.27.35.45 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2008-05-17 23:21:16 2,048 --s-a-w C:\WINDOWS\bootstat.dat
    + 2008-05-19 22:05:18 2,048 --s-a-w C:\WINDOWS\bootstat.dat
    - 2004-08-04 10:00:00 15,360 ----a-w C:\WINDOWS\system32\ctfmon.exe
    + 2008-01-08 21:47:28 15,360 ----a-w C:\WINDOWS\system32\ctfmon.exe
    - 2004-08-04 10:00:00 15,360 -c--a-w C:\WINDOWS\system32\dllcache\ctfmon.exe
    + 2008-01-08 21:47:28 15,360 -c--a-w C:\WINDOWS\system32\dllcache\ctfmon.exe
    + 2008-01-08 21:47:56 126,976 ----a-w C:\WINDOWS\system32\hkcmd.exe
    + 2008-01-08 21:47:53 155,648 ----a-w C:\WINDOWS\system32\igfxtray.exe
    - 2007-10-11 20:12:48 1,468,968 ----a-w C:\WINDOWS\system32\LegitCheckControl.dll
    + 2008-03-20 23:06:36 1,480,232 ----a-w C:\WINDOWS\system32\LegitCheckControl.dll
    - 2007-10-08 20:46:18 14,640 ----a-w C:\WINDOWS\system32\spmsg.dll
    + 2008-03-20 19:41:20 14,640 ------w C:\WINDOWS\system32\spmsg.dll
    + 2006-12-02 03:56:00 96,256 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.ATL_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_cbb27474\ATL80.dll
    + 2006-12-02 03:54:32 479,232 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcm80.dll
    + 2006-12-02 03:54:34 548,864 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcp80.dll
    + 2006-12-02 03:54:32 626,688 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6b128700\msvcr80.dll
    + 2006-12-02 05:25:52 1,101,824 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80.dll
    + 2006-12-02 05:25:56 1,093,120 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfc80u.dll
    + 2006-12-02 05:25:58 69,632 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80.dll
    + 2006-12-02 05:26:00 57,856 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_3bf8fa05\mfcm80u.dll
    + 2006-12-02 05:08:00 40,960 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHS.dll
    + 2006-12-02 05:08:00 45,056 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80CHT.dll
    + 2006-12-02 05:08:00 65,536 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80DEU.dll
    + 2006-12-02 05:08:00 57,344 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ENU.dll
    + 2006-12-02 05:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ESP.dll
    + 2006-12-02 05:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80FRA.dll
    + 2006-12-02 05:08:00 61,440 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80ITA.dll
    + 2006-12-02 05:08:00 49,152 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80JPN.dll
    + 2006-12-02 05:08:00 49,152 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.MFCLOC_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_91481303\mfc80KOR.dll
    + 2006-12-02 05:46:44 65,536 ----a-w C:\WINDOWS\WinSxS\x86_Microsoft.VC80.OpenMP_1fc8b3b9a1e18e3b_8.0.50727.762_x-ww_6c18549a\vcomp.dll
    .
    -- Snapshot reset to current date --
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2008-01-08 16:47 15360]
    "MsnMsgr "= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 12:34 5724184]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "QuickTime Task "= "C:\Program Files\QuickTime\qttask .exe" [2008-01-08 16:48 282624]
    "SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
    "Adobe Reader Speed Launcher "= "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-08 16:47 39792]
    "UserFaultCheck "= "C:\WINDOWS\system32\dumprep 0 -u" [ ]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "FlashPlayerUpdate "= "C:\WINDOWS\system32\Macromed\Flash\FlashUtil9d.exe" [2007-06-11 14:04 190696]

    C:\Documents and Settings\Owner\Start Menu\Programs\Startup\
    Picture Motion Browser Media Check Tool.lnk - C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2007-12-04 16:45:49 368640]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 02:01:04 83360]
    NkbMonitor.exe.lnk - C:\Program Files\Nikon\PictureProject\NkbMonitor.exe [2007-12-04 19:19:40 118784]

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe "=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr .exe "=
    "C:\\Program Files\\Best Buy Rhapsody\\rhapsody.exe "=


    *Newly Created Service* - CATCHME
    .
    Contents of the 'Scheduled Tasks' folder
    "2008-05-10 01:00:21 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer - Owner.job "
    - C:\PROGRA~1\NORTON~1\Navw32.exeh/task:
    "2008-05-17 14:05:52 C:\WINDOWS\Tasks\Norton Security Scan.job "
    - C:\Program Files\Norton Security Scan\Nss.exe
    "2008-05-19 22:05:58 C:\WINDOWS\Tasks\Symantec NetDetect.job "
    - C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-05-19 17:12:31
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...


    **************************************************************************
    .
    Completion time: 2008-05-19 17:15:13
    ComboFix-quarantined-files.txt 2008-05-19 22:14:11
    ComboFix2.txt 2008-05-17 23:28:02

    Pre-Run: 42,336,821,248 bytes free
    Post-Run: 42,667,556,864 bytes free

    165 --- E O F --- 2008-05-17 20:06:01
     
    tylerho,
    #12
  14. 2008/05/19
    tylerho

    tylerho Inactive Thread Starter

    Joined:
    2008/02/26
    Messages:
    87
    Likes Received:
    0
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 5:17:11 PM, on 5/19/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\QuickTime\qttask .exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\Program Files\Windows Live\Messenger\msnmsgr.exe
    C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = file://c:/windows/homepage.html
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask .exe" -atboottime
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe "
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
    O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9d.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9d.exe (User 'Default user')
    O4 - Startup: Picture Motion Browser Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u5-windows-i586-jc.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

    --
    End of file - 6071 bytes
     
    tylerho,
    #13
  15. 2008/05/19
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi tylerho
    OK things are looking much better.

    Please do this.

    Please re-open HiJackThis and scan only. Check the boxes next to all the entries listed below.

    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = file://c:/windows/homepage.html

    Now close all windows other than HiJackThis, then click Fix Checked.

    Close HJT.

    Combofix missed a couple things so we need to run it again.

    Highlight and copy the contents of the code box below and paste it into a blank notepad, then save it to your desktop as;

    Filename: CFScript.txt
    Save As Type: All Files (*.*)

    Close all other windows and programs. Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button.
    Click here to see how to use CFScript.txt
    Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log and another fresh HijackThis log.

    Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.

    Code:
    File::
C:\Program Files\avg75free_516a1225.exe

RenV::
C:\Program Files\QuickTime\qttask         .exe
C:\Program Files\Windows Live\Messenger\msnmsgr     .exe
C:\Program Files\Windows Live\Messenger\msnmsgr  .exe
    Please post the combofix log and a new HJT log.

    Thanks
    Geri
     
    Geri,
    #14
  16. 2008/05/19
    tylerho

    tylerho Inactive Thread Starter

    Joined:
    2008/02/26
    Messages:
    87
    Likes Received:
    0
    ComboFix 08-05-15.3 - Owner 2008-05-19 19:46:44.3 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.264 [GMT -5:00]
    Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
    Command switches used :: C:\Documents and Settings\Owner\Desktop\CFScript.txt
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

    FILE ::
    C:\Program Files\avg75free_516a1225.exe
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Program Files\avg75free_516a1225.exe

    .
    ((((((((((((((((((((((((( Files Created from 2008-04-20 to 2008-05-20 )))))))))))))))))))))))))))))))
    .

    2008-05-17 18:56 . 2008-05-17 19:17 <DIR> d-------- C:\WINDOWS\system32\CatRoot_bak
    2008-05-17 18:15 . 2008-05-17 18:15 1,024 --ah----- C:\WINDOWS\system32\config\systemprofile\ntuser.dat.LOG
    2008-05-17 14:50 . 2008-05-17 14:50 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avg7
    2008-05-17 14:14 . 2008-05-05 20:46 27,048 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
    2008-05-17 14:14 . 2008-05-05 20:46 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-05-17 13:58 . 2008-05-17 13:58 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Malwarebytes
    2008-05-17 13:57 . 2008-05-17 14:14 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-05-17 13:57 . 2008-05-17 13:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-05-17 13:19 . 2008-05-17 13:19 <DIR> d-------- C:\WINDOWS\ERUNT
    2008-05-17 13:18 . 2008-05-17 13:18 <DIR> d-------- C:\Documents and Settings\Administrator.CD043221501-1
    2008-05-17 13:18 . 2008-05-19 17:40 1,024 --ah----- C:\Documents and Settings\Administrator.CD043221501-1\ntuser.dat.LOG
    2008-05-17 13:15 . 2008-05-17 13:52 <DIR> d-------- C:\SDFix
    2008-05-17 09:30 . 2008-05-17 09:30 <DIR> d-------- C:\Program Files\Trend Micro

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-05-20 00:46 --------- d-----w C:\Program Files\QuickTime
    2008-05-19 22:10 --------- d-----w C:\Program Files\Multimedia Card Reader
    2008-05-19 22:10 --------- d-----w C:\Program Files\Common Files\Symantec Shared
    2008-05-17 23:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
    2008-05-17 23:21 --------- d-----w C:\Program Files\Google
    2008-05-17 19:51 --------- d-----w C:\Program Files\LimeWire
    2008-05-17 19:48 --------- d-----w C:\Program Files\Common Files\Adobe
    2008-05-15 00:44 --------- d-----w C:\Program Files\Norton Security Scan
    2008-04-23 03:16 --------- d-----w C:\Program Files\Best Buy Rhapsody
    2008-04-13 21:19 --------- d-----w C:\Documents and Settings\Owner\Application Data\LimeWire
    2008-03-31 04:01 133,197,120 ----a-w C:\Program Files\OOo_2.4.0_Win32Intel_install_wJRE_en-US.exe
    2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll
    2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
    2008-03-01 13:06 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
    2008-02-20 06:51 282,624 ----a-w C:\WINDOWS\system32\gdi32.dll
    2008-02-20 05:32 45,568 ----a-w C:\WINDOWS\system32\dnsrslvr.dll
    2008-02-17 08:21 1,094,772 ----a-w C:\Program Files\Whennottocleanyourglasses.wmv
    2008-01-21 05:03 57,016 ----a-w C:\Documents and Settings\Owner\Application Data\GDIPFONTCACHEV1.DAT
    2007-12-25 01:50 20 ---h--w C:\Documents and Settings\All Users\Application Data\PKP_DLec.DAT
    2007-12-25 01:50 20 ---h--w C:\Documents and Settings\All Users\Application Data\PKP_DLds.DAT
    2007-12-16 07:07 3,381,280 ----a-w C:\Program Files\LimeWireWin.exe
    2007-12-03 20:44 2,400,784 ----a-w C:\Program Files\WLinstaller.exe
    2007-12-03 20:33 15,452,536 ----a-w C:\Program Files\IE7-WindowsXP-x86-enu.exe
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2008-01-08 16:47 15360]
    "MsnMsgr "= "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" [2008-01-08 16:49 5724184]
    "swg "= "C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe" [2008-01-08 16:48 171448]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "QuickTime Task "= "C:\Program Files\QuickTime\qttask .exe" [ ]
    "SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
    "Adobe Reader Speed Launcher "= "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-08 16:47 39792]
    "UserFaultCheck "= "C:\WINDOWS\system32\dumprep 0 -u" [ ]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
    "FlashPlayerUpdate "= "C:\WINDOWS\system32\Macromed\Flash\FlashUtil9d.exe" [2007-06-11 14:04 190696]

    C:\Documents and Settings\Owner\Start Menu\Programs\Startup\
    Picture Motion Browser Media Check Tool.lnk - C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe [2007-12-04 16:45:49 368640]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office10\OSA.EXE [2001-02-13 02:01:04 83360]
    NkbMonitor.exe.lnk - C:\Program Files\Nikon\PictureProject\NkbMonitor.exe [2007-12-04 19:19:40 118784]

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe "=
    "C:\\Program Files\\Best Buy Rhapsody\\rhapsody.exe "=


    *Newly Created Service* - CATCHME
    .
    Contents of the 'Scheduled Tasks' folder
    "2008-05-10 01:00:21 C:\WINDOWS\Tasks\Norton AntiVirus - Scan my computer - Owner.job "
    - C:\PROGRA~1\NORTON~1\Navw32.exeh/task:
    "2008-05-17 14:05:52 C:\WINDOWS\Tasks\Norton Security Scan.job "
    - C:\Program Files\Norton Security Scan\Nss.exe
    "2008-05-19 22:05:58 C:\WINDOWS\Tasks\Symantec NetDetect.job "
    - C:\Program Files\Symantec\LiveUpdate\NDETECT.EXE
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-05-19 19:48:36
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...


    **************************************************************************
    .
    Completion time: 2008-05-19 19:51:23
    ComboFix-quarantined-files.txt 2008-05-20 00:50:19
    ComboFix2.txt 2008-05-19 22:15:14
    ComboFix3.txt 2008-05-17 23:28:02

    Pre-Run: 43,095,801,856 bytes free
    Post-Run: 43,055,915,008 bytes free

    107 --- E O F --- 2008-05-17 20:06:01
     
    tylerho,
    #15
  17. 2008/05/19
    tylerho

    tylerho Inactive Thread Starter

    Joined:
    2008/02/26
    Messages:
    87
    Likes Received:
    0
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 8:12:01 PM, on 5/19/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\QuickTime\qttask .exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
    C:\Program Files\Norton AntiVirus\navapsvc.exe
    C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: Norton AntiVirus - {42CDD1BF-3FFB-4238-8AD1-7859DF00B1D6} - C:\Program Files\Norton AntiVirus\NavShExt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask .exe" -atboottime
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe "
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe "
    O4 - HKLM\..\Run: [UserFaultCheck] %systemroot%\system32\dumprep 0 -u
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\msnmsgr.exe" /background
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\1.2.1128.5462\GoogleToolbarNotifier.exe
    O4 - HKUS\S-1-5-18\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9d.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\system32\Macromed\Flash\FlashUtil9d.exe (User 'Default user')
    O4 - Startup: Picture Motion Browser Media Check Tool.lnk = C:\Program Files\Sony\Sony Picture Utility\VolumeWatcher\SPUVolumeWatcher.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office10\OSA.EXE
    O4 - Global Startup: NkbMonitor.exe.lnk = C:\Program Files\Nikon\PictureProject\NkbMonitor.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx1.hotmail.com/mail/w2/resources/MSNPUpld.cab
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://javadl-esd.sun.com/update/1.6.0/jinstall-6u5-windows-i586-jc.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
    O23 - Service: Symantec Password Validation (ccPwdSvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccPwdSvc.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: Norton AntiVirus Auto Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton AntiVirus\navapsvc.exe
    O23 - Service: Norton Unerase Protection (NProtectService) - Symantec Corporation - C:\Program Files\Norton AntiVirus\AdvTools\NPROTECT.EXE
    O23 - Service: SAVScan - Symantec Corporation - C:\Program Files\Norton AntiVirus\SAVScan.exe
    O23 - Service: ScriptBlocking Service (SBService) - Symantec Corporation - C:\PROGRA~1\COMMON~1\SYMANT~1\SCRIPT~1\SBServ.exe
    O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

    --
    End of file - 5920 bytes
     
    tylerho,
    #16
  18. 2008/05/19
    tylerho

    tylerho Inactive Thread Starter

    Joined:
    2008/02/26
    Messages:
    87
    Likes Received:
    0
    Also, I would like to uinstall Norton Internet Security 2004 and install 2008. It will not let me. Do you know how i can do this? Thank you.
     
    tylerho,
    #17
  19. 2008/05/19
    tylerho

    tylerho Inactive Thread Starter

    Joined:
    2008/02/26
    Messages:
    87
    Likes Received:
    0
    Nevermind...I was able to get Norton installed. Thank you.
     
    tylerho,
    #18
  20. 2008/05/19
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi
    OK Looks good.

    I missed this so lets delete it.

    Using Windows Explorer (to get there right-click your Start button and go to "Explore "), please delete these folders (if present):

    C:\Documents and Settings\All Users\Application Data\Avg7


    Download ATF Cleaner by Atribune and save it to your Desktop.
    This is a good tool to get rid of the temporary garbage you pick up while surfing the net.
    Double click ATF-Cleaner.exe to run the program.
    Check the boxes to the left of:

    Windows Temp
    Current User Temp
    All Users Temp
    Temporary Internet Files
    Prefetch
    Java Cache
    Recycle bin

    The rest are optional - if you want it to remove everything check "Select All ".
    Finally, click Empty Selected. When you get the "Done Cleaning" message, click OK.


    Now lets get a on-line scan.

    Please do an online scan with Kaspersky WebScanner

    Click on "Accept" If your pop "“up blocker blocks the ActiveX download, allow it, click on "Accept" again

    You will be prompted to install an ActiveX component from Kaspersky, Click Yes or Install.
    • The program will launch and then begin downloading the latest definition files:
    • Once the files have been downloaded click on NEXT
    • Now click on Scan Settings
    • In the scan settings make that the following are selected:
      • Scan using the following Anti-Virus database:
      • Extended (if available otherwise Standard)
      • Scan Options:
      • Scan Archives
        Scan Mail Bases
    • Click OK
    • Now under select a target to scan:
      • Select My Computer
    • This will start the program and scan your system.
    • The scan will take a while so be patient and let it run.
    • Once the scan is complete it will display if your system has been infected.
      • Now click on the Save as Text button:
    • Save the file to your desktop.
    • Copy and paste that information in your next post.

    Please post the Kaspersky results.

    Thanks
    Geri
     
    Geri,
    #19

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...