1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Trojan.Win32.Monder.yl

Discussion in 'Malware and Virus Removal Archive' started by fakin, 2008/08/02.

Page 1 of 2
  1. 2008/08/02
    fakin

    fakin Inactive Thread Starter

    Joined:
    2008/08/02
    Messages:
    12
    Likes Received:
    0
    Hi,

    I have a problem with the Monder.yl. I've tried to remove it with ZoneLabs Security Suite but it can't do anything. I've also tried to remove it with Spybot-Search & Destroy but I think it doesn't even see it.
    Following instructions I've downloaded HijackThis, run it and here is it's log:

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 21:38:24, on 2.8.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\RunDll32.exe
    C:\WINDOWS\System32\hkcmd.exe
    C:\WINDOWS\System32\igfxpers.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\Program Files\3DO\Heroes3\RegisterSOD\Remind32.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: (no name) - {33EEA2FD-92A5-4B9E-9A36-D4E16C0AD849} - C:\WINDOWS\system32\hgGywWMd.dll (file missing)
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {5F11D5D5-3FB2-4ADD-84AD-D69BC9A5D312} - C:\WINDOWS\system32\efcYQJab.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: ImageShack Toolbar - {6932D140-ABC4-4073-A44C-D4A541665E35} - C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\System32\igfxpers.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [Windows Acer Service ] acersv.exe
    O4 - HKLM\..\Run: [SBI] C:\Documents and Settings\Nela\Local Settings\Temporary Internet Files\Content.IE5\6J4FJD66\install_sbd_en[1].exe
    O4 - HKLM\..\Run: [BMN] "C:\Program Files\Common Files\System Doctor\dcmon.exe" dm=http://systemdoctor.com ad=http://systemdoctor.com sd=http://log.systemdoctor.com/
    O4 - HKLM\..\Run: [SystemDoctor Free] C:\Program Files\System Doctor Free\systemdoc.exe /min
    O4 - HKLM\..\Run: [e8f11989] rundll32.exe "C:\WINDOWS\system32\nrdfmyrk.dll ",b
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe "
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\RunOnce: [FlashPlayerUpdate] C:\WINDOWS\System32\Macromed\Flash\NPSWF32_FlashUtil.exe -p
    O4 - HKUS\S-1-5-18\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'Default user')
    O4 - Startup: H3 The Shadow of Death(TM).lnk = C:\Program Files\3DO\Heroes3\RegisterSOD\Remind32.exe
    O8 - Extra context menu item: &Search - ?p=ZJfox000
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-ww\msntabres.dll.mui/229?d2a97d1c32b9416c96cdc6cdb27f3004
    O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-ww\msntabres.dll.mui/230?d2a97d1c32b9416c96cdc6cdb27f3004
    O8 - Extra context menu item: Post Image to Blog - res://C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll/5003
    O8 - Extra context menu item: Tag This Image - res://C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll/5002
    O8 - Extra context menu item: Transload Image to ImageShack - res://C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll/5004
    O8 - Extra context menu item: Upload All Images to ImageShack - res://C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll/5000
    O8 - Extra context menu item: Upload Image to ImageShack - res://C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll/5001
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {6932D140-ABC4-4073-A44C-D4A541665E35} (ImageShack Toolbar) - http://toolbar.imageshack.us/toolbar/ImageShackToolbar.cab
    O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://1-simona-3.spaces.live.com/PhotoUpload/MsnPUpld.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O20 - Winlogon Notify: efcYQJab - C:\WINDOWS\SYSTEM32\efcYQJab.dll
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 8290 bytes


    Please help.
     
    fakin,
    #1
  2. 2008/08/02
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi fakin
    Welcome to Windowsbbs.

    Lets start like this, please do these in the order given.

    Download Malwarebytes' Anti-Malware (MBAM) from here or here and save the file to your desktop.

    Double click mbam-setup.exe to install the application.
    • Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    • If an update is found, it will download and install the latest version.
    • Once the program has loaded, select 'Perform Quick Scan', then click Scan.
    • The scan may take some time to finish,so please be patient.
    • When the scan is complete, click OK, then Show Results to view the results.
    • Make sure that everything is checked, and click Remove Selected.
    • When disinfection is completed, a log will open in Notepad and you may be prompted to Restart. (See Note below)
    • The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
    • Post the entire report in your next reply along with a fresh HijackThis log.

    Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately.

    Now please run Deckard System Scanner.

    Please download Deckard's System Scanner (dss.exe) and save it to your Desktop.
    Note: You must be logged onto an account with administrator privileges to complete the following.
    • Close all other windows before proceeding.
    • Double-click on dss.exe and follow the prompts.
    • When it has finished, dss will open two Notepads main.txt and extra.txt -- please copy and then paste the contents of main.txt and extra.txt in your next reply.

    Please post the "main.txt" log only for now.

    Please post the MBAM log and the dss log.

    Thanks
    Geri
     
    Geri,
    #2


  3. to hide this advert.

  4. 2008/08/03
    fakin

    fakin Inactive Thread Starter

    Joined:
    2008/08/02
    Messages:
    12
    Likes Received:
    0
    Hi Geri,

    Thanks.

    Here are MBAM and dss log:

    Malwarebytes' Anti-Malware 1.24
    Database version: 1018
    Windows 5.1.2600 Service Pack 2

    11:22:55 3.8.2008
    mbam-log-8-3-2008 (11-22-55).txt

    Scan type: Quick Scan
    Objects scanned: 39736
    Time elapsed: 13 minute(s), 43 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 1
    Registry Keys Infected: 10
    Registry Values Infected: 4
    Registry Data Items Infected: 1
    Folders Infected: 7
    Files Infected: 6

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    C:\WINDOWS\system32\efcYQJab.dll (Trojan.Vundo) -> Delete on reboot.

    Registry Keys Infected:
    HKEY_CLASSES_ROOT\CLSID\{5f11d5d5-3fb2-4add-84ad-d69bc9a5d312} (Trojan.Vundo) -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5f11d5d5-3fb2-4add-84ad-d69bc9a5d312} (Trojan.Vundo) -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\efcyqjab (Trojan.Vundo) -> Delete on reboot.
    HKEY_CURRENT_USER\SOFTWARE\AntiSpywareMasterDownloader (Rogue.AntiSpywareMaster) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\AntiSpywareMasterDownloader (Rogue.AntiSpywareMaster) -> Quarantined and deleted successfully.
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\contim (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\IProxyProvider (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\FCOVM (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\RemoveRP (Trojan.Vundo) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Multimedia\WMPlayer\Schemes\f3pss (Adware.MyWebSearch) -> Quarantined and deleted successfully.

    Registry Values Infected:
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\{5f11d5d5-3fb2-4add-84ad-d69bc9a5d312} (Trojan.Vundo) -> Delete on reboot.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\BMN (Rogue.SystemDoctor) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SystemDoctor Free (Rogue.SystemDoctor) -> Quarantined and deleted successfully.
    HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\windows acer service (Backdoor.Bot) -> Quarantined and deleted successfully.

    Registry Data Items Infected:
    HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\Start_ShowRun (Hijack.StartMenu) -> Bad: (0) Good: (1) -> Quarantined and deleted successfully.

    Folders Infected:
    C:\Documents and Settings\All Users\Application Data\SalesMon (Rogue.Multiple) -> Quarantined and deleted successfully.
    C:\Documents and Settings\All Users\Application Data\SalesMon\Data (Rogue.Multiple) -> Quarantined and deleted successfully.
    C:\Documents and Settings\All Users\Application Data\System Doctor Free (Rogue.SystemDoctor) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Nela\Application Data\System Doctor Free (Rogue.SystemDoctor) -> Quarantined and deleted successfully.
    C:\Documents and Settings\Nela\Application Data\System Doctor Free\Logs (Rogue.SystemDoctor) -> Quarantined and deleted successfully.
    C:\Documents and Settings\luka\Application Data\System Doctor Free (Rogue.SystemDoctor) -> Quarantined and deleted successfully.
    C:\Documents and Settings\luka\Application Data\System Doctor Free\Logs (Rogue.SystemDoctor) -> Quarantined and deleted successfully.

    Files Infected:
    C:\WINDOWS\system32\efcYQJab.dll (Trojan.Vundo) -> Delete on reboot.
    C:\Documents and Settings\Nela\Application Data\System Doctor Free\Logs\update.log (Rogue.SystemDoctor) -> Quarantined and deleted successfully.
    C:\Documents and Settings\luka\Application Data\System Doctor Free\Logs\update.log (Rogue.SystemDoctor) -> Quarantined and deleted successfully.
    C:\WINDOWS\BMebc22a15.xml (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\BMebc22a15.txt (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\WINDOWS\system32\clkcnt.txt (Trojan.Vundo) -> Quarantined and deleted successfully.



    Deckard's System Scanner v20071014.68
    Run by Nela on 2008-08-03 11:31:13
    Computer is in Normal Mode.
    --------------------------------------------------------------------------------

    Total Physical Memory: 503 MiB (512 MiB recommended).


    -- HijackThis (run as Nela.exe) ------------------------------------------------

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:31:27, on 3.8.2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\system32\RunDll32.exe
    C:\WINDOWS\System32\hkcmd.exe
    C:\WINDOWS\System32\igfxpers.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\3DO\Heroes3\RegisterSOD\Remind32.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Documents and Settings\Nela\Desktop\dss.exe
    C:\PROGRA~1\TRENDM~1\HIJACK~1\Nela.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: (no name) - {33EEA2FD-92A5-4B9E-9A36-D4E16C0AD849} - C:\WINDOWS\system32\hgGywWMd.dll (file missing)
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {5F11D5D5-3FB2-4ADD-84AD-D69BC9A5D312} - (no file)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: ImageShack Toolbar - {6932D140-ABC4-4073-A44C-D4A541665E35} - C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\System32\igfxpers.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [SBI] C:\Documents and Settings\Nela\Local Settings\Temporary Internet Files\Content.IE5\6J4FJD66\install_sbd_en[1].exe
    O4 - HKLM\..\Run: [e8f11989] rundll32.exe "C:\WINDOWS\system32\nrdfmyrk.dll ",b
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe "
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKUS\S-1-5-18\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'Default user')
    O4 - Startup: H3 The Shadow of Death(TM).lnk = C:\Program Files\3DO\Heroes3\RegisterSOD\Remind32.exe
    O8 - Extra context menu item: &Search - ?p=ZJfox000
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-ww\msntabres.dll.mui/229?d2a97d1c32b9416c96cdc6cdb27f3004
    O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-ww\msntabres.dll.mui/230?d2a97d1c32b9416c96cdc6cdb27f3004
    O8 - Extra context menu item: Post Image to Blog - res://C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll/5003
    O8 - Extra context menu item: Tag This Image - res://C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll/5002
    O8 - Extra context menu item: Transload Image to ImageShack - res://C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll/5004
    O8 - Extra context menu item: Upload All Images to ImageShack - res://C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll/5000
    O8 - Extra context menu item: Upload Image to ImageShack - res://C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll/5001
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {6932D140-ABC4-4073-A44C-D4A541665E35} (ImageShack Toolbar) - http://toolbar.imageshack.us/toolbar/ImageShackToolbar.cab
    O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://1-simona-3.spaces.live.com/PhotoUpload/MsnPUpld.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O20 - Winlogon Notify: efcYQJab - C:\WINDOWS\
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 7790 bytes

    -- Files created between 2008-07-03 and 2008-08-03 -----------------------------

    2008-08-03 11:07:05 0 d-------- C:\Documents and Settings\Nela\Application Data\Malwarebytes
    2008-08-03 11:06:54 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-08-03 11:06:54 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-08-02 21:37:57 0 d-------- C:\Program Files\Trend Micro
    2008-08-02 19:38:13 4220192 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
    2008-08-02 17:49:23 0 d-------- C:\Program Files\Winamp
    2008-08-02 15:05:40 0 d-------- C:\Documents and Settings\Nela\Application Data\Skype
    2008-08-02 15:04:52 6291456 --a------ C:\Documents and Settings\Nela\ntuser.dat
    2008-07-04 12:25:05 446852 --ahs---- C:\WINDOWS\system32\UtsuDJlm.ini2


    -- Find3M Report ---------------------------------------------------------------

    2008-08-02 19:35:24 4212 --ah----- C:\WINDOWS\system32\zllictbl.dat
    2008-08-02 19:25:59 440915 --ahs---- C:\WINDOWS\system32\dMWwyGgh.ini2
    2008-08-02 17:56:51 27 --a------ C:\WINDOWS\mscpt.dat
    2008-08-02 16:27:02 0 d-------- C:\Documents and Settings\Nela\Application Data\Mozilla
    2008-08-02 15:31:49 0 d-------- C:\Program Files\Common Files
    2008-08-02 15:31:40 0 d-------- C:\Program Files\Common Files\Symantec Shared
    2008-08-02 15:31:33 0 d-------- C:\Documents and Settings\Nela\Application Data\Yahoo!
    2008-08-02 14:13:15 0 d-------- C:\Documents and Settings\Nela\Application Data\skypePM
    2008-07-02 15:05:45 454628 --ahs---- C:\WINDOWS\system32\NortBJjl.ini2
    2008-06-17 16:29:51 477036 --ahs---- C:\WINDOWS\system32\WxaKlUvw.ini2
    2008-06-11 16:31:30 0 d-------- C:\Documents and Settings\Nela\Application Data\MSN6
    2008-06-11 14:02:43 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat


    -- Registry Dump ---------------------------------------------------------------

    *Note* empty entries & legit default entries are not shown


    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{33EEA2FD-92A5-4B9E-9A36-D4E16C0AD849}]
    C:\WINDOWS\system32\hgGywWMd.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5F11D5D5-3FB2-4ADD-84AD-D69BC9A5D312}]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Cmaudio "= "cmicnfg.cpl" []
    "igfxtray "= "C:\WINDOWS\System32\igfxtray.exe" [20.09.2005 04:35]
    "igfxhkcmd "= "C:\WINDOWS\System32\hkcmd.exe" [20.09.2005 04:32]
    "igfxpers "= "C:\WINDOWS\System32\igfxpers.exe" [20.09.2005 04:36]
    "NeroFilterCheck "= "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [12.01.2006 16:40]
    "SBI "= "C:\Documents and Settings\Nela\Local Settings\Temporary Internet Files\Content.IE5\6J4FJD66\install_sbd_en[1].exe" []
    "e8f11989 "= "C:\WINDOWS\system32\nrdfmyrk.dll" []
    "ZoneAlarm Client "= "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [09.07.2008 09:05]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [04.08.2004 09:56]
    "MsnMsgr "= "C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [18.10.2007 12:34]
    "swg "= "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [26.09.2007 17:36]
    "SpybotSD TeaTimer "= "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [07.07.2008 09:42]

    [HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
    "ALUAlert "=C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe

    C:\Documents and Settings\Nela\Start Menu\Programs\Startup\
    H3 The Shadow of Death(TM).lnk - C:\Program Files\3DO\Heroes3\RegisterSOD\Remind32.exe [6.7.2007 17:07:31]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcYQJab]

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    "Authentication Packages "= msv1_0 C:\WINDOWS\system32\hgGywWMd

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
    SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
    @= "Volume shadow copy "




    -- End of Deckard's System Scanner: finished at 2008-08-03 11:32:19 ------------
     
    fakin,
    #3
  5. 2008/08/03
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi fakin
    OK now do this please.

    Download ComboFix from Here to your Desktop.

    It's best to disable realtime protection applications as they sometimes interfere with the tool.
    Check this link for any applicable programs you may have.
    • Close all open programs and windows
    • Double click combofix.exe and follow the prompts.
    • Vista users right click Combofix.exe and select Run As Administrator.
    • When finished, it shall produce a log for you. Post that log.
    Note: Do not mouseclick combofix's window while its running. That may cause it to stall

    Note - ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.

    Note - Combofix makes some changes when run to prevent autorun/autoplay of ALL CDs, floppies and USB devices, to assist with malware removal & increase security. If this is an issue or makes it difficult for you to use those devices, please ask how to reset it.

    Thanks
    Geri
     
    Geri,
    #4
  6. 2008/08/03
    fakin

    fakin Inactive Thread Starter

    Joined:
    2008/08/02
    Messages:
    12
    Likes Received:
    0
    Hi Geri,

    Well, I've done that but now I can't boot my computer any more. In fact it does boot, I log in and then there's just my desktop picture, no taskbar, no icons, everything's gone. I can however run taskmgr.

    Thanks,

    fakin

    in fact it booted, but after about 10 minutes.
    I'm using ICS, so infected computer connects through this computer to internet. I'll try to post the log as soon as possible :)
     
    Last edited: 2008/08/03
    fakin,
    #5
  7. 2008/08/03
    fakin

    fakin Inactive Thread Starter

    Joined:
    2008/08/02
    Messages:
    12
    Likes Received:
    0
    I've (self initiated) restore computer to the previous state (the one before I've run ComboFix.exe.

    Anyway, here's ComboFix.log

    ComboFix 08-08-02.01 - Nela 2008-08-03 16:54:12.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.171 [GMT 2:00]
    Running from: C:\Documents and Settings\Nela\Desktop\ComboFix.exe
    * Created a new restore point
    * Resident AV is active


    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Documents and Settings\luka\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
    C:\WINDOWS\system32\ckhgpopc.ini
    C:\WINDOWS\system32\dMWwyGgh.ini
    C:\WINDOWS\system32\dMWwyGgh.ini2
    C:\WINDOWS\system32\hdaqwmhs.ini
    C:\WINDOWS\system32\krymfdrn.ini
    C:\WINDOWS\system32\ltvwawpe.ini
    C:\WINDOWS\system32\mcrh.tmp
    C:\WINDOWS\system32\NortBJjl.ini
    C:\WINDOWS\system32\NortBJjl.ini2
    C:\WINDOWS\system32\plwxgnrq.ini
    C:\WINDOWS\system32\rkdyswcq.ini
    C:\WINDOWS\system32\UtsuDJlm.ini
    C:\WINDOWS\system32\UtsuDJlm.ini2
    C:\WINDOWS\system32\uyrlbfpc.ini
    C:\WINDOWS\system32\WxaKlUvw.ini
    C:\WINDOWS\system32\WxaKlUvw.ini2

    .
    ((((((((((((((((((((((((( Files Created from 2008-07-03 to 2008-08-03 )))))))))))))))))))))))))))))))
    .

    2008-08-03 16:47 . 2004-08-04 09:56 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
    2008-08-03 16:47 . 2004-08-04 07:58 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
    2008-08-03 16:47 . 2004-08-04 07:58 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys
    2008-08-03 16:46 . 2004-08-04 08:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
    2008-08-03 16:46 . 2004-08-04 08:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
    2008-08-03 11:07 . 2008-08-03 11:07 <DIR> d-------- C:\Documents and Settings\Nela\Application Data\Malwarebytes
    2008-08-03 11:06 . 2008-08-03 11:07 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-08-03 11:06 . 2008-08-03 11:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-08-03 11:06 . 2008-07-30 20:07 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
    2008-08-03 11:06 . 2008-07-30 20:07 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-08-02 21:53 . 2008-08-02 21:53 <DIR> d-------- C:\Deckard
    2008-08-02 21:37 . 2008-08-02 21:37 <DIR> d-------- C:\Program Files\Trend Micro
    2008-08-02 19:38 . 2008-08-03 17:02 4,322,336 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
    2008-08-02 19:38 . 2008-08-03 17:01 58,940 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
    2008-08-02 19:33 . 2008-07-09 09:05 1,086,952 --a------ C:\WINDOWS\system32\zpeng24.dll
    2008-08-02 19:07 . 2008-08-02 19:07 1,353,016 --a------ C:\WINDOWS\system32\vete.1
    2008-08-02 18:47 . 2008-08-02 18:48 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
    2008-08-02 17:49 . 2008-08-02 17:51 <DIR> d-------- C:\Program Files\Winamp
    2008-08-02 16:08 . 2005-07-20 02:42 653,072 --a------ C:\WINDOWS\system32\imsinstall.dll
    2008-08-02 16:08 . 2008-07-09 09:05 75,248 --a------ C:\WINDOWS\zllsputility.exe
    2008-08-02 16:07 . 2008-08-02 16:07 <DIR> d-------- C:\Program Files\Zone Labs
    2008-08-02 16:07 . 2008-08-03 16:49 355,090 --ah----- C:\WINDOWS\system32\vsconfig.xml
    2008-08-02 15:05 . 2008-08-02 15:31 <DIR> d-------- C:\Documents and Settings\Nela\Application Data\Skype
    2008-08-02 13:56 . 2001-08-17 13:48 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
    2008-08-02 13:56 . 2001-08-17 13:48 12,160 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys
    2008-08-02 13:56 . 2001-08-17 14:02 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
    2008-08-02 13:56 . 2001-08-17 14:02 9,600 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-08-02 16:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-08-02 13:31 --------- d-----w C:\Program Files\Common Files\Symantec Shared
    2008-08-02 13:31 --------- d-----w C:\Documents and Settings\Nela\Application Data\Yahoo!
    2008-08-02 13:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
    2008-08-02 13:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
    2008-08-02 13:29 --------- d-----w C:\Documents and Settings\luka\Application Data\Yahoo!
    2008-08-02 13:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo!
    2008-08-02 12:13 --------- d-----w C:\Documents and Settings\Nela\Application Data\skypePM
    2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
    2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
    2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
    2008-06-15 22:19 --------- d-----w C:\Documents and Settings\luka\Application Data\Talkback
    2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
    2008-06-11 14:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-06-11 14:31 --------- d-----w C:\Documents and Settings\Nela\Application Data\MSN6
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:56 15360]
    "MsnMsgr "= "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 12:34 5724184]
    "swg "= "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-26 17:36 68856]
    "SpybotSD TeaTimer "= "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 09:42 2156368]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "igfxtray "= "C:\WINDOWS\System32\igfxtray.exe" [2005-09-20 04:35 94208]
    "igfxhkcmd "= "C:\WINDOWS\System32\hkcmd.exe" [2005-09-20 04:32 77824]
    "igfxpers "= "C:\WINDOWS\System32\igfxpers.exe" [2005-09-20 04:36 114688]
    "NeroFilterCheck "= "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40 155648]
    "ZoneAlarm Client "= "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 09:05 919016]

    C:\Documents and Settings\Nela\Start Menu\Programs\Startup\
    H3 The Shadow of Death(TM).lnk - C:\Program Files\3DO\Heroes3\RegisterSOD\Remind32.exe [2007-07-06 17:07:31 67584]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "VIDC.YV12 "= yv12vfw.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
    "DisableMonitoring "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall "= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "C:\\WINDOWS\\system32\\ZoneLabs\\avsys\\ScanningProcess.exe "=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe "=
    "C:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe "=

    S3 usnjsvc;Usluga Messenger Sharing Folders USN Journal Reader;C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 12:31]
    .
    Contents of the 'Scheduled Tasks' folder

    2008-07-18 C:\WINDOWS\Tasks\1-Click Maintenance.job
    - C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe []

    2008-08-03 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job
    - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 12:20]
    .
    - - - - ORPHANS REMOVED - - - -

    BHO-{33EEA2FD-92A5-4B9E-9A36-D4E16C0AD849} - C:\WINDOWS\system32\hgGywWMd.dll
    HKLM-Run-e8f11989 - C:\WINDOWS\system32\nrdfmyrk.dll
    HKLM-Run-Cmaudio - cmicnfg.cpl
    HKU-Default-Run-ALUAlert - C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe
    Notify-efcYQJab - (no file)


    .
    ------- Supplementary Scan -------
    .
    FireFox -: Profile - C:\Documents and Settings\Nela\Application Data\Mozilla\Firefox\Profiles\0196v4jj.default\
    FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://search.yahoo.com/search?fr=ffsp1&p=
    FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.com/
    FF -: plugin - C:\Program Files\Java\jre1.6.0_03\bin\npjava11.dll
    FF -: plugin - C:\Program Files\Java\jre1.6.0_03\bin\npjava12.dll
    FF -: plugin - C:\Program Files\Java\jre1.6.0_03\bin\npjava13.dll
    FF -: plugin - C:\Program Files\Java\jre1.6.0_03\bin\npjava14.dll
    FF -: plugin - C:\Program Files\Java\jre1.6.0_03\bin\npjava32.dll
    FF -: plugin - C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll
    FF -: plugin - C:\Program Files\Java\jre1.6.0_03\bin\npoji610.dll
    FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPMorpBr.dll
    FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPZoneSB.dll
    FF -: plugin - C:\Program Files\Real\RhapsodyPlayerEngine\nprhapengine.dll


    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-08-03 17:02:24
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    ------------------------ Other Running Processes ------------------------
    .
    C:\WINDOWS\system32\wdfmgr.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    .
    **************************************************************************
    .
    Completion time: 2008-08-03 17:08:25 - machine was rebooted
    ComboFix-quarantined-files.txt 2008-08-03 15:08:18

    Pre-Run: 39,552,458,752 bytes free
    Post-Run: 39,502,626,816 bytes free

    159 --- E O F --- 2008-08-03 11:56:55


    Thanks
     
    fakin,
    #6
  8. 2008/08/03
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi
    OK let me get this right.
    You ran Combofix on the infected computer then it wouldn't boot?

    You then did a restore point prior to combofix being ran?

    The combofix log you posted was made before you did the restore point?

    Thanks
    Geri
     
    Geri,
    #7
  9. 2008/08/03
    fakin

    fakin Inactive Thread Starter

    Joined:
    2008/08/02
    Messages:
    12
    Likes Received:
    0
    Hi Geri,

    Yes. I've run ComboFix, and then it wont boot. In fact it shows desktop, then stalls for about 10 minutes, and then loads everything.

    Since I'm using ICS and ComboFix probably changed my LAN settings I wasn't able to connect to internet, and after I've set correct settings it still wasn't able to connect to internet (to post a ComboFix log) so I run System Restore.

    Yes, the restore point was the one prior to running ComboFix.

    Yes, the log is made prior to reverting the system with System Restore.

    Thanks,

    Darko
     
    fakin,
    #8
  10. 2008/08/03
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi Darko
    OK please post a new dss log.

    Thanks
    Geri
     
    Geri,
    #9
  11. 2008/08/03
    fakin

    fakin Inactive Thread Starter

    Joined:
    2008/08/02
    Messages:
    12
    Likes Received:
    0
    Hi Geri,

    OK, here it is:


    Deckard's System Scanner v20071014.68
    Run by Nela on 2008-08-03 19:12:58
    Computer is in Normal Mode.
    --------------------------------------------------------------------------------

    Total Physical Memory: 503 MiB (512 MiB recommended).


    -- HijackThis (run as Nela.exe) ------------------------------------------------

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 19:13, on 2008-08-03
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\RunDll32.exe
    C:\WINDOWS\System32\hkcmd.exe
    C:\WINDOWS\System32\igfxpers.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\3DO\Heroes3\RegisterSOD\Remind32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Documents and Settings\Nela\Desktop\darko_for_recovery\dss.exe
    C:\PROGRA~1\TRENDM~1\HIJACK~1\Nela.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: (no name) - {33EEA2FD-92A5-4B9E-9A36-D4E16C0AD849} - C:\WINDOWS\system32\hgGywWMd.dll (file missing)
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {5F11D5D5-3FB2-4ADD-84AD-D69BC9A5D312} - (no file)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: ImageShack Toolbar - {6932D140-ABC4-4073-A44C-D4A541665E35} - C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\System32\igfxpers.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [SBI] C:\Documents and Settings\Nela\Local Settings\Temporary Internet Files\Content.IE5\6J4FJD66\install_sbd_en[1].exe
    O4 - HKLM\..\Run: [e8f11989] rundll32.exe "C:\WINDOWS\system32\nrdfmyrk.dll ",b
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe "
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKUS\S-1-5-18\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'Default user')
    O4 - Startup: H3 The Shadow of Death(TM).lnk = C:\Program Files\3DO\Heroes3\RegisterSOD\Remind32.exe
    O8 - Extra context menu item: &Search - ?p=ZJfox000
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-ww\msntabres.dll.mui/229?d2a97d1c32b9416c96cdc6cdb27f3004
    O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-ww\msntabres.dll.mui/230?d2a97d1c32b9416c96cdc6cdb27f3004
    O8 - Extra context menu item: Post Image to Blog - res://C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll/5003
    O8 - Extra context menu item: Tag This Image - res://C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll/5002
    O8 - Extra context menu item: Transload Image to ImageShack - res://C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll/5004
    O8 - Extra context menu item: Upload All Images to ImageShack - res://C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll/5000
    O8 - Extra context menu item: Upload Image to ImageShack - res://C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll/5001
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {6932D140-ABC4-4073-A44C-D4A541665E35} (ImageShack Toolbar) - http://toolbar.imageshack.us/toolbar/ImageShackToolbar.cab
    O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://1-simona-3.spaces.live.com/PhotoUpload/MsnPUpld.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O20 - Winlogon Notify: efcYQJab - C:\WINDOWS\
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 7821 bytes

    -- Files created between 2008-07-03 and 2008-08-03 -----------------------------

    2008-08-03 16:53:07 6553600 --a------ C:\Documents and Settings\Nela\ntuser.dat
    2008-08-03 16:52:33 68096 --a------ C:\WINDOWS\zip.exe
    2008-08-03 16:52:33 49152 --a------ C:\WINDOWS\VFind.exe
    2008-08-03 16:52:33 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists>
    2008-08-03 16:52:33 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller>
    2008-08-03 16:52:33 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor>
    2008-08-03 16:52:33 98816 --a------ C:\WINDOWS\sed.exe
    2008-08-03 16:52:33 80412 --a------ C:\WINDOWS\grep.exe
    2008-08-03 16:52:33 89504 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; >
    2008-08-03 11:07:05 0 d-------- C:\Documents and Settings\Nela\Application Data\Malwarebytes
    2008-08-03 11:06:54 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-08-03 11:06:54 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-08-02 21:37:57 0 d-------- C:\Program Files\Trend Micro
    2008-08-02 19:38:13 4376096 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
    2008-08-02 17:49:23 0 d-------- C:\Program Files\Winamp
    2008-08-02 15:05:40 0 d-------- C:\Documents and Settings\Nela\Application Data\Skype


    -- Find3M Report ---------------------------------------------------------------

    2008-08-03 16:57:43 0 d-------- C:\Program Files\Common Files
    2008-08-02 19:35:24 4212 --ah----- C:\WINDOWS\system32\zllictbl.dat
    2008-08-02 17:56:51 27 --a------ C:\WINDOWS\mscpt.dat
    2008-08-02 16:27:02 0 d-------- C:\Documents and Settings\Nela\Application Data\Mozilla
    2008-08-02 15:31:40 0 d-------- C:\Program Files\Common Files\Symantec Shared
    2008-08-02 15:31:33 0 d-------- C:\Documents and Settings\Nela\Application Data\Yahoo!
    2008-08-02 14:13:15 0 d-------- C:\Documents and Settings\Nela\Application Data\skypePM
    2008-06-11 16:31:30 0 d-------- C:\Documents and Settings\Nela\Application Data\MSN6
    2008-06-11 14:02:43 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat


    -- Registry Dump ---------------------------------------------------------------

    *Note* empty entries & legit default entries are not shown


    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{33EEA2FD-92A5-4B9E-9A36-D4E16C0AD849}]
    C:\WINDOWS\system32\hgGywWMd.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5F11D5D5-3FB2-4ADD-84AD-D69BC9A5D312}]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Cmaudio "= "cmicnfg.cpl" []
    "igfxtray "= "C:\WINDOWS\System32\igfxtray.exe" [2005-09-20 04:35]
    "igfxhkcmd "= "C:\WINDOWS\System32\hkcmd.exe" [2005-09-20 04:32]
    "igfxpers "= "C:\WINDOWS\System32\igfxpers.exe" [2005-09-20 04:36]
    "NeroFilterCheck "= "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40]
    "SBI "= "C:\Documents and Settings\Nela\Local Settings\Temporary Internet Files\Content.IE5\6J4FJD66\install_sbd_en[1].exe" []
    "e8f11989 "= "C:\WINDOWS\system32\nrdfmyrk.dll" []
    "ZoneAlarm Client "= "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 09:05]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:56]
    "MsnMsgr "= "C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34]
    "swg "= "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-26 17:36]
    "SpybotSD TeaTimer "= "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 09:42]

    [HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
    "ALUAlert "=C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe

    C:\Documents and Settings\Nela\Start Menu\Programs\Startup\
    H3 The Shadow of Death(TM).lnk - C:\Program Files\3DO\Heroes3\RegisterSOD\Remind32.exe [2007-07-06 17:07:31]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
    "disableregistrytools "=0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcYQJab]

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    "Authentication Packages "= msv1_0 C:\WINDOWS\system32\hgGywWMd

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
    SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSEXESVC]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
    @= "Volume shadow copy "




    -- End of Deckard's System Scanner: finished at 2008-08-03 19:14:20 ------------


    Thanks,

    Darko
     
    fakin,
    #10
  12. 2008/08/03
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi
    OK please do this.

    Download ERUNT from Derfisch or Aumha and save it to your desktop.

    Use the setup program to install ERUNT on your computer
    Click ERUNT.Setup.exe to install ERUNT and backup your registry.
    Uncheck the "Create NTREGOPT desktop icon" box.
    In the window that comes up to Create an ERUNT entry to the Start up folder select No.

    By Default the backup location is C:\windows\erunt\ (current date)
    Click OK to continue with the registry backup.
    If the folder does not exist then let ERUNT create the folder for you by clicking Yes
    You should see a progress bar when ERUNT is backing up the Windows Registry.
    After ERUNT has completed the Windows Registry backup. Click OK to exit ERUNT

    Please download the OTMoveIt2 by OldTimer.
    • Save it to your desktop.
    • Please double-click OTMoveIt2.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
    • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

      Code:
      C:\WINDOWS\system32\hgGywWMd.dll
C:\WINDOWS\system32\nrdfmyrk.dll
    • Return to OTMoveIt2, right click in the "Paste Custom List Of Files/Patterns To Move " window (under the yellow bar) and choose Paste.
    • Click the red Moveit! button.
    • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
    • Close OTMoveIt2
    Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.


    Open "Notepad†Copy the contents of the code box below to the blank Notepad.
    Click "File" > "Save as "
    In the "Save In" box at the top click the down arrow and select DeskTop

    In the "File name" type in: fix.reg
    In the "Save As Type" select: All Files
    Once saved, Go to your desktop double click "fix.reg file" and let it merge with the registry.
    Code:
    REGEDIT4

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{33EEA2FD-92A5-4B9E-9A36-D4E16C0AD849}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5F11D5D5-3FB2-4ADD-84AD-D69BC9A5D312}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
 "e8f11989 "=-
    Please podt the OTMovit2 log and a new dss log.

    Thanks
    Geri
     
    Geri,
    #11
  13. 2008/08/03
    fakin

    fakin Inactive Thread Starter

    Joined:
    2008/08/02
    Messages:
    12
    Likes Received:
    0
    Hi Geri,

    OK, I've done like you've said. Here's the scenario I got:

    Run OTMoveIt with the commands you've sent and here's the log:

    File/Folder C:\WINDOWS\system32\hgGywWMd.dll not found.
    File/Folder C:\WINDOWS\system32\nrdfmyrk.dll not found.

    OTMoveIt2 by OldTimer - Version 1.0.4.3 log created on 08032008_205411


    --------------------------------------------------------------------------
    imported your code into registry...
    run DSS and here's the log:

    Deckard's System Scanner v20071014.68
    Run by Nela on 2008-08-03 20:57:26
    Computer is in Normal Mode.
    --------------------------------------------------------------------------------

    Total Physical Memory: 503 MiB (512 MiB recommended).


    -- HijackThis (run as Nela.exe) ------------------------------------------------

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 20:57, on 2008-08-03
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\system32\RunDll32.exe
    C:\WINDOWS\System32\hkcmd.exe
    C:\WINDOWS\System32\igfxpers.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\3DO\Heroes3\RegisterSOD\Remind32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Documents and Settings\Nela\Desktop\OTMoveIt2.exe
    C:\Documents and Settings\Nela\Desktop\darko_for_recovery\dss.exe
    C:\PROGRA~1\TRENDM~1\HIJACK~1\Nela.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: (no name) - {33EEA2FD-92A5-4B9E-9A36-D4E16C0AD849} - C:\WINDOWS\system32\hgGywWMd.dll (file missing)
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {5F11D5D5-3FB2-4ADD-84AD-D69BC9A5D312} - (no file)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: ImageShack Toolbar - {6932D140-ABC4-4073-A44C-D4A541665E35} - C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\System32\igfxpers.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [SBI] C:\Documents and Settings\Nela\Local Settings\Temporary Internet Files\Content.IE5\6J4FJD66\install_sbd_en[1].exe
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe "
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKUS\S-1-5-18\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'Default user')
    O4 - Startup: H3 The Shadow of Death(TM).lnk = C:\Program Files\3DO\Heroes3\RegisterSOD\Remind32.exe
    O8 - Extra context menu item: &Search - ?p=ZJfox000
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-ww\msntabres.dll.mui/229?d2a97d1c32b9416c96cdc6cdb27f3004
    O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-ww\msntabres.dll.mui/230?d2a97d1c32b9416c96cdc6cdb27f3004
    O8 - Extra context menu item: Post Image to Blog - res://C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll/5003
    O8 - Extra context menu item: Tag This Image - res://C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll/5002
    O8 - Extra context menu item: Transload Image to ImageShack - res://C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll/5004
    O8 - Extra context menu item: Upload All Images to ImageShack - res://C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll/5000
    O8 - Extra context menu item: Upload Image to ImageShack - res://C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll/5001
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {6932D140-ABC4-4073-A44C-D4A541665E35} (ImageShack Toolbar) - http://toolbar.imageshack.us/toolbar/ImageShackToolbar.cab
    O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://1-simona-3.spaces.live.com/PhotoUpload/MsnPUpld.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O20 - Winlogon Notify: efcYQJab - C:\WINDOWS\
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 7749 bytes

    -- Files created between 2008-07-03 and 2008-08-03 -----------------------------

    2008-08-03 16:53:07 6553600 --a------ C:\Documents and Settings\Nela\ntuser.dat
    2008-08-03 16:52:33 68096 --a------ C:\WINDOWS\zip.exe
    2008-08-03 16:52:33 49152 --a------ C:\WINDOWS\VFind.exe
    2008-08-03 16:52:33 212480 --a------ C:\WINDOWS\swxcacls.exe <Not Verified; SteelWerX; SteelWerX Extended Configurator ACLists>
    2008-08-03 16:52:33 136704 --a------ C:\WINDOWS\swsc.exe <Not Verified; SteelWerX; SteelWerX Service Controller>
    2008-08-03 16:52:33 161792 --a------ C:\WINDOWS\swreg.exe <Not Verified; SteelWerX; SteelWerX Registry Editor>
    2008-08-03 16:52:33 98816 --a------ C:\WINDOWS\sed.exe
    2008-08-03 16:52:33 80412 --a------ C:\WINDOWS\grep.exe
    2008-08-03 16:52:33 89504 --a------ C:\WINDOWS\fdsv.exe <Not Verified; Smallfrogs Studio; >
    2008-08-03 11:07:05 0 d-------- C:\Documents and Settings\Nela\Application Data\Malwarebytes
    2008-08-03 11:06:54 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-08-03 11:06:54 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-08-02 21:37:57 0 d-------- C:\Program Files\Trend Micro
    2008-08-02 19:38:13 4394016 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
    2008-08-02 17:49:23 0 d-------- C:\Program Files\Winamp
    2008-08-02 15:05:40 0 d-------- C:\Documents and Settings\Nela\Application Data\Skype


    -- Find3M Report ---------------------------------------------------------------

    2008-08-03 16:57:43 0 d-------- C:\Program Files\Common Files
    2008-08-02 19:35:24 4212 --ah----- C:\WINDOWS\system32\zllictbl.dat
    2008-08-02 17:56:51 27 --a------ C:\WINDOWS\mscpt.dat
    2008-08-02 16:27:02 0 d-------- C:\Documents and Settings\Nela\Application Data\Mozilla
    2008-08-02 15:31:40 0 d-------- C:\Program Files\Common Files\Symantec Shared
    2008-08-02 15:31:33 0 d-------- C:\Documents and Settings\Nela\Application Data\Yahoo!
    2008-08-02 14:13:15 0 d-------- C:\Documents and Settings\Nela\Application Data\skypePM
    2008-06-11 16:31:30 0 d-------- C:\Documents and Settings\Nela\Application Data\MSN6
    2008-06-11 14:02:43 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat


    -- Registry Dump ---------------------------------------------------------------

    *Note* empty entries & legit default entries are not shown


    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{33EEA2FD-92A5-4B9E-9A36-D4E16C0AD849}]
    C:\WINDOWS\system32\hgGywWMd.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5F11D5D5-3FB2-4ADD-84AD-D69BC9A5D312}]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Cmaudio "= "cmicnfg.cpl" []
    "igfxtray "= "C:\WINDOWS\System32\igfxtray.exe" [2005-09-20 04:35]
    "igfxhkcmd "= "C:\WINDOWS\System32\hkcmd.exe" [2005-09-20 04:32]
    "igfxpers "= "C:\WINDOWS\System32\igfxpers.exe" [2005-09-20 04:36]
    "NeroFilterCheck "= "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40]
    "SBI "= "C:\Documents and Settings\Nela\Local Settings\Temporary Internet Files\Content.IE5\6J4FJD66\install_sbd_en[1].exe" []
    "ZoneAlarm Client "= "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 09:05]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:56]
    "MsnMsgr "= "C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34]
    "swg "= "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-26 17:36]
    "SpybotSD TeaTimer "= "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 09:42]

    [HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
    "ALUAlert "=C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe

    C:\Documents and Settings\Nela\Start Menu\Programs\Startup\
    H3 The Shadow of Death(TM).lnk - C:\Program Files\3DO\Heroes3\RegisterSOD\Remind32.exe [2007-07-06 17:07:31]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
    "disableregistrytools "=0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcYQJab]

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    "Authentication Packages "= msv1_0 C:\WINDOWS\system32\hgGywWMd

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
    SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSEXESVC]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
    @= "Volume shadow copy "




    -- End of Deckard's System Scanner: finished at 2008-08-03 20:58:38 ------------

    Thanks,

    Darko
     
    fakin,
    #12
  14. 2008/08/03
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi
    OK please post this log.

    C:\Qoobox\ComboFix-quarantined-files.txt log.

    Thanks
    Geri
     
    Geri,
    #13
  15. 2008/08/03
    fakin

    fakin Inactive Thread Starter

    Joined:
    2008/08/02
    Messages:
    12
    Likes Received:
    0
    Hi,

    here it is:

    2008-06-17 15:01 1655676 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\ckhgpopc.ini.vir
    2008-06-17 16:29 477036 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\WxaKlUvw.ini.vir
    2008-06-17 16:29 477036 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\WxaKlUvw.ini2.vir
    2008-06-17 17:31 1630708 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\uyrlbfpc.ini.vir
    2008-06-19 16:57 1634185 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\ltvwawpe.ini.vir
    2008-06-26 01:02 1987991 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\rkdyswcq.ini.vir
    2008-06-26 01:07 2378512 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\plwxgnrq.ini.vir
    2008-07-02 15:05 454628 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\NortBJjl.ini2.vir
    2008-07-02 15:07 454774 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\NortBJjl.ini.vir
    2008-07-04 12:21 1694615 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\hdaqwmhs.ini.vir
    2008-07-04 15:11 446852 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\UtsuDJlm.ini2.vir
    2008-07-04 15:13 447440 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\UtsuDJlm.ini.vir
    2008-07-04 15:16 53 --a------ C:\Qoobox\Quarantine\C\Documents and Settings\luka\Local Settings\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML.vir
    2008-07-09 18:50 143 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\mcrh.tmp.vir
    2008-07-24 14:54 2259873 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\krymfdrn.ini.vir
    2008-08-02 19:25 440915 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\dMWwyGgh.ini.vir
    2008-08-02 19:25 440915 --a------ C:\Qoobox\Quarantine\C\WINDOWS\system32\dMWwyGgh.ini2.vir
    2008-08-03 16:59 54 --a------ C:\Qoobox\Quarantine\catchme.log
    2008-08-03 17:07 0 --a------ C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-CFSServ.exe.reg.dat
    2008-08-03 17:07 0 --a------ C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-NDSTray.exe.reg.dat
    2008-08-03 17:07 0 --a------ C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-TFncKy.reg.dat
    2008-08-03 17:07 125 --a------ C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-Cmaudio.reg.dat
    2008-08-03 17:07 149 --a------ C:\Qoobox\Quarantine\Registry_backups\HKLM-Run-e8f11989.reg.dat
    2008-08-03 17:07 150 --a------ C:\Qoobox\Quarantine\Registry_backups\HKU-Default-Run-ALUAlert.reg.dat
    2008-08-03 17:07 270 --a------ C:\Qoobox\Quarantine\Registry_backups\Notify-efcYQJab.reg.dat
    2008-08-03 17:07 374 --a------ C:\Qoobox\Quarantine\Registry_backups\BHO-{33EEA2FD-92A5-4B9E-9A36-D4E16C0AD849}.reg.dat


    Thanks,

    Darko
     
    fakin,
    #14
  16. 2008/08/03
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi
    OK Thanks

    Please delete the combofix you have.
    Here is how.

    Click Start>Run in the run box copy and paste or type ComboFix /u then hit Enter to uninstall ComboFix and remove the files/folders it created. This action will also reset the System Restore points, removing the infected files there as well.

    Spybot S&D's tea timer normally provides real-time protection from spyware, however it may interfere with what we need to do. We will disable it until the machine is clean when it can be re-enabled.

    First step:
    • Right-click the Spybot Icon in the System Tray (looks like a blue/white calendar with a padlock symbol)
    • If you have the new version 1.5, Click once on Resident Protection, then Right click the Spybot icon again and make sure Resident Protection is now Unchecked. The Spybot icon in the System tray should now be now colorless.
    • If you have Version 1.4, Click on Exit Spybot S&D Resident
    Second step, For Either Version :
    • Open Spybot S&D
    • Click Mode, choose Advanced Mode
    • Go To the bottom of the Vertical Panel on the Left, Click Tools
    • then, also in left panel, click Resident shows a red/white shield.
    • If your firewall raises a question, say OK
    • In the Resident protection status frame, Uncheck the box labeled Resident "Tea-Timer "(Protection of over-all system settings) active
    • OK any prompts.
    • Use File, Exit to terminate Spybot
    • Reboot your machine for the changes to take effect.
    Don't forget to re-enable it, when your computer is clean.


    Please re-open HiJackThis and scan only. Check the boxes next to all the entries listed below.

    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: (no name) - {33EEA2FD-92A5-4B9E-9A36-D4E16C0AD849} - C:\WINDOWS\system32\hgGywWMd.dll (file missing)
    O2 - BHO: (no name) - {5F11D5D5-3FB2-4ADD-84AD-D69BC9A5D312} - (no file)
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O8 - Extra context menu item: &Search - ?p=ZJfox000
    O20 - Winlogon Notify: efcYQJab - C:\WINDOWS\

    Now close all windows other than HiJackThis, then click Fix Checked.

    Close HJT.

    Please reboot and then post a new dss log.

    Thanks
    Geri
     
    Geri,
    #15
  17. 2008/08/03
    fakin

    fakin Inactive Thread Starter

    Joined:
    2008/08/02
    Messages:
    12
    Likes Received:
    0
    Hi,

    OK, I've done like you asked, system already acting better :)

    Here's the log:

    Deckard's System Scanner v20071014.68
    Run by Nela on 2008-08-03 21:59:41
    Computer is in Normal Mode.
    --------------------------------------------------------------------------------

    Total Physical Memory: 503 MiB (512 MiB recommended).


    -- HijackThis (run as Nela.exe) ------------------------------------------------

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 21:59, on 2008-08-03
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\RunDll32.exe
    C:\WINDOWS\System32\hkcmd.exe
    C:\WINDOWS\System32\igfxpers.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\3DO\Heroes3\RegisterSOD\Remind32.exe
    C:\Documents and Settings\Nela\Desktop\darko_for_recovery\dss.exe
    C:\PROGRA~1\TRENDM~1\HIJACK~1\Nela.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: (no name) - {33EEA2FD-92A5-4B9E-9A36-D4E16C0AD849} - (no file)
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {5F11D5D5-3FB2-4ADD-84AD-D69BC9A5D312} - (no file)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: ImageShack Toolbar - {6932D140-ABC4-4073-A44C-D4A541665E35} - C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\System32\igfxpers.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [SBI] C:\Documents and Settings\Nela\Local Settings\Temporary Internet Files\Content.IE5\6J4FJD66\install_sbd_en[1].exe
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe "
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKUS\S-1-5-18\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'Default user')
    O4 - Startup: H3 The Shadow of Death(TM).lnk = C:\Program Files\3DO\Heroes3\RegisterSOD\Remind32.exe
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-ww\msntabres.dll.mui/229?d2a97d1c32b9416c96cdc6cdb27f3004
    O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-ww\msntabres.dll.mui/230?d2a97d1c32b9416c96cdc6cdb27f3004
    O8 - Extra context menu item: Post Image to Blog - res://C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll/5003
    O8 - Extra context menu item: Tag This Image - res://C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll/5002
    O8 - Extra context menu item: Transload Image to ImageShack - res://C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll/5004
    O8 - Extra context menu item: Upload All Images to ImageShack - res://C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll/5000
    O8 - Extra context menu item: Upload Image to ImageShack - res://C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll/5001
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {6932D140-ABC4-4073-A44C-D4A541665E35} (ImageShack Toolbar) - http://toolbar.imageshack.us/toolbar/ImageShackToolbar.cab
    O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://1-simona-3.spaces.live.com/PhotoUpload/MsnPUpld.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O20 - Winlogon Notify: efcYQJab - C:\WINDOWS\
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 7661 bytes

    -- Files created between 2008-07-03 and 2008-08-03 -----------------------------

    2008-08-03 16:53:07 6553600 --a------ C:\Documents and Settings\Nela\ntuser.dat
    2008-08-03 11:07:05 0 d-------- C:\Documents and Settings\Nela\Application Data\Malwarebytes
    2008-08-03 11:06:54 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-08-03 11:06:54 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-08-02 21:37:57 0 d-------- C:\Program Files\Trend Micro
    2008-08-02 19:38:13 4413728 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
    2008-08-02 17:49:23 0 d-------- C:\Program Files\Winamp
    2008-08-02 15:05:40 0 d-------- C:\Documents and Settings\Nela\Application Data\Skype


    -- Find3M Report ---------------------------------------------------------------

    2008-08-03 16:57:43 0 d-------- C:\Program Files\Common Files
    2008-08-02 19:35:24 4212 --ah----- C:\WINDOWS\system32\zllictbl.dat
    2008-08-02 17:56:51 27 --a------ C:\WINDOWS\mscpt.dat
    2008-08-02 16:27:02 0 d-------- C:\Documents and Settings\Nela\Application Data\Mozilla
    2008-08-02 15:31:40 0 d-------- C:\Program Files\Common Files\Symantec Shared
    2008-08-02 15:31:33 0 d-------- C:\Documents and Settings\Nela\Application Data\Yahoo!
    2008-08-02 14:13:15 0 d-------- C:\Documents and Settings\Nela\Application Data\skypePM
    2008-06-11 16:31:30 0 d-------- C:\Documents and Settings\Nela\Application Data\MSN6
    2008-06-11 14:02:43 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat


    -- Registry Dump ---------------------------------------------------------------

    *Note* empty entries & legit default entries are not shown


    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{33EEA2FD-92A5-4B9E-9A36-D4E16C0AD849}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5F11D5D5-3FB2-4ADD-84AD-D69BC9A5D312}]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Cmaudio "= "cmicnfg.cpl" []
    "igfxtray "= "C:\WINDOWS\System32\igfxtray.exe" [2005-09-20 04:35]
    "igfxhkcmd "= "C:\WINDOWS\System32\hkcmd.exe" [2005-09-20 04:32]
    "igfxpers "= "C:\WINDOWS\System32\igfxpers.exe" [2005-09-20 04:36]
    "NeroFilterCheck "= "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40]
    "SBI "= "C:\Documents and Settings\Nela\Local Settings\Temporary Internet Files\Content.IE5\6J4FJD66\install_sbd_en[1].exe" []
    "ZoneAlarm Client "= "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 09:05]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:56]
    "MsnMsgr "= "C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34]
    "swg "= "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-26 17:36]
    "SpybotSD TeaTimer "= "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 09:42]

    [HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
    "ALUAlert "=C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe

    C:\Documents and Settings\Nela\Start Menu\Programs\Startup\
    H3 The Shadow of Death(TM).lnk - C:\Program Files\3DO\Heroes3\RegisterSOD\Remind32.exe [2007-07-06 17:07:31]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
    "disableregistrytools "=0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcYQJab]

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    "Authentication Packages "= msv1_0 C:\WINDOWS\system32\hgGywWMd

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
    SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSEXESVC "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
    @= "Volume shadow copy "




    -- End of Deckard's System Scanner: finished at 2008-08-03 22:00:24 ------------


    Thanks,

    Darko
     
    fakin,
    #16
  18. 2008/08/03
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi Darko
    OK there is still something stopping HJT from fixing those entries. So lets do it this way.

    Reboot into safe mode.
    Restart your computer and as soon as it starts booting up again continuously tap F8. A menu should come up where you will be given the option to enter Safe Mode.

    Please re-open HiJackThis and scan only. Check the boxes next to all the entries listed below.

    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: (no name) - {33EEA2FD-92A5-4B9E-9A36-D4E16C0AD849} - (no file)
    O2 - BHO: (no name) - {5F11D5D5-3FB2-4ADD-84AD-D69BC9A5D312} - (no file)
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O20 - Winlogon Notify: efcYQJab - C:\WINDOWS\

    Now close all windows other than HiJackThis, then click Fix Checked.

    Close HJT.

    Now reboot and post a new dss log.

    Thanks
    Geri
     
    Geri,
    #17
  19. 2008/08/04
    fakin

    fakin Inactive Thread Starter

    Joined:
    2008/08/02
    Messages:
    12
    Likes Received:
    0
    Hi Geri,

    OK, everything done like you've said and here's the log:


    Deckard's System Scanner v20071014.68
    Run by Nela on 2008-08-04 10:40:15
    Computer is in Normal Mode.
    --------------------------------------------------------------------------------

    Total Physical Memory: 503 MiB (512 MiB recommended).


    -- HijackThis (run as Nela.exe) ------------------------------------------------

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 10:40, on 2008-08-04
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\ZoneLabs\vsmon.exe
    C:\WINDOWS\system32\RunDll32.exe
    C:\WINDOWS\System32\hkcmd.exe
    C:\WINDOWS\System32\igfxpers.exe
    C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Program Files\3DO\Heroes3\RegisterSOD\Remind32.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Documents and Settings\Nela\Desktop\dss.exe
    C:\PROGRA~1\TRENDM~1\HIJACK~1\Nela.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://us.rd.yahoo.com/customize/ie/defaults/su/msgr8/*http://www.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/defaults/sb/msgr8/*http://www.yahoo.com/ext/search/search.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/ie/defaults/sp/msgr8/*http://www.yahoo.com
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
    O2 - BHO: (no name) - {02478D38-C3F9-4efb-9B51-7695ECA05670} - (no file)
    O2 - BHO: (no name) - {33EEA2FD-92A5-4B9E-9A36-D4E16C0AD849} - (no file)
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {5F11D5D5-3FB2-4ADD-84AD-D69BC9A5D312} - (no file)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\3.0.1225.9868\swg.dll
    O2 - BHO: Windows Live Toolbar Helper - {BDBD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: Windows Live Toolbar - {BDAD1DAD-C946-4A17-ADC1-64B5B4FF55D0} - C:\Program Files\Windows Live Toolbar\msntb.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
    O3 - Toolbar: ImageShack Toolbar - {6932D140-ABC4-4073-A44C-D4A541665E35} - C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll
    O4 - HKLM\..\Run: [Cmaudio] RunDll32 cmicnfg.cpl,CMICtrlWnd
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\System32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\System32\hkcmd.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\System32\igfxpers.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [SBI] C:\Documents and Settings\Nela\Local Settings\Temporary Internet Files\Content.IE5\6J4FJD66\install_sbd_en[1].exe
    O4 - HKLM\..\Run: [ZoneAlarm Client] "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe "
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKUS\S-1-5-18\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [ALUAlert] C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe (User 'Default user')
    O4 - Startup: H3 The Shadow of Death(TM).lnk = C:\Program Files\3DO\Heroes3\RegisterSOD\Remind32.exe
    O8 - Extra context menu item: &Windows Live Search - res://C:\Program Files\Windows Live Toolbar\msntb.dll/search.htm
    O8 - Extra context menu item: Add to Windows &Live Favorites - http://favorites.live.com/quickadd.aspx
    O8 - Extra context menu item: Open in new background tab - res://C:\Program Files\Windows Live Toolbar\Components\en-ww\msntabres.dll.mui/229?d2a97d1c32b9416c96cdc6cdb27f3004
    O8 - Extra context menu item: Open in new foreground tab - res://C:\Program Files\Windows Live Toolbar\Components\en-ww\msntabres.dll.mui/230?d2a97d1c32b9416c96cdc6cdb27f3004
    O8 - Extra context menu item: Post Image to Blog - res://C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll/5003
    O8 - Extra context menu item: Tag This Image - res://C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll/5002
    O8 - Extra context menu item: Transload Image to ImageShack - res://C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll/5004
    O8 - Extra context menu item: Upload All Images to ImageShack - res://C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll/5000
    O8 - Extra context menu item: Upload Image to ImageShack - res://C:\Program Files\ImageShackToolbar\ImageShackToolbar.dll/5001
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {6932D140-ABC4-4073-A44C-D4A541665E35} (ImageShack Toolbar) - http://toolbar.imageshack.us/toolbar/ImageShackToolbar.cab
    O16 - DPF: {7FC1B346-83E6-4774-8D20-1A6B09B0E737} (Windows Live Photo Upload Control) - http://1-simona-3.spaces.live.com/PhotoUpload/MsnPUpld.cab
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O20 - Winlogon Notify: efcYQJab - C:\WINDOWS\
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: TrueVector Internet Monitor (vsmon) - Zone Labs, LLC - C:\WINDOWS\system32\ZoneLabs\vsmon.exe

    --
    End of file - 7642 bytes

    -- Files created between 2008-07-04 and 2008-08-04 -----------------------------

    2008-08-03 16:53:07 6553600 --a------ C:\Documents and Settings\Nela\ntuser.dat
    2008-08-03 11:07:05 0 d-------- C:\Documents and Settings\Nela\Application Data\Malwarebytes
    2008-08-03 11:06:54 0 d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-08-03 11:06:54 0 d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-08-02 21:37:57 0 d-------- C:\Program Files\Trend Micro
    2008-08-02 19:38:13 4433440 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
    2008-08-02 17:49:23 0 d-------- C:\Program Files\Winamp
    2008-08-02 15:05:40 0 d-------- C:\Documents and Settings\Nela\Application Data\Skype


    -- Find3M Report ---------------------------------------------------------------

    2008-08-03 16:57:43 0 d-------- C:\Program Files\Common Files
    2008-08-02 19:35:24 4212 --ah----- C:\WINDOWS\system32\zllictbl.dat
    2008-08-02 17:56:51 27 --a------ C:\WINDOWS\mscpt.dat
    2008-08-02 16:27:02 0 d-------- C:\Documents and Settings\Nela\Application Data\Mozilla
    2008-08-02 15:31:40 0 d-------- C:\Program Files\Common Files\Symantec Shared
    2008-08-02 15:31:33 0 d-------- C:\Documents and Settings\Nela\Application Data\Yahoo!
    2008-08-02 14:13:15 0 d-------- C:\Documents and Settings\Nela\Application Data\skypePM
    2008-06-11 16:31:30 0 d-------- C:\Documents and Settings\Nela\Application Data\MSN6
    2008-06-11 14:02:43 56 --ah----- C:\WINDOWS\system32\ezsidmv.dat


    -- Registry Dump ---------------------------------------------------------------

    *Note* empty entries & legit default entries are not shown


    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{33EEA2FD-92A5-4B9E-9A36-D4E16C0AD849}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5F11D5D5-3FB2-4ADD-84AD-D69BC9A5D312}]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Cmaudio "= "cmicnfg.cpl" []
    "igfxtray "= "C:\WINDOWS\System32\igfxtray.exe" [2005-09-20 04:35]
    "igfxhkcmd "= "C:\WINDOWS\System32\hkcmd.exe" [2005-09-20 04:32]
    "igfxpers "= "C:\WINDOWS\System32\igfxpers.exe" [2005-09-20 04:36]
    "NeroFilterCheck "= "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40]
    "SBI "= "C:\Documents and Settings\Nela\Local Settings\Temporary Internet Files\Content.IE5\6J4FJD66\install_sbd_en[1].exe" []
    "ZoneAlarm Client "= "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 09:05]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:56]
    "MsnMsgr "= "C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2007-10-18 12:34]
    "swg "= "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-26 17:36]
    "SpybotSD TeaTimer "= "C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-07-07 09:42]

    [HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
    "ALUAlert "=C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe

    C:\Documents and Settings\Nela\Start Menu\Programs\Startup\
    H3 The Shadow of Death(TM).lnk - C:\Program Files\3DO\Heroes3\RegisterSOD\Remind32.exe [2007-07-06 17:07:31]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
    "disableregistrytools "=0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcYQJab]

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
    "Authentication Packages "= msv1_0 C:\WINDOWS\system32\hgGywWMd

    [HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
    SecurityProviders msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll,

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PSEXESVC "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
    @= "Volume shadow copy "




    -- End of Deckard's System Scanner: finished at 2008-08-04 10:42:06 ------------


    Thanks,

    Darko
     
    fakin,
    #18
  20. 2008/08/04
    Geri Lifetime Subscription

    Geri Inactive Alumni

    Joined:
    2003/03/02
    Messages:
    4,580
    Likes Received:
    7
    Hi fakin
    OK still not working. Lets try combofix again.

    Please follow the instructions carefully and disable all real time protections before running it.

    Download ComboFix from Here to your Desktop.

    It's best to disable realtime protection applications as they sometimes interfere with the tool.
    Check this link for any applicable programs you may have.
    • Close all open programs and windows
    • Double click combofix.exe and follow the prompts.
    • Vista users right click Combofix.exe and select Run As Administrator.
    • When finished, it shall produce a log for you. Post the Combofix log
    Note: Do not mouseclick combofix's window while its running. That may cause it to stall

    Note - ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.

    Note - Combofix makes some changes when run to prevent autorun/autoplay of ALL CDs, floppies and USB devices, to assist with malware removal & increase security. If this is an issue or makes it difficult for you to use those devices, please ask how to reset it.

    Thanks
    Geri
     
    Geri,
    #19
  21. 2008/08/05
    fakin

    fakin Inactive Thread Starter

    Joined:
    2008/08/02
    Messages:
    12
    Likes Received:
    0
    Hi Geri,

    OK, after running ComboFix again I got problem with booting and network.
    Anyway, I've run ComboFix and copied log to my external disk, so here's log:

    ComboFix 08-08-04.01 - Nela 2008-08-05 12:22:09.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.250 [GMT 2:00]
    Running from: C:\Documents and Settings\Nela\Desktop\ComboFix.exe

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\system32\ckhgpopc.ini
    C:\WINDOWS\system32\dMWwyGgh.ini
    C:\WINDOWS\system32\hdaqwmhs.ini
    C:\WINDOWS\system32\krymfdrn.ini
    C:\WINDOWS\system32\ltvwawpe.ini
    C:\WINDOWS\system32\NortBJjl.ini
    C:\WINDOWS\system32\plwxgnrq.ini
    C:\WINDOWS\system32\rkdyswcq.ini
    C:\WINDOWS\system32\UtsuDJlm.ini
    C:\WINDOWS\system32\uyrlbfpc.ini
    C:\WINDOWS\system32\WxaKlUvw.ini

    .
    ((((((((((((((((((((((((( Files Created from 2008-07-05 to 2008-08-05 )))))))))))))))))))))))))))))))
    .

    2008-08-03 21:57 . 2008-08-03 21:57 <DIR> d-------- C:\Deckard
    2008-08-03 20:52 . 2008-08-03 20:52 <DIR> d-------- C:\Program Files\ERUNT
    2008-08-03 16:47 . 2004-08-04 09:56 21,504 --a------ C:\WINDOWS\system32\hidserv.dll
    2008-08-03 16:47 . 2004-08-04 07:58 14,848 --a------ C:\WINDOWS\system32\drivers\kbdhid.sys
    2008-08-03 16:47 . 2004-08-04 07:58 14,848 --a--c--- C:\WINDOWS\system32\dllcache\kbdhid.sys
    2008-08-03 16:46 . 2004-08-04 08:08 31,616 --a------ C:\WINDOWS\system32\drivers\usbccgp.sys
    2008-08-03 16:46 . 2004-08-04 08:08 31,616 --a--c--- C:\WINDOWS\system32\dllcache\usbccgp.sys
    2008-08-03 11:07 . 2008-08-03 11:07 <DIR> d-------- C:\Documents and Settings\Nela\Application Data\Malwarebytes
    2008-08-03 11:06 . 2008-08-03 11:07 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-08-03 11:06 . 2008-08-03 11:06 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-08-03 11:06 . 2008-07-30 20:07 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
    2008-08-03 11:06 . 2008-07-30 20:07 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-08-02 21:37 . 2008-08-02 21:37 <DIR> d-------- C:\Program Files\Trend Micro
    2008-08-02 19:38 . 2008-08-05 12:26 4,506,912 --ahs---- C:\WINDOWS\system32\drivers\fidbox.dat
    2008-08-02 19:38 . 2008-08-05 12:25 61,388 --ahs---- C:\WINDOWS\system32\drivers\fidbox.idx
    2008-08-02 19:33 . 2008-07-09 09:05 1,086,952 --a------ C:\WINDOWS\system32\zpeng24.dll
    2008-08-02 19:07 . 2008-08-02 19:07 1,353,016 --a------ C:\WINDOWS\system32\vete.1
    2008-08-02 18:47 . 2008-08-02 18:48 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
    2008-08-02 17:49 . 2008-08-02 17:51 <DIR> d-------- C:\Program Files\Winamp
    2008-08-02 16:08 . 2005-07-20 02:42 653,072 --a------ C:\WINDOWS\system32\imsinstall.dll
    2008-08-02 16:08 . 2008-07-09 09:05 75,248 --a------ C:\WINDOWS\zllsputility.exe
    2008-08-02 16:07 . 2008-08-02 16:07 <DIR> d-------- C:\Program Files\Zone Labs
    2008-08-02 16:07 . 2008-08-05 12:17 355,090 --ah----- C:\WINDOWS\system32\vsconfig.xml
    2008-08-02 15:05 . 2008-08-02 15:31 <DIR> d-------- C:\Documents and Settings\Nela\Application Data\Skype
    2008-08-02 13:56 . 2001-08-17 13:48 12,160 --a------ C:\WINDOWS\system32\drivers\mouhid.sys
    2008-08-02 13:56 . 2001-08-17 13:48 12,160 --a--c--- C:\WINDOWS\system32\dllcache\mouhid.sys
    2008-08-02 13:56 . 2001-08-17 14:02 9,600 --a------ C:\WINDOWS\system32\drivers\hidusb.sys
    2008-08-02 13:56 . 2001-08-17 14:02 9,600 --a--c--- C:\WINDOWS\system32\dllcache\hidusb.sys

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-08-02 16:48 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-08-02 13:31 --------- d-----w C:\Program Files\Common Files\Symantec Shared
    2008-08-02 13:31 --------- d-----w C:\Documents and Settings\Nela\Application Data\Yahoo!
    2008-08-02 13:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
    2008-08-02 13:31 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
    2008-08-02 13:29 --------- d-----w C:\Documents and Settings\luka\Application Data\Yahoo!
    2008-08-02 13:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\Yahoo!
    2008-08-02 12:13 --------- d-----w C:\Documents and Settings\Nela\Application Data\skypePM
    2008-06-20 10:45 360,320 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
    2008-06-20 10:44 138,368 ----a-w C:\WINDOWS\system32\drivers\afd.sys
    2008-06-20 09:52 225,920 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
    2008-06-15 22:19 --------- d-----w C:\Documents and Settings\luka\Application Data\Talkback
    2008-06-13 13:10 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
    2008-06-11 14:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-06-11 14:31 --------- d-----w C:\Documents and Settings\Nela\Application Data\MSN6
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 09:56 15360]
    "MsnMsgr "= "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" [2007-10-18 12:34 5724184]
    "swg "= "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-09-26 17:36 68856]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "igfxtray "= "C:\WINDOWS\System32\igfxtray.exe" [2005-09-20 04:35 94208]
    "igfxhkcmd "= "C:\WINDOWS\System32\hkcmd.exe" [2005-09-20 04:32 77824]
    "igfxpers "= "C:\WINDOWS\System32\igfxpers.exe" [2005-09-20 04:36 114688]
    "NeroFilterCheck "= "C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2006-01-12 16:40 155648]
    "ZoneAlarm Client "= "C:\Program Files\Zone Labs\ZoneAlarm\zlclient.exe" [2008-07-09 09:05 919016]
    "Cmaudio "= "cmicnfg.cpl" [BU]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "ALUAlert "= "C:\Program Files\Symantec\LiveUpdate\ALUNotify.exe" [BU]

    C:\Documents and Settings\Nela\Start Menu\Programs\Startup\
    H3 The Shadow of Death(TM).lnk - C:\Program Files\3DO\Heroes3\RegisterSOD\Remind32.exe [2007-07-06 17:07:31 67584]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\efcYQJab]
    [BU]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "VIDC.YV12 "= yv12vfw.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\ZoneLabsFirewall]
    "DisableMonitoring "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall "= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "C:\\WINDOWS\\system32\\ZoneLabs\\avsys\\ScanningProcess.exe "=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe "=
    "C:\\WINDOWS\\system32\\ZoneLabs\\vsmon.exe "=

    S3 usnjsvc;Usluga Messenger Sharing Folders USN Journal Reader;C:\Program Files\Windows Live\Messenger\usnsvc.exe [2007-10-18 12:31]
    .
    Contents of the 'Scheduled Tasks' folder

    2008-07-18 C:\WINDOWS\Tasks\1-Click Maintenance.job
    - C:\Program Files\TuneUp Utilities 2007\SystemOptimizer.exe []

    2008-08-05 C:\WINDOWS\Tasks\Check Updates for Windows Live Toolbar.job
    - C:\Program Files\Windows Live Toolbar\MSNTBUP.EXE [2007-10-19 12:20]
    .
    - - - - ORPHANS REMOVED - - - -

    BHO-{33EEA2FD-92A5-4B9E-9A36-D4E16C0AD849} - (no file)


    .
    ------- Supplementary Scan -------
    .
    FireFox -: Profile - C:\Documents and Settings\Nela\Application Data\Mozilla\Firefox\Profiles\0196v4jj.default\
    FireFox -: prefs.js - SEARCH.DEFAULTURL - hxxp://search.yahoo.com/search?fr=ffsp1&p=
    FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://www.google.com/
    FF -: plugin - C:\Program Files\Java\jre1.6.0_03\bin\npjava11.dll
    FF -: plugin - C:\Program Files\Java\jre1.6.0_03\bin\npjava12.dll
    FF -: plugin - C:\Program Files\Java\jre1.6.0_03\bin\npjava13.dll
    FF -: plugin - C:\Program Files\Java\jre1.6.0_03\bin\npjava14.dll
    FF -: plugin - C:\Program Files\Java\jre1.6.0_03\bin\npjava32.dll
    FF -: plugin - C:\Program Files\Java\jre1.6.0_03\bin\npjpi160_03.dll
    FF -: plugin - C:\Program Files\Java\jre1.6.0_03\bin\npoji610.dll
    FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPMorpBr.dll
    FF -: plugin - C:\Program Files\Mozilla Firefox\plugins\NPZoneSB.dll
    FF -: plugin - C:\Program Files\Real\RhapsodyPlayerEngine\nprhapengine.dll


    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-08-05 12:26:41
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    ------------------------ Other Running Processes ------------------------
    .
    C:\WINDOWS\system32\wdfmgr.exe
    .
    **************************************************************************
    .
    Completion time: 2008-08-05 12:30:49 - machine was rebooted [Nela]
    ComboFix-quarantined-files.txt 2008-08-05 10:30:45
    ComboFix2.txt 2008-08-05 10:12:29
    ComboFix3.txt 2008-08-03 15:08:27

    Pre-Run: 44,616,994,816 bytes free
    Post-Run: 44,569,088,000 bytes free

    152 --- E O F --- 2008-08-03 11:56:55


    Thanks,

    Darko
     
    fakin,
    #20
Page 1 of 2

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...