1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Active Virtumonde Virus

Discussion in 'Malware and Virus Removal Archive' started by RobertUddin, 2009/01/03.

  1. 2009/01/03
    RobertUddin

    RobertUddin Inactive Thread Starter

    Joined:
    2009/01/03
    Messages:
    5
    Likes Received:
    0
    [Active] Virtumonde Virus

    Hi There,

    I have been having a big problem removing the Virtumonde Virus. When I first discovered the virus and try to run Spybot S&D it took 5 hours almost only to recommend I reboot my computer half way through the scan - I have since tried it twice with the same result.

    I have also run AVG which picked up Trojan Horse Clicker.VSE and Trojan Horse Generic.AHRD. This is after my initial clean up of Virtumonde.EXE and other threads belonging to Virtumonde.

    I wouldn't say I was a beginner on the pc but I'm not an expert either. I used Hijack This and compared an old log - I got rid of a couple of lines that I had also read on another forum which tied up with the old log. (which I can't remember the name of).

    Just to add, I ran AVG in safe mode which worked better although I can't get AVG to update at all - i keep getting page error - connection failed.

    This has also happened when I have tried downloading other software to help me (I assume it knows what I'm looking for and where)

    This has also happened when trying to download RSIT from BBS.

    I am also having trouble with saving logs from Hijack this - it seems when I click save loh - Hijack this shuts down and I can't find my log.

    Can someone please help?


    Thank you

    Robert
     
    RobertUddin,
    #1
  2. 2009/01/04
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Welcome to WindowsBBS Robert :)

    You might need to download the following file on another computer and transfer it via usb flash drive or cd. Download ComboFix by sUBs from here, saving the file to your desktop.


    Disable realtime protection applications as they sometimes interfere with the tool. Check this link for your applicable programs.

    • Close all open programs and windows
    • Double click ComboFix.exe and follow the prompts.
    • It may reboot your computer and resume running when you logon. Wait for it to complete. When finished, it will open a log for you. Post that log in your next reply.
    Note: Do not mouseclick combofix's window while its running. That may cause it to stall
     
    noahdfear,
    #2


  3. to hide this advert.

  4. 2009/01/05
    RobertUddin

    RobertUddin Inactive Thread Starter

    Joined:
    2009/01/03
    Messages:
    5
    Likes Received:
    0
    Combo Fix Log

    Thanks for replying to my post.

    The Log is below.


    Should I keep Avg disabled? Also, spybot is asking me to allow a registry change - Kernal Fault Check? I just closed the window down because I wasn't sure what to do. I have also managed to get RSIT.EXE and Vundo Fix - should I run either of these?

    Many Thanks

    Rob

    ComboFix 09-01-05.02 - Rob 2009-01-05 22:12:23.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.531 [GMT 0:00]
    Running from: J:\ComboFix.exe
    AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\program files\TinyProxy
    c:\windows\Downloaded Program Files\setup.inf
    c:\windows\f49f4daa.dat
    c:\windows\fmark2.dat
    c:\windows\system32\alaiioms.dll
    c:\windows\system32\apqjly.dll
    c:\windows\system32\bdymgqrg.ini
    c:\windows\system32\bouxrr.dll
    c:\windows\system32\bwmhidxy.dll
    c:\windows\system32\cegfPqss.ini
    c:\windows\system32\cegfPqss.ini2
    c:\windows\system32\cmdisbll.ini
    c:\windows\system32\ctsiaesa.dll
    c:\windows\system32\dcsdbhmm.ini
    c:\windows\system32\ddCusSmj.dll
    c:\windows\system32\dlamsk.dll
    c:\windows\system32\drivers\seneka.sys
    c:\windows\system32\drivers\senekawcqtetov.sys
    c:\windows\system32\dundjkxw.dll
    c:\windows\system32\duqfuxpq.dll
    c:\windows\system32\erwhlljq.ini
    c:\windows\system32\feOrsBeg.ini
    c:\windows\system32\fhlhxfnm.dll
    c:\windows\system32\fkyyqxdk.dll
    c:\windows\system32\frjeymnc.dll
    c:\windows\system32\geBsrOef.dll
    c:\windows\system32\gemjhnat.dll
    c:\windows\system32\gjrdxtit.ini
    c:\windows\system32\grqgmydb.dll
    c:\windows\system32\hihgncts.dll
    c:\windows\system32\hkkdei.dll
    c:\windows\system32\hnojqkgk.dll
    c:\windows\system32\huwwtmvt.dll
    c:\windows\system32\jlutqz.dll
    c:\windows\system32\jmSsuCdd.ini
    c:\windows\system32\jtvqvfpt.dll
    c:\windows\system32\kklbxnap.dll
    c:\windows\system32\lhnivcdr.ini
    c:\windows\system32\lldvhhcw.ini
    c:\windows\system32\lyoeilqw.ini
    c:\windows\system32\ofvawlrr.dll
    c:\windows\system32\oruFeMoq.ini
    c:\windows\system32\oruFeMoq.ini2
    c:\windows\system32\panxblkk.ini
    c:\windows\system32\prrdcrnb.dll
    c:\windows\system32\qjllhwre.dll
    c:\windows\system32\qoMeFuro.dll
    c:\windows\system32\qwklpppe.dll
    c:\windows\system32\qxtlggbg.dll
    c:\windows\system32\rdcvinhl.dll
    c:\windows\system32\rqRIawWN.dll
    c:\windows\system32\rqRLbbCu.dll
    c:\windows\system32\seneka.dat
    c:\windows\system32\senekacobrlnta.dll
    c:\windows\system32\senekadf.dat
    c:\windows\system32\senekaepydijaw.dll
    c:\windows\system32\senekalog.dat
    c:\windows\system32\senekauvjsarje.dll
    c:\windows\system32\ssqPfgec.dll
    c:\windows\system32\stynbz.dll
    c:\windows\system32\tvfzpr.dll
    c:\windows\system32\twain_32
    c:\windows\system32\urqQJyyx.dll
    c:\windows\system32\uwwDKRqr.ini
    c:\windows\system32\uwwDKRqr.ini2
    c:\windows\system32\wchhvdll.dll
    c:\windows\system32\wqlieoyl.dll
    c:\windows\system32\xkfvmjjq.dll
    c:\windows\system32\xyyJQqru.ini
    c:\windows\system32\xyyJQqru.ini2
    c:\windows\system32\yoyrxqpi.dll
    c:\windows\system32\zvvayz.dll

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Service_seneka


    ((((((((((((((((((((((((( Files Created from 2008-12-05 to 2009-01-05 )))))))))))))))))))))))))))))))
    .

    2009-01-03 03:08 . 2009-01-03 10:28 <DIR> d-------- c:\documents and settings\All Users\Application Data\SITEguard
    2009-01-03 03:07 . 2009-01-03 03:07 <DIR> d-------- c:\program files\Common Files\iS3
    2009-01-03 03:07 . 2009-01-03 10:33 <DIR> d-------- c:\documents and settings\All Users\Application Data\STOPzilla!
    2009-01-02 23:35 . 2009-01-02 23:35 <DIR> d-------- c:\program files\Security Task Manager
    2009-01-02 23:35 . 2009-01-02 23:39 <DIR> d-------- c:\documents and settings\All Users\Application Data\SecTaskMan
    2009-01-01 14:15 . 2009-01-01 14:15 72,192 --a------ c:\windows\system32\iiFyAspp.dll
    2009-01-01 12:34 . 2009-01-01 12:35 10,240 --a------ c:\windows\ijuzevuqana.dll
    2009-01-01 04:39 . 2009-01-01 04:39 40,448 --a------ c:\windows\system32\k9261108.exe
    2009-01-01 04:39 . 2009-01-01 04:39 40,448 --a------ c:\windows\Mfovejiqaluhe.dll
    2008-12-30 18:15 . 2008-12-30 18:15 <DIR> d-------- c:\program files\Common Files\Logitech
    2008-12-25 17:57 . 2007-04-04 14:56 13,712 -ra------ c:\windows\system32\drivers\UsbKbd.sys
    2008-12-25 17:42 . 2008-12-25 18:05 <DIR> d-------- C:\Songeasy load
    2008-12-23 00:58 . 2008-02-06 02:20 628,760 -ra------ c:\windows\system32\drivers\lvrs.sys
    2008-12-23 00:58 . 2008-02-06 01:40 25,056 -ra------ c:\windows\system32\Repository.reg
    2008-12-23 00:58 . 2008-02-06 02:17 13,848 -ra------ c:\windows\system32\drivers\lv302af.sys
    2008-12-23 00:55 . 2008-02-06 02:17 2,570,520 -ra------ c:\windows\system32\drivers\LV302V32.SYS
    2008-12-23 00:55 . 2008-02-06 02:21 490,008 -ra------ c:\windows\system32\LVUI2.dll
    2008-12-23 00:55 . 2008-02-06 02:21 465,432 -ra------ c:\windows\system32\LVUI2RC.dll
    2008-12-23 00:55 . 2008-02-06 02:18 416,280 -ra------ c:\windows\system32\lvcodec2.dll
    2008-12-23 00:55 . 2008-02-06 02:18 195,096 -ra------ c:\windows\system32\lvci11701196.dll
    2008-12-23 00:55 . 2008-02-06 01:37 66,482 -ra------ c:\windows\system32\lvcoinst.ini
    2008-12-23 00:55 . 2008-02-06 02:21 41,752 -ra------ c:\windows\system32\drivers\LVUSBSta.sys
    2008-12-23 00:51 . 2008-12-23 00:51 <DIR> d-------- c:\documents and settings\Rob\Application Data\Leadertech
    2008-12-23 00:49 . 2008-12-23 00:49 <DIR> d-------- c:\program files\Logitech
    2008-12-23 00:49 . 2008-12-29 16:37 <DIR> d-------- c:\program files\Common Files\LogiShrd
    2008-12-23 00:49 . 2008-12-23 00:49 <DIR> d-------- c:\documents and settings\All Users\Application Data\Logitech
    2008-12-23 00:49 . 2008-12-30 12:54 <DIR> d-------- c:\documents and settings\All Users\Application Data\Logishrd
    2008-12-12 17:31 . 2008-12-12 17:31 230,424 --a------ C:\snp2sxp-002.raw
    2008-12-11 03:10 . 2009-01-05 21:57 <DIR> d--h----- C:\$AVG8.VAULT$
    2008-12-11 01:38 . 2009-01-05 17:39 <DIR> d-------- c:\windows\system32\drivers\Avg
    2008-12-11 01:38 . 2008-12-11 01:38 <DIR> d-------- c:\program files\AVG
    2008-12-11 01:38 . 2008-12-11 11:27 <DIR> d-------- c:\documents and settings\Rob\Application Data\AVGTOOLBAR
    2008-12-11 01:38 . 2009-01-02 23:54 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8
    2008-12-11 01:38 . 2009-01-02 23:54 <DIR> d-------- c:\documents and settings\All Users\Application Data\AVG7
    2008-12-11 01:38 . 2008-12-11 01:38 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys
    2008-12-11 01:38 . 2008-12-11 01:38 76,040 --a------ c:\windows\system32\drivers\avgtdix.sys
    2008-12-11 01:38 . 2008-12-11 01:38 10,520 --a------ c:\windows\system32\avgrsstx.dll
    2008-12-11 00:38 . 2008-12-14 00:32 <DIR> d-------- c:\program files\Mozilla Thunderbird
    2008-12-11 00:38 . 2008-12-11 00:38 <DIR> d-------- c:\documents and settings\Rob\Application Data\Thunderbird
    2008-12-10 16:22 . 2008-12-10 16:22 <DIR> d-------- c:\documents and settings\Rob\Application Data\MSNInstaller
    2008-12-10 13:22 . 2008-12-10 13:22 <DIR> d-------- c:\program files\GoalTigerVisionBoard
    2008-12-10 13:21 . 2008-12-10 13:21 <DIR> d-------- c:\program files\Sony Ericsson
    2008-12-10 13:14 . 2008-12-16 15:01 <DIR> d-------- c:\windows\system32\CatRoot_bak
    2008-12-10 13:12 . 2008-12-10 13:12 <DIR> d-------- c:\program files\MarkAny
    2008-12-08 21:06 . 2008-12-08 21:06 <DIR> d-------- c:\windows\system32\scripting
    2008-12-08 21:06 . 2008-12-08 21:06 <DIR> d-------- c:\windows\l2schemas
    2008-12-08 20:59 . 2008-12-08 21:07 <DIR> d-------- c:\windows\ServicePackFiles
    2008-12-08 13:01 . 2008-12-17 22:44 <DIR> d-------- c:\program files\Noughties
    2008-12-05 19:11 . 2008-12-05 19:11 <DIR> d-------- c:\temp\Ogif
    2008-12-05 19:11 . 2008-12-05 19:11 <DIR> d-------- C:\Temp

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-01-03 02:37 --------- d-----w c:\program files\Spybot - Search & Destroy
    2009-01-02 19:28 --------- d-----w c:\program files\Java
    2009-01-02 19:20 --------- d-----w c:\program files\LimeWire
    2008-12-31 11:10 --------- d-----w c:\program files\eMule
    2008-12-08 20:09 --------- d--h--w c:\program files\InstallShield Installation Information
    2008-11-28 17:49 --------- d-----w c:\program files\Common Files\ArcSoft
    2008-11-28 17:48 --------- d-----w c:\program files\ArcSoft
    2008-11-28 17:42 --------- d-----w c:\program files\Common Files\snp2std
    .

    ------- Sigcheck -------

    2004-08-04 12:00 14336 8f078ae4ed187aaabc0a305146de6716 c:\windows\$NtServicePackUninstall$\svchost.exe
    2004-08-04 12:00 14336 8f078ae4ed187aaabc0a305146de6716 c:\windows\system32\svchost.exe
    2004-08-04 12:00 14336 8f078ae4ed187aaabc0a305146de6716 c:\windows\system32\dllcache\svchost.exe

    2004-08-04 12:00 82944 2ed0b7f12a60f90092081c50fa0ec2b2 c:\windows\$NtServicePackUninstall$\ws2_32.dll
    2004-08-04 12:00 82944 2ed0b7f12a60f90092081c50fa0ec2b2 c:\windows\system32\ws2_32.dll
    2004-08-04 12:00 82944 2ed0b7f12a60f90092081c50fa0ec2b2 c:\windows\system32\dllcache\ws2_32.dll

    2007-03-07 17:40 823296 b8f4db39ca7353752f245379d285c80e c:\windows\$hf_mig$\KB931768-IE7\SP2QFE\wininet.dll
    2007-04-25 09:08 823808 431defbb4a3d7b0dc062c1b064623a2f c:\windows\$hf_mig$\KB933566-IE7\SP2QFE\wininet.dll
    2007-06-27 14:40 824320 d6ed5e042c5207553e7f5e842918137f c:\windows\$hf_mig$\KB937143-IE7\SP2QFE\wininet.dll
    2007-08-20 10:02 825344 357d54bf94fe9d6d8505a96b5c2a3bca c:\windows\$hf_mig$\KB939653-IE7\SP2QFE\wininet.dll
    2007-10-10 23:47 825344 0e5d918f87efa7d2424d66b499c7eb04 c:\windows\$hf_mig$\KB942615-IE7\SP2QFE\wininet.dll
    2007-12-07 02:01 825344 b5b411bb229ae6ead7652a32ed47bfb9 c:\windows\$hf_mig$\KB944533-IE7\SP2QFE\wininet.dll
    2008-03-01 13:03 827392 6316c2f0c61271c8abdff7429174879e c:\windows\$hf_mig$\KB947864-IE7\SP2QFE\wininet.dll
    2008-04-23 03:35 827392 41546b396a526918da7995a02ea04e51 c:\windows\$hf_mig$\KB950759-IE7\SP2QFE\wininet.dll
    2008-06-23 16:01 827904 c66402a06b83b036c195242c0c8cf83c c:\windows\$hf_mig$\KB953838-IE7\SP2QFE\wininet.dll
    2008-08-26 09:08 827904 77c192fe56a70d7fa0247ba0a6201c32 c:\windows\$hf_mig$\KB956390-IE7\SP2QFE\wininet.dll
    2008-10-16 20:24 827904 0d5b75171ff51775b630a431b6c667e8 c:\windows\$hf_mig$\KB958215-IE7\SP2QFE\wininet.dll
    2004-08-04 12:00 656384 c0823fc5469663ba63e7db88f9919d70 c:\windows\ie7\wininet.dll
    2006-11-07 20:03 818688 92995334f993e6e49c25c6d02ec04401 c:\windows\ie7updates\KB931768-IE7\wininet.dll
    2007-03-07 17:45 822784 5b35dae6e4886f64d1da58c4e3e01eb9 c:\windows\ie7updates\KB933566-IE7\wininet.dll
    2007-04-25 08:41 822784 0586a7f0b2fdb94d624f399d4728e7c8 c:\windows\ie7updates\KB937143-IE7\wininet.dll
    2007-06-27 14:34 823808 8068cbb58fe60cc95aeb2cff70178208 c:\windows\ie7updates\KB939653-IE7\wininet.dll
    2007-08-20 10:04 824832 774435e499d8e9643ec961a6103c361f c:\windows\ie7updates\KB942615-IE7\wininet.dll
    2007-10-10 23:56 824832 30c1e0f34ad2972c72a01db5c74ab065 c:\windows\ie7updates\KB944533-IE7\wininet.dll
    2007-12-07 02:21 824832 806d274c9a6c3aaea5eae8e4af841e04 c:\windows\ie7updates\KB947864-IE7\wininet.dll
    2008-03-01 13:06 826368 ad21461aef8244edec2ef18e55e1dcf3 c:\windows\ie7updates\KB950759-IE7\wininet.dll
    2008-04-23 04:16 826368 f6589be784647cfdbc22ea51ccb1a57a c:\windows\ie7updates\KB953838-IE7\wininet.dll
    2008-06-23 16:57 826368 8c13d4a7479fa0a026eda8abce82c0ed c:\windows\ie7updates\KB956390-IE7\wininet.dll
    2008-08-26 07:24 826368 ef8eba98145bfa44e80d17a3b3453300 c:\windows\ie7updates\KB958215-IE7\wininet.dll
    2008-10-16 20:38 826368 6741eaf7b7f110e803a6e38f6e5fa6b0 c:\windows\system32\wininet.dll
    2008-10-16 20:38 826368 6741eaf7b7f110e803a6e38f6e5fa6b0 c:\windows\system32\dllcache\wininet.dll

    2006-04-20 12:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 c:\windows\$hf_mig$\KB917953\SP2QFE\tcpip.sys
    2007-10-30 16:53 360832 64798ecfa43d78c7178375fcdd16d8c8 c:\windows\$hf_mig$\KB941644\SP2QFE\tcpip.sys
    2008-06-20 10:44 360960 744e57c99232201ae98c49168b918f48 c:\windows\$hf_mig$\KB951748\SP2QFE\tcpip.sys
    2008-06-20 11:51 361600 9aefa14bd6b182d61e3119fa5f436d3d c:\windows\$hf_mig$\KB951748\SP3GDR\tcpip.sys
    2008-06-20 11:59 361600 ad978a1b783b5719720cff204b666c8e c:\windows\$hf_mig$\KB951748\SP3QFE\tcpip.sys
    2008-06-20 10:45 360320 2a5554fc5b1e04e131230e3ce035c3f9 c:\windows\$NtServicePackUninstall$\tcpip.sys
    2004-08-04 12:00 359040 9f4b36614a0fc234525ba224957de55c c:\windows\$NtUninstallKB917953$\tcpip.sys
    2006-04-20 11:51 359808 1dbf125862891817f374f407626967f4 c:\windows\$NtUninstallKB941644$\tcpip.sys
    2007-10-30 17:20 360064 90caff4b094573449a0872a0f919b178 c:\windows\$NtUninstallKB951748$\tcpip.sys
    2008-06-20 10:45 360320 2a5554fc5b1e04e131230e3ce035c3f9 c:\windows\system32\dllcache\tcpip.sys
    2008-06-20 10:45 360320 2a5554fc5b1e04e131230e3ce035c3f9 c:\windows\system32\drivers\tcpip.sys

    2004-08-04 12:00 502272 01c3346c241652f43aed8e2149881bfe c:\windows\$NtServicePackUninstall$\winlogon.exe
    2004-08-04 12:00 502272 01c3346c241652f43aed8e2149881bfe c:\windows\system32\winlogon.exe
    2004-08-04 12:00 502272 01c3346c241652f43aed8e2149881bfe c:\windows\system32\dllcache\winlogon.exe

    2004-08-04 12:00 182912 558635d3af1c7546d26067d5d9b6959e c:\windows\$NtServicePackUninstall$\ndis.sys
    2004-08-04 12:00 182912 558635d3af1c7546d26067d5d9b6959e c:\windows\system32\dllcache\ndis.sys
    2004-08-04 12:00 182912 558635d3af1c7546d26067d5d9b6959e c:\windows\system32\drivers\ndis.sys

    2004-08-04 12:00 29056 4448006b6bc60e6c027932cfc38d6855 c:\windows\$NtServicePackUninstall$\ip6fw.sys
    2004-08-04 12:00 29056 4448006b6bc60e6c027932cfc38d6855 c:\windows\system32\dllcache\ip6fw.sys
    2004-08-04 12:00 29056 4448006b6bc60e6c027932cfc38d6855 c:\windows\system32\drivers\ip6fw.sys

    2005-03-02 00:36 2056832 d8aba3eab509627e707a3b14f00fbb6b c:\windows\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
    2007-02-28 09:15 2059392 4d3dbdccbf97f5ba1e74f322b155c3ba c:\windows\$hf_mig$\KB931784\SP2QFE\ntkrnlpa.exe
    2008-08-14 09:18 2062976 63ec865dff6ccfc7bef94b5c50297cad c:\windows\$hf_mig$\KB956841\SP2QFE\ntkrnlpa.exe
    2008-08-14 09:33 2066048 4ac58f03eb94a72809949d757fc39d80 c:\windows\$hf_mig$\KB956841\SP3GDR\ntkrnlpa.exe
    2008-08-14 14:39 2066048 a25e9b86effb2af33bf51e676b68bfb0 c:\windows\$hf_mig$\KB956841\SP3QFE\ntkrnlpa.exe
    2008-08-14 09:22 2057728 ba002228743b6824d87f0551dbc86d45 c:\windows\$NtServicePackUninstall$\ntkrnlpa.exe
    2004-08-04 12:00 2056832 947fb1d86d14afcffdb54bf837ec25d0 c:\windows\$NtUninstallKB890859$\ntkrnlpa.exe
    2005-03-02 00:34 2056832 81013f36b21c7f72cf784cc6731e0002 c:\windows\$NtUninstallKB931784$\ntkrnlpa.exe
    2007-02-28 08:38 2057600 515d30e2c90a3665a2739309334c9283 c:\windows\$NtUninstallKB956841$\ntkrnlpa.exe
    2008-08-14 09:22 2057728 ba002228743b6824d87f0551dbc86d45 c:\windows\Driver Cache\i386\ntkrnlpa.exe
    2008-08-14 09:22 2057728 ba002228743b6824d87f0551dbc86d45 c:\windows\system32\ntkrnlpa.exe
    2008-08-14 09:22 2057728 ba002228743b6824d87f0551dbc86d45 c:\windows\system32\dllcache\ntkrnlpa.exe

    2005-03-02 01:04 2179456 28187802b7c368c0d3aef7d4c382aabb c:\windows\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
    2007-02-28 09:55 2182144 5a5c8db4aa962c714c8371fbdf189fc9 c:\windows\$hf_mig$\KB931784\SP2QFE\ntoskrnl.exe
    2008-08-14 09:57 2185984 ce69dbd54221f2d40e49ff6db77c6507 c:\windows\$hf_mig$\KB956841\SP2QFE\ntoskrnl.exe
    2008-08-14 10:11 2189184 eeaf32f8e15a24f62becb1bd403bb5c5 c:\windows\$hf_mig$\KB956841\SP3GDR\ntoskrnl.exe
    2008-08-14 15:11 2189184 31914172342bff330063f343ac6958fe c:\windows\$hf_mig$\KB956841\SP3QFE\ntoskrnl.exe
    2008-08-14 10:00 2180352 21c91da9cb53aa8a37041ba9684a8458 c:\windows\$NtServicePackUninstall$\ntoskrnl.exe
    2004-08-04 12:00 2180992 ce218bc7088681faa06633e218596ca7 c:\windows\$NtUninstallKB890859$\ntoskrnl.exe
    2005-03-02 00:59 2179328 4d4cf2c14550a4b7718e94a6e581856e c:\windows\$NtUninstallKB931784$\ntoskrnl.exe
    2007-02-28 09:10 2180352 582a8dbaa58c3b1f176eb2817daee77c c:\windows\$NtUninstallKB956841$\ntoskrnl.exe
    2008-08-14 10:00 2180352 21c91da9cb53aa8a37041ba9684a8458 c:\windows\Driver Cache\i386\ntoskrnl.exe
    2008-08-14 10:00 2180352 21c91da9cb53aa8a37041ba9684a8458 c:\windows\system32\ntoskrnl.exe
    2008-08-14 10:00 2180352 21c91da9cb53aa8a37041ba9684a8458 c:\windows\system32\dllcache\ntoskrnl.exe

    2004-08-04 12:00 108032 c6ce6eec82f187615d1002bb3bb50ed4 c:\windows\$NtServicePackUninstall$\services.exe
    2004-08-04 12:00 108032 c6ce6eec82f187615d1002bb3bb50ed4 c:\windows\system32\services.exe
    2004-08-04 12:00 108032 c6ce6eec82f187615d1002bb3bb50ed4 c:\windows\system32\dllcache\services.exe

    2004-08-04 12:00 13312 84885f9b82f4d55c6146ebf6065d75d2 c:\windows\$NtServicePackUninstall$\lsass.exe
    2004-08-04 12:00 13312 84885f9b82f4d55c6146ebf6065d75d2 c:\windows\system32\lsass.exe
    2004-08-04 12:00 13312 84885f9b82f4d55c6146ebf6065d75d2 c:\windows\system32\dllcache\lsass.exe

    2004-08-04 12:00 15360 24232996a38c0b0cf151c2140ae29fc8 c:\windows\$NtServicePackUninstall$\ctfmon.exe
    2004-08-04 12:00 15360 24232996a38c0b0cf151c2140ae29fc8 c:\windows\system32\ctfmon.exe
    2004-08-04 12:00 15360 24232996a38c0b0cf151c2140ae29fc8 c:\windows\system32\dllcache\ctfmon.exe

    2004-08-04 12:00 24576 39b1ffb03c2296323832acbae50d2aff c:\windows\$NtServicePackUninstall$\userinit.exe
    2004-08-04 12:00 24576 39b1ffb03c2296323832acbae50d2aff c:\windows\system32\userinit.exe
    2004-08-04 12:00 24576 39b1ffb03c2296323832acbae50d2aff c:\windows\system32\dllcache\userinit.exe

    2004-08-04 12:00 295424 b60c877d16d9c880b952fda04adf16e6 c:\windows\$NtServicePackUninstall$\termsrv.dll
    2004-08-04 12:00 295424 b60c877d16d9c880b952fda04adf16e6 c:\windows\system32\termsrv.dll
    2004-08-04 12:00 295424 b60c877d16d9c880b952fda04adf16e6 c:\windows\system32\dllcache\termsrv.dll
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "msnmsgr "= "c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
    "ctfmon.exe "= "c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
    "SpybotSD TeaTimer "= "c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
    "FlashPlayerUpdate "= "c:\windows\system32\Macromed\Flash\NPSWF32_FlashUtil.exe" [2008-10-05 235936]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "KernelFaultCheck "= "c:\windows\system32\dumprep 0 -k" [X]
    "PCguardadvisor.exe "= "c:\program files\blueyonder\PCguard advisor\PCguardadvisor.exe" [2006-04-28 1888256]
    "NeroFilterCheck "= "c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
    "SMSTray "= "c:\program files\Samsung\Samsung Media Studio 5\SMSTray.exe" [2007-09-20 132624]
    "Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
    "QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2008-01-31 385024]
    "TkBellExe "= "c:\program files\Common Files\Real\Update_OB\realsched.exe" [2007-11-24 185896]
    "iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2008-02-19 267048]
    "AVG8_TRAY "= "c:\progra~1\AVG\AVG8\avgtray.exe" [2008-12-11 1261336]
    "LogitechCommunicationsManager "= "c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2008-02-13 564496]
    "LogitechQuickCamRibbon "= "c:\program files\Logitech\QuickCam\Quickcam.exe" [2008-02-13 2196240]
    "SoundMan "= "SOUNDMAN.EXE" [2006-06-21 c:\windows\soundman.exe]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-28 241664]
    HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-05-28 53248]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{88485281-8b4b-4f8d-9ede-82e29a064277} "= "c:\progra~1\MarkAny\CONTEN~1\MACSMA~1.DLL" [2004-11-23 192512]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs "=bouxrr.dll

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "c:\\Program Files\\iTunes\\iTunes.exe "=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
    "c:\\Program Files\\eMule\\emule.exe "=
    "c:\\Program Files\\LimeWire\\LimeWire.exe "=
    "c:\\Program Files\\AVG\\AVG8\\avgemc.exe "=
    "c:\\Program Files\\AVG\\AVG8\\avgupd.exe "=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "3128:TCP "= 3128:TCP:avg

    R0 tffsport;M-Systems DiskOnChip 2000;c:\windows\system32\drivers\tffsport.sys [2008-01-28 149376]
    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-12-11 97928]
    R4 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-12-11 875288]
    R4 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-12-11 231704]
    R4 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-12-11 76040]
    S3 UsbKbd;Multak Book USB Driver;c:\windows\system32\drivers\UsbKbd.sys [2008-12-25 13712]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2abeb636-95c1-11dc-9432-000d61347b54}]
    \Shell\AutoRun\command - E:\LaunchU3.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bc402421-437f-11dc-93fe-000d61347b54}]
    \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL system.exe
    \Shell\Explore\command - E:\system.exe
    \Shell\Open\command - E:\system.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f1ca073b-5896-11dd-9478-000d61347b54}]
    \Shell\AutoRun\command - E:\InstallTomTomHOME.exe
    .
    Contents of the 'Scheduled Tasks' folder

    2009-01-04 c:\windows\Tasks\AdwareAlert Scheduled Scan.job
    - c:\program files\AdwareAlert\AdwareAlert.exe []

    2009-01-04 c:\windows\Tasks\AdwareAlert Scheduled Scan.job
    - c:\program files\AdwareAlert []

    2008-12-30 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]

    2009-01-03 c:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job
    - c:\program files\Spybot - Search & Destroy\SpybotSD.exe [2007-08-31 15:46]

    2009-01-05 c:\windows\Tasks\ywdowcfz.job
    - c:\windows\system32\rundll32.exe [2004-08-04 12:00]
    .
    - - - - ORPHANS REMOVED - - - -

    BHO-{68B4D8D9-7100-492D-8707-93FCC42E1DB6} - (no file)
    BHO-{6a68db6d-4e68-4606-9145-40773e9d467b} - c:\windows\system32\bouxrr.dll
    BHO-{6D794CB4-C7CD-4c6f-BFDC-9B77AFBDC02C} - (no file)
    BHO-{709656F2-CA31-43BF-ABBE-06EC3D47BFC9} - (no file)
    BHO-{7A2F3A2E-4B59-4932-B2C3-2E7F13B03207} - (no file)
    BHO-{88A2058D-2E47-4E12-8951-6A66D20435AC} - c:\windows\system32\rqRKDwwu.dll
    BHO-{AA715187-E4F8-4103-95DA-04A4EBD87F95} - (no file)
    BHO-{CA186527-41D4-4573-9DC3-D571E50586C0} - (no file)
    HKCU-Run-BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Common Files\Ahead\Lib\NMBgMonitor.exe
    HKLM-Run-Workflow - D:\Workflow.exe
    HKLM-Run-c82f9f57 - c:\windows\system32\llbsidmc.dll
    HKU-Default-Run-msiexec.exe - msiconf.exe
    Notify-efcYrQJa - efcYrQJa.dll


    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.yahoo.co.uk/
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

    O16 -: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
    c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
    FF - ProfilePath - c:\documents and settings\Rob\Application Data\Mozilla\Firefox\Profiles\23nxpgix.default\
    FF - prefs.js: browser.startup.homepage - www.yahoo.co.uk
    FF - component: c:\documents and settings\Rob\Application Data\Mozilla\Firefox\Profiles\23nxpgix.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}\platform\WINNT\components\FoxyTunes.dll
    FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
    FF - component: c:\program files\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-01-05 22:23:15
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(536)
    c:\windows\system32\Ati2evxx.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\windows\system32\ati2evxx.exe
    c:\windows\system32\ati2evxx.exe
    c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    c:\program files\Common Files\LightScribe\LSSrvc.exe
    c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
    c:\program files\Common Files\LogiShrd\LVMVFM\LVPrcSrv.exe
    c:\program files\Common Files\Motive\McciCMService.exe
    c:\program files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    c:\windows\system32\wdfmgr.exe
    c:\program files\AVG\AVG8\avgrsx.exe
    c:\program files\Common Files\LogiShrd\LVCOMSER\LVComSer.exe
    c:\windows\system32\wscntfy.exe
    c:\program files\AVG\AVG8\avgtray.exe
    c:\program files\iPod\bin\iPodService.exe
    c:\program files\Common Files\LogiShrd\LQCVFX\COCIManager.exe
    c:\program files\HP\Digital Imaging\bin\hpqgalry.exe
    .
    **************************************************************************
    .
    Completion time: 2009-01-05 22:31:10 - machine was rebooted [Rob]
    ComboFix-quarantined-files.txt 2009-01-05 22:31:08

    Pre-Run: 60,349,063,168 bytes free
    Post-Run: 66,135,740,416 bytes free

    374 --- E O F --- 2008-12-16 10:01:04
     
    RobertUddin,
    #3
  5. 2009/01/05
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    KernalFaultCheck means an application crashed and the system tried to write an entry to the registry. Don't worry about it at this time. ;)

    AVG can be re-enabled after running ComboFix. We only ask it be disabled during the scan to avoid interference.

    I don't expect it to happen, but should Spybot prompt you about any changes while ComboFix is scanning, please allow them.

    Please do not run any other tools. Unexpected changes can throw up errant red flags for the analyst.

    I would like to see if ComboFix will remove any more on it's own with a second pass. Please close all programs and windows, disable realtime protections, then run ComboFix again. Allow it to update if prompted.
    Post the new ComboFix log here.
     
    noahdfear,
    #4
  6. 2009/01/05
    RobertUddin

    RobertUddin Inactive Thread Starter

    Joined:
    2009/01/03
    Messages:
    5
    Likes Received:
    0
    Hi There,

    Once again, a BIG thank you for your help.:D

    Here is the second log...

    ComboFix 09-01-05.03 - Rob 2009-01-06 1:32:12.2 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1023.548 [GMT 0:00]
    Running from: J:\ComboFix.exe
    AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
    * Created a new restore point
    .

    ((((((((((((((((((((((((( Files Created from 2008-12-06 to 2009-01-06 )))))))))))))))))))))))))))))))
    .

    2009-01-05 23:01 . 2009-01-05 23:01 <DIR> d-------- C:\VundoFix Backups
    2009-01-05 22:59 . 2009-01-05 22:59 <DIR> d-------- C:\rsit
    2009-01-05 22:59 . 2009-01-05 22:59 <DIR> d-------- c:\program files\trend micro
    2009-01-03 03:08 . 2009-01-03 10:28 <DIR> d-------- c:\documents and settings\All Users\Application Data\SITEguard
    2009-01-03 03:07 . 2009-01-03 03:07 <DIR> d-------- c:\program files\Common Files\iS3
    2009-01-03 03:07 . 2009-01-03 10:33 <DIR> d-------- c:\documents and settings\All Users\Application Data\STOPzilla!
    2009-01-02 23:35 . 2009-01-02 23:35 <DIR> d-------- c:\program files\Security Task Manager
    2009-01-02 23:35 . 2009-01-02 23:39 <DIR> d-------- c:\documents and settings\All Users\Application Data\SecTaskMan
    2009-01-01 12:34 . 2009-01-01 12:35 10,240 --a------ c:\windows\ijuzevuqana.dll
    2008-12-30 18:15 . 2008-12-30 18:15 <DIR> d-------- c:\program files\Common Files\Logitech
    2008-12-25 17:57 . 2007-04-04 14:56 13,712 -ra------ c:\windows\system32\drivers\UsbKbd.sys
    2008-12-25 17:42 . 2008-12-25 18:05 <DIR> d-------- C:\Songeasy load
    2008-12-23 00:58 . 2008-02-06 02:20 628,760 -ra------ c:\windows\system32\drivers\lvrs.sys
    2008-12-23 00:58 . 2008-02-06 01:40 25,056 -ra------ c:\windows\system32\Repository.reg
    2008-12-23 00:58 . 2008-02-06 02:17 13,848 -ra------ c:\windows\system32\drivers\lv302af.sys
    2008-12-23 00:55 . 2008-02-06 02:17 2,570,520 -ra------ c:\windows\system32\drivers\LV302V32.SYS
    2008-12-23 00:55 . 2008-02-06 02:21 490,008 -ra------ c:\windows\system32\LVUI2.dll
    2008-12-23 00:55 . 2008-02-06 02:21 465,432 -ra------ c:\windows\system32\LVUI2RC.dll
    2008-12-23 00:55 . 2008-02-06 02:18 416,280 -ra------ c:\windows\system32\lvcodec2.dll
    2008-12-23 00:55 . 2008-02-06 02:18 195,096 -ra------ c:\windows\system32\lvci11701196.dll
    2008-12-23 00:55 . 2008-02-06 01:37 66,482 -ra------ c:\windows\system32\lvcoinst.ini
    2008-12-23 00:55 . 2008-02-06 02:21 41,752 -ra------ c:\windows\system32\drivers\LVUSBSta.sys
    2008-12-23 00:51 . 2008-12-23 00:51 <DIR> d-------- c:\documents and settings\Rob\Application Data\Leadertech
    2008-12-23 00:49 . 2008-12-23 00:49 <DIR> d-------- c:\program files\Logitech
    2008-12-23 00:49 . 2008-12-29 16:37 <DIR> d-------- c:\program files\Common Files\LogiShrd
    2008-12-23 00:49 . 2008-12-23 00:49 <DIR> d-------- c:\documents and settings\All Users\Application Data\Logitech
    2008-12-23 00:49 . 2008-12-30 12:54 <DIR> d-------- c:\documents and settings\All Users\Application Data\Logishrd
    2008-12-12 17:31 . 2008-12-12 17:31 230,424 --a------ C:\snp2sxp-002.raw
    2008-12-11 03:10 . 2009-01-05 23:10 <DIR> d--h----- C:\$AVG8.VAULT$
    2008-12-11 01:38 . 2009-01-05 22:25 <DIR> d-------- c:\windows\system32\drivers\Avg
    2008-12-11 01:38 . 2008-12-11 01:38 <DIR> d-------- c:\program files\AVG
    2008-12-11 01:38 . 2008-12-11 11:27 <DIR> d-------- c:\documents and settings\Rob\Application Data\AVGTOOLBAR
    2008-12-11 01:38 . 2009-01-02 23:54 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8
    2008-12-11 01:38 . 2009-01-02 23:54 <DIR> d-------- c:\documents and settings\All Users\Application Data\AVG7
    2008-12-11 01:38 . 2008-12-11 01:38 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys
    2008-12-11 01:38 . 2008-12-11 01:38 76,040 --a------ c:\windows\system32\drivers\avgtdix.sys
    2008-12-11 01:38 . 2008-12-11 01:38 10,520 --a------ c:\windows\system32\avgrsstx.dll
    2008-12-11 00:38 . 2008-12-14 00:32 <DIR> d-------- c:\program files\Mozilla Thunderbird
    2008-12-11 00:38 . 2008-12-11 00:38 <DIR> d-------- c:\documents and settings\Rob\Application Data\Thunderbird
    2008-12-10 16:22 . 2008-12-10 16:22 <DIR> d-------- c:\documents and settings\Rob\Application Data\MSNInstaller
    2008-12-10 13:22 . 2008-12-10 13:22 <DIR> d-------- c:\program files\GoalTigerVisionBoard
    2008-12-10 13:21 . 2008-12-10 13:21 <DIR> d-------- c:\program files\Sony Ericsson
    2008-12-10 13:14 . 2008-12-16 15:01 <DIR> d-------- c:\windows\system32\CatRoot_bak
    2008-12-10 13:12 . 2008-12-10 13:12 <DIR> d-------- c:\program files\MarkAny
    2008-12-08 21:06 . 2008-12-08 21:06 <DIR> d-------- c:\windows\system32\scripting
    2008-12-08 21:06 . 2008-12-08 21:06 <DIR> d-------- c:\windows\l2schemas
    2008-12-08 20:59 . 2008-12-08 21:07 <DIR> d-------- c:\windows\ServicePackFiles
    2008-12-08 13:01 . 2008-12-17 22:44 <DIR> d-------- c:\program files\Noughties

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-01-03 02:37 --------- d-----w c:\program files\Spybot - Search & Destroy
    2009-01-02 19:28 --------- d-----w c:\program files\Java
    2009-01-02 19:20 --------- d-----w c:\program files\LimeWire
    2008-12-31 11:10 --------- d-----w c:\program files\eMule
    2008-12-08 20:09 --------- d--h--w c:\program files\InstallShield Installation Information
    2008-11-28 17:49 --------- d-----w c:\program files\Common Files\ArcSoft
    2008-11-28 17:48 --------- d-----w c:\program files\ArcSoft
    2008-11-28 17:42 --------- d-----w c:\program files\Common Files\snp2std
    2008-10-23 13:01 283,648 ----a-w c:\windows\system32\gdi32.dll
    2008-10-16 20:38 826,368 ----a-w c:\windows\system32\wininet.dll
    2008-10-16 14:13 202,776 ----a-w c:\windows\system32\wuweb.dll
    2008-10-16 14:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
    2008-10-16 14:12 561,688 ----a-w c:\windows\system32\wuapi.dll
    2008-10-16 14:12 323,608 ----a-w c:\windows\system32\wucltui.dll
    2008-10-16 14:09 92,696 ----a-w c:\windows\system32\cdm.dll
    2008-10-16 14:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
    2008-10-16 14:09 43,544 ----a-w c:\windows\system32\wups2.dll
    2008-10-16 14:08 34,328 ----a-w c:\windows\system32\wups.dll
    2008-10-16 14:06 268,648 ----a-w c:\windows\system32\mucltui.dll
    2008-10-16 14:06 208,744 ----a-w c:\windows\system32\muweb.dll
    2008-10-15 16:57 332,800 ----a-w c:\windows\system32\netapi32(4).dll
    2008-10-15 16:57 332,800 ----a-w c:\windows\system32\netapi32(3).dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "msnmsgr "= "c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
    "ctfmon.exe "= "c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
    "SpybotSD TeaTimer "= "c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "PCguardadvisor.exe "= "c:\program files\blueyonder\PCguard advisor\PCguardadvisor.exe" [2006-04-28 1888256]
    "NeroFilterCheck "= "c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
    "SMSTray "= "c:\program files\Samsung\Samsung Media Studio 5\SMSTray.exe" [2007-09-20 132624]
    "Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
    "QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2008-01-31 385024]
    "TkBellExe "= "c:\program files\Common Files\Real\Update_OB\realsched.exe" [2007-11-24 185896]
    "iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2008-02-19 267048]
    "AVG8_TRAY "= "c:\progra~1\AVG\AVG8\avgtray.exe" [2008-12-11 1261336]
    "LogitechCommunicationsManager "= "c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2008-02-13 564496]
    "LogitechQuickCamRibbon "= "c:\program files\Logitech\QuickCam\Quickcam.exe" [2008-02-13 2196240]
    "SoundMan "= "SOUNDMAN.EXE" [2006-06-21 c:\windows\soundman.exe]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-28 241664]
    HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-05-28 53248]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{88485281-8b4b-4f8d-9ede-82e29a064277} "= "c:\progra~1\MarkAny\CONTEN~1\MACSMA~1.DLL" [2004-11-23 192512]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs "=bouxrr.dll

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "c:\\Program Files\\iTunes\\iTunes.exe "=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
    "c:\\Program Files\\eMule\\emule.exe "=
    "c:\\Program Files\\LimeWire\\LimeWire.exe "=
    "c:\\Program Files\\AVG\\AVG8\\avgemc.exe "=
    "c:\\Program Files\\AVG\\AVG8\\avgupd.exe "=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "3128:TCP "= 3128:TCP:avg

    R0 tffsport;M-Systems DiskOnChip 2000;c:\windows\system32\drivers\tffsport.sys [2008-01-28 149376]
    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-12-11 97928]
    R4 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-12-11 875288]
    R4 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-12-11 231704]
    R4 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-12-11 76040]
    S3 UsbKbd;Multak Book USB Driver;c:\windows\system32\drivers\UsbKbd.sys [2008-12-25 13712]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2abeb636-95c1-11dc-9432-000d61347b54}]
    \Shell\AutoRun\command - E:\LaunchU3.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bc402421-437f-11dc-93fe-000d61347b54}]
    \Shell\AutoRun\command - c:\windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL system.exe
    \Shell\Explore\command - E:\system.exe
    \Shell\Open\command - E:\system.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f1ca073b-5896-11dd-9478-000d61347b54}]
    \Shell\AutoRun\command - E:\InstallTomTomHOME.exe
    .
    Contents of the 'Scheduled Tasks' folder

    2008-12-30 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]

    2009-01-03 c:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job
    - c:\program files\Spybot - Search & Destroy\SpybotSD.exe [2007-08-31 15:46]

    2009-01-05 c:\windows\Tasks\ywdowcfz.job
    - c:\windows\system32\rundll32.exe [2004-08-04 12:00]
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.yahoo.co.uk/
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

    O16 -: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
    c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
    FF - ProfilePath - c:\documents and settings\Rob\Application Data\Mozilla\Firefox\Profiles\23nxpgix.default\
    FF - prefs.js: browser.startup.homepage - www.yahoo.co.uk
    FF - component: c:\documents and settings\Rob\Application Data\Mozilla\Firefox\Profiles\23nxpgix.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}\platform\WINNT\components\FoxyTunes.dll
    FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
    FF - component: c:\program files\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-01-06 01:34:51
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(536)
    c:\windows\system32\Ati2evxx.dll
    .
    Completion time: 2009-01-06 1:36:36
    ComboFix-quarantined-files.txt 2009-01-06 01:35:54
    ComboFix2.txt 2009-01-05 22:31:12

    Pre-Run: 66,162,876,416 bytes free
    Post-Run: 66,099,187,712 bytes free

    176 --- E O F --- 2008-12-16 10:01:04
     
    RobertUddin,
    #5
  7. 2009/01/05
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Please download Flash_Disinfector by sUBs and save it to your desktop:

    NOTE: In the event you already have Flash_Disinfector, this is a new version that I need you to download.

    • Plug in your USB flash drive.
    • Double-click Flash_Disinfector.exe to run it.
    • Follow any prompts that may appear.
    • Your desktop will vanish for a while, and then reappear. This is normal.
    • Wait until the program has finished scanning, then please exit the program. If you use more than 1 flash drive, run the tool with each plugged in.


    Now, disable any realtime protection applications. Highlight and copy the contents of the code box below and paste it into a blank notepad, then save it to your desktop as;

    Filename: CFScript.txt
    Save As Type: All Files (*.*)

    Code:
    File::
c:\windows\ijuzevuqana.dll
c:\windows\Tasks\ywdowcfz.job
Registry::
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
 "AppInit_DLLs "=" "
[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{bc402421-437f-11dc-93fe-000d61347b54}]
    Close all other windows and programs. Now drag the CFScript.txt onto ComboFix.exe and drop it, using the left mouse button. Combofix should run and may reboot the computer when it's done. A log will open when it's complete. Post the contents of that log.

    Please do not click on the ComboFix window while it is running a scan. This can cause it to stall.


    Next, do an online scan with Kaspersky Online Scanner

    Click Accept, when prompted to download and install the program files and database of malware definitions.
    • Click Run at the Security prompt.
    • The program will then begin downloading and installing and will also update the database.
    • Please be patient as this can take several minutes.
    • Once the update is complete, click on My Computer under the green Scan bar to the left to start the scan.
    • Once the scan is complete, it will display if your system has been infected. It does not provide an option to clean/disinfect. We only require a report from it.
    • Click View scan report at the bottom.
    • Click the Save Report As... button.
    • Click the Save as Text button to save the file to your desktop so that you may post it in your next reply.
    **Note**

    To optimize scanning time and produce a more sensible report for review:
    • Close any open programs.
    • Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.


    Post the Kaspersky log here and let me know if any issues persist.
     
    noahdfear,
    #6
  8. 2009/01/08
    RobertUddin

    RobertUddin Inactive Thread Starter

    Joined:
    2009/01/03
    Messages:
    5
    Likes Received:
    0
    Combo log Kasper log

    Hi There,

    Sorry it took some time - been a little busy. Here are the logs...

    ComboFix 09-01-07.01 - Rob 2009-01-07 23:43:11.3 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.44.1033.18.1023.492 [GMT 0:00]
    Running from: J:\ComboFix.exe
    Command switches used :: c:\documents and settings\Rob\Desktop\CFScript.txt
    AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated)
    * Created a new restore point

    FILE ::
    c:\windows\ijuzevuqana.dll
    c:\windows\Tasks\ywdowcfz.job
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\ijuzevuqana.dll
    c:\windows\Tasks\ywdowcfz.job

    .
    ((((((((((((((((((((((((( Files Created from 2008-12-07 to 2009-01-07 )))))))))))))))))))))))))))))))
    .

    2009-01-05 23:01 . 2009-01-05 23:01 <DIR> d-------- C:\VundoFix Backups
    2009-01-05 22:59 . 2009-01-05 22:59 <DIR> d-------- C:\rsit
    2009-01-05 22:59 . 2009-01-05 22:59 <DIR> d-------- c:\program files\trend micro
    2009-01-03 03:08 . 2009-01-03 10:28 <DIR> d-------- c:\documents and settings\All Users\Application Data\SITEguard
    2009-01-03 03:07 . 2009-01-03 03:07 <DIR> d-------- c:\program files\Common Files\iS3
    2009-01-03 03:07 . 2009-01-03 10:33 <DIR> d-------- c:\documents and settings\All Users\Application Data\STOPzilla!
    2009-01-02 23:35 . 2009-01-02 23:35 <DIR> d-------- c:\program files\Security Task Manager
    2009-01-02 23:35 . 2009-01-02 23:39 <DIR> d-------- c:\documents and settings\All Users\Application Data\SecTaskMan
    2008-12-30 18:15 . 2008-12-30 18:15 <DIR> d-------- c:\program files\Common Files\Logitech
    2008-12-25 17:57 . 2007-04-04 14:56 13,712 -ra------ c:\windows\system32\drivers\UsbKbd.sys
    2008-12-25 17:42 . 2008-12-25 18:05 <DIR> d-------- C:\Songeasy load
    2008-12-23 00:58 . 2008-02-06 02:20 628,760 -ra------ c:\windows\system32\drivers\lvrs.sys
    2008-12-23 00:58 . 2008-02-06 01:40 25,056 -ra------ c:\windows\system32\Repository.reg
    2008-12-23 00:58 . 2008-02-06 02:17 13,848 -ra------ c:\windows\system32\drivers\lv302af.sys
    2008-12-23 00:55 . 2008-02-06 02:17 2,570,520 -ra------ c:\windows\system32\drivers\LV302V32.SYS
    2008-12-23 00:55 . 2008-02-06 02:21 490,008 -ra------ c:\windows\system32\LVUI2.dll
    2008-12-23 00:55 . 2008-02-06 02:21 465,432 -ra------ c:\windows\system32\LVUI2RC.dll
    2008-12-23 00:55 . 2008-02-06 02:18 416,280 -ra------ c:\windows\system32\lvcodec2.dll
    2008-12-23 00:55 . 2008-02-06 02:18 195,096 -ra------ c:\windows\system32\lvci11701196.dll
    2008-12-23 00:55 . 2008-02-06 01:37 66,482 -ra------ c:\windows\system32\lvcoinst.ini
    2008-12-23 00:55 . 2008-02-06 02:21 41,752 -ra------ c:\windows\system32\drivers\LVUSBSta.sys
    2008-12-23 00:51 . 2008-12-23 00:51 <DIR> d-------- c:\documents and settings\Rob\Application Data\Leadertech
    2008-12-23 00:49 . 2008-12-23 00:49 <DIR> d-------- c:\program files\Logitech
    2008-12-23 00:49 . 2008-12-29 16:37 <DIR> d-------- c:\program files\Common Files\LogiShrd
    2008-12-23 00:49 . 2008-12-23 00:49 <DIR> d-------- c:\documents and settings\All Users\Application Data\Logitech
    2008-12-23 00:49 . 2008-12-30 12:54 <DIR> d-------- c:\documents and settings\All Users\Application Data\Logishrd
    2008-12-12 17:31 . 2008-12-12 17:31 230,424 --a------ C:\snp2sxp-002.raw
    2008-12-11 03:10 . 2009-01-05 23:10 <DIR> d--h----- C:\$AVG8.VAULT$
    2008-12-11 01:38 . 2009-01-07 02:46 <DIR> d-------- c:\windows\system32\drivers\Avg
    2008-12-11 01:38 . 2008-12-11 01:38 <DIR> d-------- c:\program files\AVG
    2008-12-11 01:38 . 2008-12-11 11:27 <DIR> d-------- c:\documents and settings\Rob\Application Data\AVGTOOLBAR
    2008-12-11 01:38 . 2009-01-02 23:54 <DIR> d-------- c:\documents and settings\All Users\Application Data\avg8
    2008-12-11 01:38 . 2009-01-02 23:54 <DIR> d-------- c:\documents and settings\All Users\Application Data\AVG7
    2008-12-11 01:38 . 2008-12-11 01:38 97,928 --a------ c:\windows\system32\drivers\avgldx86.sys
    2008-12-11 01:38 . 2008-12-11 01:38 76,040 --a------ c:\windows\system32\drivers\avgtdix.sys
    2008-12-11 01:38 . 2008-12-11 01:38 10,520 --a------ c:\windows\system32\avgrsstx.dll
    2008-12-11 00:38 . 2008-12-14 00:32 <DIR> d-------- c:\program files\Mozilla Thunderbird
    2008-12-11 00:38 . 2008-12-11 00:38 <DIR> d-------- c:\documents and settings\Rob\Application Data\Thunderbird
    2008-12-10 16:22 . 2008-12-10 16:22 <DIR> d-------- c:\documents and settings\Rob\Application Data\MSNInstaller
    2008-12-10 13:22 . 2008-12-10 13:22 <DIR> d-------- c:\program files\GoalTigerVisionBoard
    2008-12-10 13:21 . 2008-12-10 13:21 <DIR> d-------- c:\program files\Sony Ericsson
    2008-12-10 13:14 . 2008-12-16 15:01 <DIR> d-------- c:\windows\system32\CatRoot_bak
    2008-12-10 13:12 . 2008-12-10 13:12 <DIR> d-------- c:\program files\MarkAny
    2008-12-08 21:06 . 2008-12-08 21:06 <DIR> d-------- c:\windows\system32\scripting
    2008-12-08 21:06 . 2008-12-08 21:06 <DIR> d-------- c:\windows\l2schemas
    2008-12-08 20:59 . 2008-12-08 21:07 <DIR> d-------- c:\windows\ServicePackFiles
    2008-12-08 13:01 . 2008-12-17 22:44 <DIR> d-------- c:\program files\Noughties

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-01-03 02:37 --------- d-----w c:\program files\Spybot - Search & Destroy
    2009-01-02 19:28 --------- d-----w c:\program files\Java
    2009-01-02 19:20 --------- d-----w c:\program files\LimeWire
    2008-12-31 11:10 --------- d-----w c:\program files\eMule
    2008-12-08 20:09 --------- d--h--w c:\program files\InstallShield Installation Information
    2008-11-28 17:49 --------- d-----w c:\program files\Common Files\ArcSoft
    2008-11-28 17:48 --------- d-----w c:\program files\ArcSoft
    2008-11-28 17:42 --------- d-----w c:\program files\Common Files\snp2std
    2008-10-23 13:01 283,648 ----a-w c:\windows\system32\gdi32.dll
    2008-10-16 20:38 826,368 ----a-w c:\windows\system32\wininet.dll
    2008-10-16 14:13 202,776 ----a-w c:\windows\system32\wuweb.dll
    2008-10-16 14:13 1,809,944 ----a-w c:\windows\system32\wuaueng.dll
    2008-10-16 14:12 561,688 ----a-w c:\windows\system32\wuapi.dll
    2008-10-16 14:12 323,608 ----a-w c:\windows\system32\wucltui.dll
    2008-10-16 14:09 92,696 ----a-w c:\windows\system32\cdm.dll
    2008-10-16 14:09 51,224 ----a-w c:\windows\system32\wuauclt.exe
    2008-10-16 14:09 43,544 ----a-w c:\windows\system32\wups2.dll
    2008-10-16 14:08 34,328 ----a-w c:\windows\system32\wups.dll
    2008-10-16 14:06 268,648 ----a-w c:\windows\system32\mucltui.dll
    2008-10-16 14:06 208,744 ----a-w c:\windows\system32\muweb.dll
    2008-10-15 16:57 332,800 ----a-w c:\windows\system32\netapi32(4).dll
    2008-10-15 16:57 332,800 ----a-w c:\windows\system32\netapi32(3).dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "msnmsgr "= "c:\program files\Windows Live\Messenger\msnmsgr.exe" [2007-10-18 5724184]
    "ctfmon.exe "= "c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
    "SpybotSD TeaTimer "= "c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2008-09-16 1833296]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
    "FlashPlayerUpdate "= "c:\windows\system32\Macromed\Flash\NPSWF32_FlashUtil.exe" [2008-10-05 235936]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "PCguardadvisor.exe "= "c:\program files\blueyonder\PCguard advisor\PCguardadvisor.exe" [2006-04-28 1888256]
    "NeroFilterCheck "= "c:\windows\system32\NeroCheck.exe" [2001-07-09 155648]
    "SMSTray "= "c:\program files\Samsung\Samsung Media Studio 5\SMSTray.exe" [2007-09-20 132624]
    "Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 40048]
    "QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2008-01-31 385024]
    "TkBellExe "= "c:\program files\Common Files\Real\Update_OB\realsched.exe" [2007-11-24 185896]
    "iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2008-02-19 267048]
    "AVG8_TRAY "= "c:\progra~1\AVG\AVG8\avgtray.exe" [2008-12-11 1261336]
    "LogitechCommunicationsManager "= "c:\program files\Common Files\LogiShrd\LComMgr\Communications_Helper.exe" [2008-02-13 564496]
    "LogitechQuickCamRibbon "= "c:\program files\Logitech\QuickCam\Quickcam.exe" [2008-02-13 2196240]
    "c82f9f57 "= "c:\windows\system32\llbsidmc.dll" [BU]
    "SoundMan "= "SOUNDMAN.EXE" [2006-06-21 c:\windows\soundman.exe]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    HP Digital Imaging Monitor.lnk - c:\program files\HP\Digital Imaging\bin\hpqtra08.exe [2004-05-28 241664]
    HP Image Zone Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2004-05-28 53248]

    [hkey_local_machine\software\microsoft\windows\currentversion\explorer\ShellExecuteHooks]
    "{88485281-8b4b-4f8d-9ede-82e29a064277} "= "c:\progra~1\MarkAny\CONTEN~1\MACSMA~1.DLL" [2004-11-23 192512]

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "c:\\Program Files\\iTunes\\iTunes.exe "=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
    "c:\\Program Files\\eMule\\emule.exe "=
    "c:\\Program Files\\LimeWire\\LimeWire.exe "=
    "c:\\Program Files\\AVG\\AVG8\\avgemc.exe "=
    "c:\\Program Files\\AVG\\AVG8\\avgupd.exe "=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "3128:TCP "= 3128:TCP:avg

    R0 tffsport;M-Systems DiskOnChip 2000;c:\windows\system32\drivers\tffsport.sys [2008-01-28 149376]
    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2008-12-11 97928]
    R4 avg8emc;AVG Free8 E-mail Scanner;c:\progra~1\AVG\AVG8\avgemc.exe [2008-12-11 875288]
    R4 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [2008-12-11 231704]
    R4 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2008-12-11 76040]
    S3 UsbKbd;Multak Book USB Driver;c:\windows\system32\drivers\UsbKbd.sys [2008-12-25 13712]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2abeb636-95c1-11dc-9432-000d61347b54}]
    \Shell\AutoRun\command - E:\LaunchU3.exe

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f1ca073b-5896-11dd-9478-000d61347b54}]
    \Shell\AutoRun\command - E:\InstallTomTomHOME.exe
    .
    Contents of the 'Scheduled Tasks' folder

    2009-01-06 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2007-08-29 14:57]

    2009-01-03 c:\windows\Tasks\Spybot - Search & Destroy - Scheduled Task.job
    - c:\program files\Spybot - Search & Destroy\SpybotSD.exe [2007-08-31 15:46]
    .
    - - - - ORPHANS REMOVED - - - -

    BHO-{68B4D8D9-7100-492D-8707-93FCC42E1DB6} - (no file)
    BHO-{709656F2-CA31-43BF-ABBE-06EC3D47BFC9} - (no file)
    BHO-{AA715187-E4F8-4103-95DA-04A4EBD87F95} - (no file)
    BHO-{CA186527-41D4-4573-9DC3-D571E50586C0} - (no file)


    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.yahoo.co.uk/
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

    O16 -: Microsoft XML Parser for Java - file:///C:/WINDOWS/Java/classes/xmldso.cab
    c:\windows\Downloaded Program Files\Microsoft XML Parser for Java.osd
    FF - ProfilePath - c:\documents and settings\Rob\Application Data\Mozilla\Firefox\Profiles\23nxpgix.default\
    FF - prefs.js: browser.startup.homepage - www.yahoo.co.uk
    FF - component: c:\documents and settings\Rob\Application Data\Mozilla\Firefox\Profiles\23nxpgix.default\extensions\{463F6CA5-EE3C-4be1-B7E6-7FEE11953374}\platform\WINNT\components\FoxyTunes.dll
    FF - component: c:\program files\AVG\AVG8\Firefox\components\avgssff.dll
    FF - component: c:\program files\AVG\AVG8\ToolbarFF\components\vmAVGConnector.dll
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-01-07 23:45:29
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(536)
    c:\windows\system32\Ati2evxx.dll

    - - - - - - - > 'winlogon.exe'(980)
    c:\windows\system32\Ati2evxx.dll
    .
    Completion time: 2009-01-07 23:48:01
    ComboFix-quarantined-files.txt 2009-01-07 23:47:22
    ComboFix2.txt 2009-01-06 01:36:37
    ComboFix3.txt 2009-01-05 22:31:12

    Pre-Run: 66,095,362,048 bytes free
    Post-Run: 66,083,901,440 bytes free

    187 --- E O F --- 2008-12-16 10:01:04


    Thursday, January 8, 2009
    Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
    Kaspersky Online Scanner 7 version: 7.0.25.0
    Program database last update: Wednesday, January 07, 2009 23:24:06
    Records in database: 1582621
    Scan settings
    Scan using the following database extended
    Scan archives yes
    Scan mail databases yes
    Scan area My Computer
    A:\
    C:\
    D:\
    F:\
    Scan statistics
    Files scanned 58830
    Threat name 15
    Infected objects 35
    Suspicious objects 0
    Duration of the scan 01:42:14

    File name Threat name Threats count
    C:\Qoobox\Quarantine\C\WINDOWS\system32\alaiioms.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.fsk 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\apqjly.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.fqr 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\bouxrr.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.ftx 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\ctsiaesa.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.fqr 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\ddCusSmj.dll.vir Infected: Trojan.Win32.Monder.agwe 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\dlamsk.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.fqb 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\fhlhxfnm.dll.vir Infected: Trojan.Win32.Monder.agmv 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\fkyyqxdk.dll.vir Infected: Trojan.Win32.Monder.agia 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\geBsrOef.dll.vir Infected: Trojan.Win32.Monder.agwe 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\gemjhnat.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.fqb 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\grqgmydb.dll.vir Infected: Trojan.Win32.Monder.agtu 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\hkkdei.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.fpv 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\hnojqkgk.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.fqr 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\huwwtmvt.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.fpv 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\jlutqz.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.fqr 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\kklbxnap.dll.vir Infected: Trojan.Win32.Monder.agtu 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\ofvawlrr.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.fqb 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\prrdcrnb.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.fqb 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\qjllhwre.dll.vir Infected: Trojan.Win32.Monder.agmv 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\qoMeFuro.dll.vir Infected: Trojan.Win32.Monder.agwe 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\qwklpppe.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.fqr 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\rdcvinhl.dll.vir Infected: Trojan.Win32.Monder.ahmz 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\rqRIawWN.dll.vir Infected: Packed.Win32.PolyCrypt.d 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\rqRLbbCu.dll.vir Infected: Packed.Win32.PolyCrypt.d 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\senekaepydijaw.dll.vir Infected: Trojan.Win32.Small.brl 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\senekauvjsarje.dll.vir Infected: Trojan.Win32.Agent.aykk 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\ssqPfgec.dll.vir Infected: Trojan.Win32.Monder.agwe 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\stynbz.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.fqr 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\tvfzpr.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.fsk 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\urqQJyyx.dll.vir Infected: Trojan.Win32.Monder.ahbh 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\wchhvdll.dll.vir Infected: Trojan.Win32.Monder.ahye 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\wqlieoyl.dll.vir Infected: Trojan.Win32.Monder.agmv 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\xkfvmjjq.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.ftx 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\yoyrxqpi.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.fqb 1
    C:\Qoobox\Quarantine\C\WINDOWS\system32\zvvayz.dll.vir Infected: not-a-virus:AdWare.Win32.SuperJuan.fqb 1
    The selected area was scanned.

    Thanks

    Rob
     
    RobertUddin,
    #7
  9. 2009/01/08
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Highlight and copy the contents of the code box below.
    Code:
    reg delete HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v c82f9f57 /f
exit
cls
    Click Start>Run and type cmd then hit enter to open a command window. Right click in the command window and select paste. The command window will close on it's own.


    Looks good otherwise. Provided you feel the machine is behaving properly, proceed with cleanup as outlined below.


    Open your resident antivirus and remove any items quarantined.

    Click Start>Run and type ComboFix /u then hit Enter to uninstall ComboFix and remove the files it has quarantined. This action will also reset the System Restore points, removing any infected files there as well.
    Verify the C:\Qoobox and C:\ComboFix folders were removed, as well as the C:\ComboFix.txt file.

    Delete RSIT.exe and the C:\rsit folder.
    You can delete any other logs that were created/saved too.
    Empty the recycle bin when done.


    That should wrap things up.
     
    noahdfear,
    #8
  10. 2009/01/09
    RobertUddin

    RobertUddin Inactive Thread Starter

    Joined:
    2009/01/03
    Messages:
    5
    Likes Received:
    0
    Hi There,

    This seems a bit strange - I can copy the code OK but when I right click in the command prompt the window shuts immediately and I have no visual option to paste the code - I have tried typing the code though it comes up with line error.
     
    RobertUddin,
    #9
  11. 2009/01/09
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    The command was processed the on the first attempt. You get the error when manually typing the command because the key to delete is already gone. For an explanation of why you had no Paste option upon right clicking, see here.
     
    noahdfear,
    #10

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...