1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Solved Trojan Horse Agent2.TRD

Discussion in 'Malware and Virus Removal Archive' started by Andy Cool, 2009/10/03.

Page 1 of 2
  1. 2009/10/03
    Andy Cool

    Andy Cool Inactive Thread Starter

    Joined:
    2007/10/12
    Messages:
    208
    Likes Received:
    0
    [Resolved] Trojan Horse Agent2.TRD

    Dear Admins,

    I have AVG antivirus installed on my PC..I have run a scan and found out I have a Trojan..
    Please help me out fixing this issue. Attached are the 2 logs as per your instructions

    DDS log:



    DDS (Ver_09-09-29.01) - NTFSx86
    Run by Ghaleb Madhoun at 20:50:02.69 on Sat 10/03/2009
    Internet Explorer: 8.0.6001.18241
    Microsoft Windows XP Professional 5.1.2600.2.1256.961.1033.18.503.196 [GMT 3:00]

    AV: AVG Anti-Virus Free *On-access scanning enabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

    ============== Running Processes ===============

    C:\WINDOWS\system32\svchost -k DcomLaunch
    svchost.exe
    C:\WINDOWS\System32\svchost.exe -k netsvcs
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    C:\WINDOWS\Explorer.EXE
    svchost.exe
    svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    svchost.exe
    C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\Program Files\Apoint\Apoint.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\Program Files\Apoint\HidFind.exe
    C:\Program Files\Apoint\Apntex.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\WINDOWS\System32\svchost.exe -k HTTPFilter
    C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\WINDOWS\system32\svchost.exe -k imgsvc
    C:\Program Files\AVG\AVG8\avgtray.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgnsx.exe
    C:\Documents and Settings\Ghaleb Madhoun\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\Ghaleb Madhoun\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\Ghaleb Madhoun\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\Ghaleb Madhoun\Desktop\dds.scr

    ============== Pseudo HJT Report ===============

    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyOverride = *.local
    uURLSearchHooks: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
    BHO: &Yahoo! Toolbar Helper: {02478d38-c3f9-4efb-9b51-7695eca05670} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
    BHO: Adobe PDF Link Helper: {18df081c-e8ad-4283-a596-fa578c2ebdc3} - c:\program files\common files\adobe\acrobat\activex\AcroIEHelperShim.dll
    BHO: Skype add-on (mastermind): {22bf413b-c6d2-4d91-82a9-a0f997ba588c} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
    BHO: AVG Safe Search: {3ca2f312-6f6e-4b53-a66e-4e65e497c8c0} - c:\program files\avg\avg8\avgssie.dll
    BHO: {5C255C8A-E604-49b4-9D64-90988571CECB} - No File
    BHO: Windows Live Sign-in Helper: {9030d464-4c02-4abf-8ecc-5164760863c6} - c:\program files\common files\microsoft shared\windows live\WindowsLiveLogin.dll
    BHO: Java(tm) Plug-In 2 SSV Helper: {dbc80044-a445-435b-bc74-9c25c1c588a9} - c:\program files\java\jre6\bin\jp2ssv.dll
    BHO: JQSIEStartDetectorImpl Class: {e7e6f031-17ce-4c07-bc86-eabfe594f69c} - c:\program files\java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    BHO: SingleInstance Class: {fdad4da1-61a2-4fd8-9c17-86f7ac245081} - c:\program files\yahoo!\companion\installs\cpn0\YTSingleInstance.dll
    TB: Yahoo! Toolbar: {ef99bd32-c1fb-11d2-892f-0090271d4f88} - c:\program files\yahoo!\companion\installs\cpn0\yt.dll
    uRun: [CTFMON.EXE] c:\windows\system32\ctfmon.exe
    uRun: [cdoosoft] c:\docume~1\ghaleb~1\locals~1\temp\herss.exe
    uRun: [Skype] "c:\program files\skype\phone\Skype.exe" /nosplash /minimized
    uRun: [Google Update] "c:\documents and settings\ghaleb madhoun\local settings\application data\google\update\GoogleUpdate.exe" /c
    uRun: [Messenger (Yahoo!)] "c:\program files\yahoo!\messenger\YahooMessenger.exe" -quiet
    mRun: [IMJPMIG8.1] "c:\windows\ime\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    mRun: [PHIME2002ASync] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /SYNC
    mRun: [PHIME2002A] c:\windows\system32\ime\tintlgnt\TINTSETP.EXE /IMEName
    mRun: [ehTray] c:\windows\ehome\ehtray.exe
    mRun: [Apoint] c:\program files\apoint\Apoint.exe
    mRun: [igfxtray] c:\windows\system32\igfxtray.exe
    mRun: [igfxhkcmd] c:\windows\system32\hkcmd.exe
    mRun: [igfxpers] c:\windows\system32\igfxpers.exe
    mRun: [SunJavaUpdateSched] "c:\program files\java\jre6\bin\jusched.exe "
    mRun: [IntelZeroConfig] "c:\program files\intel\wireless\bin\ZCfgSvc.exe "
    mRun: [IntelWireless] "c:\program files\intel\wireless\bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    mRun: [NeroFilterCheck] c:\program files\common files\ahead\lib\NeroCheck.exe
    mRun: [AVG8_TRAY] c:\progra~1\avg\avg8\avgtray.exe
    mRun: [Adobe Reader Speed Launcher] "c:\program files\adobe\reader 9.0\reader\Reader_sl.exe "
    mRun: [QuickTime Task] "c:\program files\quicktime\QTTask.exe" -atboottime
    mRun: [iTunesHelper] "c:\program files\itunes\iTunesHelper.exe "
    dRun: [CTFMON.EXE] c:\windows\system32\CTFMON.EXE
    IE: E&xport to Microsoft Excel - c:\progra~1\micros~4\office11\EXCEL.EXE/3000
    IE: {FB5F1910-F110-11d2-BB9E-00C04F795683} - c:\program files\messenger\msmsgs.exe
    IE: {5067A26B-1337-4436-8AFE-EE169C2DA79F} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
    IE: {77BF5300-1474-4EC7-9980-D32B190E9B07} - {77BF5300-1474-4EC7-9980-D32B190E9B07} - c:\program files\skype\toolbars\internet explorer\SkypeIEPlugin.dll
    IE: {92780B25-18CC-41C8-B9BE-3C9C571A8263} - {FF059E31-CC5A-4E2E-BF3B-96E929D65503} - c:\progra~1\micros~4\office11\REFIEBAR.DLL
    DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} - hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1253950627795
    DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_03-windows-i586.cab
    DPF: {CAFEEFAC-0016-0000-0015-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
    DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} - hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_15-windows-i586.cab
    DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} - hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    Handler: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - c:\program files\avg\avg8\avgpp.dll
    Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - c:\progra~1\common~1\skype\SKYPE4~1.DLL
    Notify: avgrsstarter - avgrsstx.dll
    Notify: Csrss - csrss9.dll
    Notify: igfxcui - igfxdev.dll
    SSODL: WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - c:\windows\system32\WPDShServiceObj.dll

    ============= SERVICES / DRIVERS ===============

    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [2009-9-20 335240]
    R1 AvgMfx86;AVG Free On-access Scanner Minifilter Driver x86;c:\windows\system32\drivers\avgmfx86.sys [2009-9-20 27784]
    R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [2009-9-20 108552]
    R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\avg\avg8\avgwdsvc.exe [2009-9-20 297752]
    R2 McrdSvc;Media Center Extender Service;c:\windows\ehome\mcrdsvc.exe [2005-8-5 99328]
    R2 YahooAUService;Yahoo! Updater;c:\program files\yahoo!\softwareupdate\YahooAUService.exe [2008-11-9 602392]
    S3 AVPsys;AVPsys;c:\windows\system32\drivers\cdaudio.sys [2001-8-17 18688]
    S3 DCALEXICO;DCALEXICO;c:\windows\system32\drivers\dcalexico.sys --> c:\windows\system32\drivers\DCalexico.sys [?]

    =============== Created Last 30 ================

    2009-10-03 09:49 5,632 a------- c:\windows\system32\ptpusb.dll
    2009-10-03 09:49 15,104 ac------ c:\windows\system32\dllcache\usbscan.sys
    2009-10-03 09:49 159,232 a------- c:\windows\system32\ptpusd.dll
    2009-10-03 09:49 15,104 a------- c:\windows\system32\drivers\usbscan.sys
    2009-10-03 09:30 107,368 a------- c:\windows\system32\GEARAspi.dll
    2009-10-03 09:30 26,600 a------- c:\windows\system32\drivers\GEARAspiWDM.sys
    2009-10-03 09:29 <DIR> --d----- c:\program files\iPod
    2009-10-03 09:29 <DIR> --d----- c:\program files\iTunes
    2009-10-03 09:29 <DIR> --d----- c:\docume~1\alluse~1\applic~1\{755AC846-7372-4AC8-8550-C52491DAA8BD}
    2009-10-03 09:29 <DIR> --d----- c:\program files\Bonjour
    2009-10-03 09:27 40,448 a------- c:\windows\system32\drivers\usbaapl.sys
    2009-10-03 09:27 2,065,696 a------- c:\windows\system32\usbaaplrc.dll
    2009-09-30 08:41 69 a------- c:\windows\NeroDigital.ini
    2009-09-29 19:30 139,264 a------- c:\windows\system32\csrss9.dll
    2009-09-29 19:30 135,168 a------- c:\docume~1\alluse~1\applic~1\csrss.exe
    2009-09-28 12:31 <DIR> --d-h--- C:\$AVG8.VAULT$
    2009-09-20 18:09 56 a---h--- c:\windows\system32\ezsidmv.dat
    2009-09-20 15:35 <DIR> --d----- c:\program files\Yahoo!
    2009-09-20 14:38 <DIR> --d----- c:\program files\Microsoft
    2009-09-20 14:01 11,952 a------- c:\windows\system32\avgrsstx.dll
    2009-09-20 14:01 108,552 a------- c:\windows\system32\drivers\avgtdix.sys
    2009-09-20 14:01 335,240 a------- c:\windows\system32\drivers\avgldx86.sys
    2009-09-20 14:01 <DIR> --d----- c:\windows\system32\drivers\Avg
    2009-09-20 14:00 <DIR> --d----- c:\program files\AVG
    2009-09-20 14:00 <DIR> --d----- c:\docume~1\alluse~1\applic~1\avg8
    2009-09-19 15:59 <DIR> --d----- c:\docume~1\ghaleb~1\applic~1\AVG8
    2009-09-19 15:56 411,368 a------- c:\windows\system32\deploytk.dll
    2009-09-05 01:54 94,208 a------- c:\windows\system32\QuickTimeVR.qtx
    2009-09-05 01:54 69,632 a------- c:\windows\system32\QuickTime.qts

    ==================== Find3M ====================

    2009-09-20 15:21 87,747 a------- c:\windows\pchealth\helpctr\offlinecache\index.dat
    2009-07-26 16:44 48,448 a------- c:\windows\system32\sirenacm.dll
    2009-07-25 17:34 21,640 a------- c:\windows\system32\emptyregdb.dat

    ============= FINISH: 20:50:20.64 ===============


    Attach Log

    UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
    IF REQUESTED, ZIP IT UP & ATTACH IT

    DDS (Ver_09-09-29.01)

    Microsoft Windows XP Professional
    Boot Device: \Device\HarddiskVolume1
    Install Date: 7/25/2009 5:44:29 PM
    System Uptime: 10/3/2009 7:58:07 AM (13 hours ago)

    Motherboard: Dell Inc. | | 0W9260
    Processor: Intel(R) Pentium(R) M processor 1.60GHz | Microprocessor | 1595/133mhz

    ==== Disk Partitions =========================

    C: is FIXED (NTFS) - 37 GiB total, 13.857 GiB free.
    D: is CDROM ()

    ==== Disabled Device Manager Items =============

    ==== System Restore Points ===================

    RP1: 7/25/2009 5:52:13 PM - Installed Digital Media Feature Pack for Windows Media Center 2005
    RP2: 7/25/2009 5:53:38 PM - Installed Sonic Encoders
    RP3: 7/25/2009 5:56:50 PM - Installed Windows Media Player 10 KB903157.
    RP4: 7/25/2009 5:57:14 PM - Installed Windows XP KB891593.
    RP5: 7/25/2009 5:57:25 PM - Installed Windows XP KB895961.
    RP6: 7/25/2009 5:57:36 PM - Installed Windows XP KB899337.
    RP7: 7/25/2009 5:57:51 PM - Installed Windows XP KB912812.
    RP8: 7/25/2009 5:58:10 PM - Installed Windows XP KB899510.
    RP9: 7/25/2009 5:58:24 PM - Installed Windows XP KB888795.
    RP10: 7/25/2009 5:58:43 PM - Installed Windows XP KB902841.
    RP11: 7/25/2009 6:00:06 PM - Installed Windows XP Media Center Edition 2005 Update Rollup 2.
    RP12: 8/1/2009 11:47:17 PM - Installed Broadcom 440x 10/100 Integrated Controller
    RP13: 8/1/2009 11:49:21 PM - Installed C-Major Audio
    RP14: 8/1/2009 11:49:34 PM - Installed Dell System Software
    RP15: 8/1/2009 11:49:42 PM - Installed Notebook System Software
    RP16: 8/1/2009 11:49:47 PM - Installed QuickSet
    RP17: 8/1/2009 11:50:03 PM - Installed Windows XP KB908673.
    RP18: 8/1/2009 11:50:16 PM - Installed Windows XP KB914642.
    RP19: 8/1/2009 11:50:32 PM - Installed Windows XP KB885855.
    RP20: 8/1/2009 11:50:44 PM - Installed Windows XP KB896256.
    RP21: 8/1/2009 11:53:20 PM - Installed Norman Security Suite.
    RP22: 8/2/2009 12:20:40 AM - Installed Windows Installer KB893803v2.
    RP23: 8/2/2009 12:26:16 AM - Shockwave Player
    RP24: 8/2/2009 12:26:36 AM - Installed Adobe Reader 9.
    RP25: 8/2/2009 12:28:27 AM - Installed Java(TM) 6 Update 3
    RP26: 8/2/2009 12:29:39 AM - Installed IntelJPU
    RP27: 8/2/2009 12:32:21 AM - Installed Windows Internet Explorer 8.
    RP28: 8/2/2009 12:38:19 AM - Installed Windows Media Player 11
    RP29: 8/2/2009 12:38:48 AM - Installed Windows XP Wudf01000.
    RP30: 8/2/2009 12:41:21 AM - Installed Windows XP MSCompPackV1.
    RP31: 8/2/2009 12:41:40 AM - Installed Windows XP KB926239.
    RP32: 8/2/2009 1:16:13 AM - Installed Broadcom Management Programs 2
    RP33: 8/2/2009 1:26:58 AM - Configured Broadcom Management Programs 2
    RP34: 8/2/2009 1:27:54 AM - Configured Broadcom 440x 10/100 Integrated Controller
    RP35: 8/2/2009 1:41:54 AM - Installed Driver Detective.
    RP36: 8/2/2009 1:51:42 AM - Removed Driver Detective.
    RP37: 8/2/2009 1:58:08 AM - Installed Broadcom Management Programs 2
    RP38: 8/2/2009 1:58:48 AM - Installed QuickSet
    RP39: 8/2/2009 12:11:47 PM - Installed Microsoft Office Professional Edition 2003
    RP40: 8/2/2009 12:13:59 PM - Installed DirectX
    RP41: 8/2/2009 12:15:47 PM - Installed Nero 7 Essentials
    RP42: 8/3/2009 8:34:13 PM - Installed Microsoft Office Professional Edition 2003
    RP43: 8/3/2009 9:41:44 PM - Removed QuickSet
    RP44: 8/6/2009 7:44:35 PM - System Checkpoint
    RP45: 8/7/2009 10:28:46 PM - System Checkpoint
    RP46: 8/30/2009 11:30:22 AM - Removed Microsoft Office Professional Edition 2003
    RP47: 8/30/2009 11:32:33 AM - Installed Microsoft Office Professional Edition 2003
    RP48: 9/19/2009 3:55:45 PM - Installed Java(TM) 6 Update 15
    RP49: 9/19/2009 4:07:34 PM - Removed Norman Security Suite.
    RP50: 9/20/2009 2:00:54 PM - Installed AVG Free 8.5
    RP51: 9/20/2009 2:37:55 PM - Removed Windows Live Essentials
    RP52: 9/21/2009 9:20:25 AM - Removed Adobe Reader 9.
    RP53: 9/21/2009 9:21:50 AM - Avg8 Update
    RP54: 9/27/2009 3:57:23 PM - System Checkpoint
    RP55: 9/28/2009 4:22:59 PM - System Checkpoint
    RP56: 9/29/2009 5:30:17 PM - System Checkpoint
    RP57: 10/3/2009 9:29:30 AM - Installed iTunes
    RP58: 10/3/2009 9:47:47 AM - Avg8 Update
    RP59: 10/3/2009 9:51:55 AM - Avg8 Update

    ==== Installed Programs ======================

    Adobe AIR
    Adobe Flash Player 10 ActiveX
    Adobe Flash Player 10 Plugin
    Adobe Reader 9.1.3
    Adobe Shockwave Player 11
    ALPS Touch Pad Driver
    Apple Application Support
    Apple Mobile Device Support
    Apple Software Update
    AVG Free 8.5
    Bonjour
    Broadcom Management Programs 2
    C-Major Audio
    Conexant D110 MDC V.92 Modem
    Google Chrome
    Hotfix for Windows Media Player 10 (KB903157)
    Hotfix for Windows XP (KB888795)
    Hotfix for Windows XP (KB891593)
    Hotfix for Windows XP (KB895961)
    Hotfix for Windows XP (KB896256)
    Hotfix for Windows XP (KB899337)
    Hotfix for Windows XP (KB899510)
    Hotfix for Windows XP (KB902841)
    Hotfix for Windows XP (KB908673)
    Hotfix for Windows XP (KB914642)
    Hotfix for Windows XP (KB926239)
    Intel(R) Graphics Media Accelerator Driver for Mobile
    Intel(R) PROSet/Wireless Software
    iTunes
    Java(TM) 6 Update 15
    Java(TM) 6 Update 3
    mCore
    mDriver
    mDrWiFi
    mHlpDell
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 2.0
    Microsoft Application Error Reporting
    Microsoft Choice Guard
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Office Professional Edition 2003
    Microsoft Silverlight
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Visual C++ 2005 Redistributable
    mIWA
    mLogView
    mMHouse
    mPfMgr
    mPfWiz
    mProSafe
    mSCfg
    mSSO
    MSVCRT
    MSXML 6.0 Parser
    mWlsSafe
    mWMI
    mZConfig
    Nero 7 Essentials
    QuickTime
    Security Update for Windows XP (KB912812)
    Segoe UI
    Skype web features
    Skypeâ„¢ 4.1
    Sonic Encoders
    Spelling Dictionaries Support For Adobe Reader 9
    Update Rollup 2 for Windows XP Media Center Edition 2005
    WebFldrs XP
    Windows Installer 3.1 (KB893803)
    Windows Internet Explorer 8 Beta 2
    Windows Live Call
    Windows Live Communications Platform
    Windows Live Essentials
    Windows Live Messenger
    Windows Live Sign-in Assistant
    Windows Live Upload Tool
    Windows Media Format 11 runtime
    Windows Media Player 11
    Windows XP Hotfix - KB839210
    Windows XP Hotfix - KB885855
    WinRAR archiver
    Yahoo! Messenger
    Yahoo! Software Update
    Yahoo! Toolbar

    ==== Event Viewer Messages From Past Week ========

    9/30/2009 6:30:51 PM, error: Dhcp [1002] - The IP address lease 192.168.1.64 for the Network Card with network address 0013CE260F08 has been denied by the DHCP server 192.168.1.254 (The DHCP Server sent a DHCPNACK message).
    9/28/2009 9:25:15 AM, error: DCOM [10005] - DCOM got error "%1055" attempting to start the service winmgmt with arguments " " in order to run the server: {8BC3F05E-D86B-11D0-A075-00C04FB68820}
    9/28/2009 9:25:15 AM, error: DCOM [10005] - DCOM got error "%1055" attempting to start the service COMSysApp with arguments " " in order to run the server: {ECABAFBC-7F19-11D2-978E-0000F8757E2A}
    9/28/2009 11:10:11 PM, error: atapi [9] - The device, \Device\Ide\IdePort1, did not respond within the timeout period.
    9/26/2009 9:23:19 AM, error: Tcpip [4199] - The system detected an address conflict for IP address 192.168.1.64 with the system having network hardware address 00:1D:4F:39:66:A9. Network operations on this system may be disrupted as a result.
    9/26/2009 6:12:55 PM, error: Service Control Manager [7011] - Timeout (30000 milliseconds) waiting for a transaction response from the avg8wd service.
    9/26/2009 6:12:53 PM, error: ipnathlp [32003] - The Network Address Translator (NAT) was unable to request an operation of the kernel-mode translation module. This may indicate misconfiguration, insufficient resources, or an internal error. The data is the error code.
    9/26/2009 3:52:30 PM, error: PSched [14103] - QoS [Adapter {D120850B-CB39-4E1D-9146-0335E779C750}]: The netcard driver failed the query for OID_GEN_LINK_SPEED.
    10/2/2009 9:02:48 PM, error: PlugPlayManager [11] - The device Root\LEGACY_FAD\0000 disappeared from the system without first being prepared for removal.
    10/2/2009 10:23:14 PM, error: Schannel [36881] - The certificate received from the remote server has expired. The SSL connection request has failed. The attached data contains the server certificate.

    ==== End Of File ===========================


    Thanks for your help
     
    Andy Cool,
    #1
  2. 2009/10/03
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Please download ComboFix from [color= "Red"]Here[/color] or [color= "#FF0000"]Here[/color] to your Desktop.

    **Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**
    1. Please, never rename Combofix unless instructed.
    2. Close any open browsers.
    3. Close/disable all anti virus and anti malware programs so they do not interfere with the running of ComboFix.
      • Very Important! Temporarily disable your anti-virus, script blocking and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results ".
      • Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
      NOTE. If Combofix asks you to install Recovery Console, please allow it.
      • Close any open browsers.
      • WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
      • Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
      • If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
    4. Double click on combofix.exe & follow the prompts.
    5. When finished, it will produce a report for you.
    6. Please post the "C:\ComboFix.txt" along with a new HijackThis log for further review.
    **Note: Do not mouseclick combofix's window while it's running. That may cause it to stall**

    Make sure, you re-enable your security programs, when you're done with Combofix.

    DO NOT make any other changes to your computer (like installing programs, using other cleaning tools, etc.), until it's officially declared clean!!!



    Download HijackThis:
    http://www.trendsecure.com/portal/en-US/tools/security_tools/hijackthis/download
    by clicking on Download HijackThis Installer
    Install, and run it.
    Post HijackTHis log.
    Do NOT attempt to fix anything!

    NOTE. If you're using Vista, right click on HijackThis, and click Run as Administrator
     
    broni,
    #2


  3. to hide this advert.

  4. 2009/10/04
    Andy Cool

    Andy Cool Inactive Thread Starter

    Joined:
    2007/10/12
    Messages:
    208
    Likes Received:
    0
    Hi Broni,

    Thanks for your help..below are the 2 logs as requested.

    ComboFix 09-10-01.05 - Ghaleb Madhoun 10/04/2009 8:10.1.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1256.961.1033.18.503.179 [GMT 3:00]
    Running from: c:\documents and settings\Ghaleb Madhoun\My Documents\Downloads\ComboFix.exe
    AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Autorun.inf
    c:\windows\Installer\10e1ad9.msi
    c:\windows\Temp\13388.exe

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Service_AVPsys


    ((((((((((((((((((((((((( Files Created from 2009-09-04 to 2009-10-04 )))))))))))))))))))))))))))))))
    .

    2009-10-03 06:49 . 2001-08-17 19:36 5632 ----a-w- c:\windows\system32\ptpusb.dll
    2009-10-03 06:49 . 2004-08-03 21:56 159232 ----a-w- c:\windows\system32\ptpusd.dll
    2009-10-03 06:49 . 2004-08-03 19:58 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
    2009-10-03 06:49 . 2004-08-03 19:58 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
    2009-10-03 06:31 . 2009-10-03 06:55 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Application Data\Apple Computer
    2009-10-03 06:30 . 2008-04-17 10:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll
    2009-10-03 06:30 . 2009-05-18 11:17 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
    2009-10-03 06:29 . 2009-10-03 06:29 -------- d-----w- c:\program files\iPod
    2009-10-03 06:29 . 2009-10-03 06:30 -------- d-----w- c:\program files\iTunes
    2009-10-03 06:29 . 2009-10-03 06:30 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
    2009-10-03 06:29 . 2009-10-03 06:29 -------- d-----w- c:\program files\Bonjour
    2009-10-03 06:28 . 2009-10-03 06:28 -------- d-----w- c:\program files\QuickTime
    2009-10-03 06:27 . 2009-10-03 06:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
    2009-10-03 06:27 . 2009-10-03 06:27 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Apple
    2009-10-03 06:27 . 2009-10-03 06:27 -------- d-----w- c:\program files\Apple Software Update
    2009-10-03 06:27 . 2009-08-28 16:42 40448 ----a-w- c:\windows\system32\drivers\usbaapl.sys
    2009-10-03 06:27 . 2009-08-28 16:42 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll
    2009-10-03 06:26 . 2009-10-03 06:29 -------- d-----w- c:\program files\Common Files\Apple
    2009-10-03 06:26 . 2009-10-03 06:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
    2009-10-03 06:26 . 2009-10-03 06:50 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Apple Computer
    2009-09-29 16:30 . 2009-09-29 16:30 139264 ----a-w- c:\windows\system32\csrss9.dll
    2009-09-28 09:31 . 2009-10-03 11:20 -------- d-----w- C:\$AVG8.VAULT$
    2009-09-27 16:07 . 2009-09-27 16:07 -------- d-----w- c:\windows\Sun
    2009-09-20 18:33 . 2009-09-20 18:34 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Adobe
    2009-09-20 15:09 . 2009-09-20 15:09 56 ---ha-w- c:\windows\system32\ezsidmv.dat
    2009-09-20 15:09 . 2009-10-04 02:51 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Application Data\skypePM
    2009-09-20 12:40 . 2009-09-20 12:40 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Yahoo
    2009-09-20 12:38 . 2009-09-20 14:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
    2009-09-20 12:38 . 2009-09-20 12:38 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Application Data\Yahoo!
    2009-09-20 12:35 . 2009-09-20 12:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
    2009-09-20 12:35 . 2009-09-20 12:38 -------- d-----w- c:\program files\Yahoo!
    2009-09-20 11:38 . 2009-09-20 11:38 -------- d-----w- c:\program files\Microsoft
    2009-09-20 11:01 . 2009-09-20 11:01 11952 ----a-w- c:\windows\system32\avgrsstx.dll
    2009-09-20 11:01 . 2009-09-20 11:01 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
    2009-09-20 11:01 . 2009-09-20 11:01 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
    2009-09-20 11:01 . 2009-09-20 11:01 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
    2009-09-20 11:01 . 2009-10-03 15:04 -------- d-----w- c:\windows\system32\drivers\Avg
    2009-09-20 11:00 . 2009-09-20 11:00 -------- d-----w- c:\program files\AVG
    2009-09-20 11:00 . 2009-10-04 04:59 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
    2009-09-19 12:59 . 2009-09-19 12:59 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Application Data\AVG8
    2009-09-19 12:56 . 2009-09-19 12:55 411368 ----a-w- c:\windows\system32\deploytk.dll
    2009-09-19 12:31 . 2009-10-02 17:45 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Temp
    2009-09-19 12:23 . 2009-09-19 12:46 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Google
    2009-09-19 12:21 . 2009-10-03 07:51 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Deployment

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-10-04 04:59 . 2009-08-01 23:01 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Application Data\Skype
    2009-09-21 06:20 . 2009-08-01 21:26 -------- d-----w- c:\program files\Common Files\Adobe
    2009-09-20 13:58 . 2009-08-01 21:45 -------- d-----w- c:\program files\Microsoft Silverlight
    2009-09-19 12:55 . 2009-08-01 21:28 -------- d-----w- c:\program files\Java
    2009-08-30 08:37 . 2009-08-30 08:37 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Application Data\Ahead
    2009-08-30 08:37 . 2009-08-01 20:49 42288 ----a-w- c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2009-08-30 08:34 . 2009-08-30 08:34 -------- d-----w- c:\program files\Microsoft ActiveSync
    2009-08-30 08:32 . 2009-08-30 08:32 -------- d-----w- c:\program files\Microsoft.NET
    2009-08-01 22:54 . 2009-08-01 22:54 21425 ----a-w- c:\windows\system32\drivers\AegisP.sys
    2009-08-01 21:47 . 2009-08-01 21:47 137 ----a-w- c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\fusioncache.dat
    2009-07-26 13:44 . 2009-07-26 13:44 48448 ----a-w- c:\windows\system32\sirenacm.dll
    2009-07-25 14:34 . 2009-07-25 14:34 21640 ----a-w- c:\windows\system32\emptyregdb.dat
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Skype "= "c:\program files\Skype\Phone\Skype.exe" [2009-07-16 25607976]
    "Google Update "= "c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-09-19 133104]
    "Messenger (Yahoo!) "= "c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-05-26 4351216]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IMJPMIG8.1 "= "c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-10 208952]
    "PHIME2002ASync "= "c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
    "PHIME2002A "= "c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
    "ehTray "= "c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
    "Apoint "= "c:\program files\Apoint\Apoint.exe" [2005-10-07 176128]
    "igfxtray "= "c:\windows\system32\igfxtray.exe" [2006-06-06 94208]
    "igfxhkcmd "= "c:\windows\system32\hkcmd.exe" [2006-06-06 77824]
    "igfxpers "= "c:\windows\system32\igfxpers.exe" [2006-06-06 118784]
    "SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe" [2009-09-19 149280]
    "IntelZeroConfig "= "c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-02-21 819200]
    "IntelWireless "= "c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-02-21 970752]
    "NeroFilterCheck "= "c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
    "AVG8_TRAY "= "c:\progra~1\AVG\AVG8\avgtray.exe" [2009-10-03 2023704]
    "Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
    "QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2009-09-04 417792]
    "iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE "= "c:\windows\system32\CTFMON.EXE" [2004-08-10 15360]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
    2009-09-20 11:01 11952 ----a-w- c:\windows\system32\avgrsstx.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Csrss]
    2009-09-29 16:30 139264 ----a-w- c:\windows\system32\csrss9.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "UpdatesDisableNotify "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe "=
    "c:\\Program Files\\Messenger\\msmsgs.exe "=
    "c:\\Program Files\\AVG\\AVG8\\avgupd.exe "=
    "c:\\Program Files\\AVG\\AVG8\\avgnsx.exe "=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
    "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
    "c:\\Program Files\\iTunes\\iTunes.exe "=
    "c:\\Program Files\\Skype\\Phone\\Skype.exe "=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "110:TCP "= 110:TCP:svchost

    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [9/20/2009 2:01 PM 335240]
    R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [9/20/2009 2:01 PM 108552]
    R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [9/20/2009 2:00 PM 297752]
    S3 DCALEXICO;DCALEXICO;c:\windows\system32\drivers\DCalexico.sys --> c:\windows\system32\drivers\DCalexico.sys [?]
    .
    Contents of the 'Scheduled Tasks' folder

    2009-10-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1757981266-484763869-839522115-1003Core.job
    - c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-09-19 12:31]

    2009-10-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1757981266-484763869-839522115-1003UA.job
    - c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-09-19 12:31]

    2009-10-04 c:\windows\Tasks\User_Feed_Synchronization-{4D00303E-894C-433E-BF3A-F390846AFF33}.job
    - c:\windows\system32\msfeedssync.exe [2008-08-22 00:05]
    .
    .
    ------- Supplementary Scan -------
    .
    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyOverride = *.local
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-10-04 08:23
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
    @Denied: (A 2) (Everyone)
    @= "FlashBroker "
    "LocalizedString "= "@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101 "

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
    "Enabled "=dword:00000001

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
    @= "c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe "

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
    @= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
    @Denied: (A 2) (Everyone)
    @= "IFlashBroker3 "

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
    @= "{00020424-0000-0000-C000-000000000046} "

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
    @= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
    "Version "= "1.0 "
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(856)
    c:\windows\System32\BCMLogon.dll
    c:\windows\system32\csrss9.dll

    - - - - - - - > 'explorer.exe'(696)
    c:\program files\Windows Media Player\wmpband.dll
    c:\windows\system32\msi.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\IEFRAME.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files\Intel\Wireless\Bin\EvtEng.exe
    c:\program files\Intel\Wireless\Bin\S24EvMon.exe
    c:\program files\Intel\Wireless\Bin\WLKEEPER.exe
    c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\windows\ehome\ehRecvr.exe
    c:\windows\ehome\ehSched.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\program files\Intel\Wireless\Bin\RegSrvc.exe
    c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    c:\windows\ehome\mcrdsvc.exe
    c:\program files\AVG\AVG8\avgrsx.exe
    c:\progra~1\AVG\AVG8\avgnsx.exe
    c:\windows\system32\dllhost.exe
    c:\windows\system32\wscntfy.exe
    c:\windows\ehome\ehmsas.exe
    c:\program files\Apoint\hidfind.exe
    c:\program files\Apoint\ApntEx.exe
    c:\program files\Intel\Wireless\Bin\Dot1XCfg.exe
    c:\program files\iPod\bin\iPodService.exe
    c:\program files\Yahoo!\Messenger\Ymsgr_tray.exe
    .
    **************************************************************************
    .
    Completion time: 2009-10-04 8:28 - machine was rebooted
    ComboFix-quarantined-files.txt 2009-10-04 05:28

    Pre-Run: 14,823,960,576 bytes free
    Post-Run: 15,224,795,136 bytes free

    218
    ====================================
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 8:29:47 AM, on 10/4/2009
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18241)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgnsx.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\Program Files\Apoint\Apoint.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
    C:\Program Files\Apoint\HidFind.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\Program Files\Apoint\Apntex.exe
    C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\explorer.exe
    C:\Documents and Settings\Ghaleb Madhoun\My Documents\Downloads\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe "
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe "
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Ghaleb Madhoun\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
    O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1253950627795
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
    O20 - Winlogon Notify: Csrss - C:\WINDOWS\SYSTEM32\csrss9.dll
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

    --
    End of file - 8856 bytes
     
    Andy Cool,
    #3
  5. 2009/10/04
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Combofix says:
    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    Please, allow recovery console installation on next Combofix run.

    ==================================================================

    1. Please open Notepad
    • Click Start , then Run
    • Type notepad .exe in the Run Box.

    2. Now copy/paste the entire content of the codebox below into the Notepad window:

    Code:
    File::
c:\windows\system32\csrss9.dll
c:\windows\system32\ezsidmv.dat


Folder::

Driver::

Registry::
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\Csrss]


RegLockDel::

    3. Save the above as CFScript.txt

    4. Then drag the CFScript.txt into ComboFix.exe as depicted in the animation below. This will start ComboFix again.

    [​IMG]


    5. After reboot, (in case it asks to reboot), please post the following reports/logs into your next reply:
    • Combofix.txt
    • A new HijackThis log.
     
    broni,
    #4
  6. 2009/10/04
    Andy Cool

    Andy Cool Inactive Thread Starter

    Joined:
    2007/10/12
    Messages:
    208
    Likes Received:
    0
    Hey Broni,

    Thanks for the fast reply..done the requested and below are the 2 logs:

    ComboFix 09-10-01.05 - Ghaleb Madhoun 10/04/2009 8:53.2.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1256.961.1033.18.503.195 [GMT 3:00]
    Running from: c:\documents and settings\Ghaleb Madhoun\My Documents\Downloads\ComboFix.exe
    Command switches used :: c:\documents and settings\Ghaleb Madhoun\Desktop\CFScript.txt
    AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

    FILE ::
    "c:\windows\system32\csrss9.dll "
    "c:\windows\system32\ezsidmv.dat "
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\system32\csrss9.dll
    c:\windows\system32\ezsidmv.dat

    .
    ((((((((((((((((((((((((( Files Created from 2009-09-04 to 2009-10-04 )))))))))))))))))))))))))))))))
    .

    2009-10-03 06:49 . 2001-08-17 19:36 5632 ----a-w- c:\windows\system32\ptpusb.dll
    2009-10-03 06:49 . 2004-08-03 21:56 159232 ----a-w- c:\windows\system32\ptpusd.dll
    2009-10-03 06:49 . 2004-08-03 19:58 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
    2009-10-03 06:49 . 2004-08-03 19:58 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
    2009-10-03 06:31 . 2009-10-03 06:55 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Application Data\Apple Computer
    2009-10-03 06:30 . 2008-04-17 10:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll
    2009-10-03 06:30 . 2009-05-18 11:17 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
    2009-10-03 06:29 . 2009-10-03 06:29 -------- d-----w- c:\program files\iPod
    2009-10-03 06:29 . 2009-10-03 06:30 -------- d-----w- c:\program files\iTunes
    2009-10-03 06:29 . 2009-10-03 06:30 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
    2009-10-03 06:29 . 2009-10-03 06:29 -------- d-----w- c:\program files\Bonjour
    2009-10-03 06:28 . 2009-10-03 06:28 -------- d-----w- c:\program files\QuickTime
    2009-10-03 06:27 . 2009-10-03 06:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
    2009-10-03 06:27 . 2009-10-03 06:27 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Apple
    2009-10-03 06:27 . 2009-10-03 06:27 -------- d-----w- c:\program files\Apple Software Update
    2009-10-03 06:27 . 2009-08-28 16:42 40448 ----a-w- c:\windows\system32\drivers\usbaapl.sys
    2009-10-03 06:27 . 2009-08-28 16:42 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll
    2009-10-03 06:26 . 2009-10-03 06:29 -------- d-----w- c:\program files\Common Files\Apple
    2009-10-03 06:26 . 2009-10-03 06:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
    2009-10-03 06:26 . 2009-10-03 06:50 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Apple Computer
    2009-09-28 09:31 . 2009-10-03 11:20 -------- d-----w- C:\$AVG8.VAULT$
    2009-09-27 16:07 . 2009-09-27 16:07 -------- d-----w- c:\windows\Sun
    2009-09-20 18:33 . 2009-09-20 18:34 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Adobe
    2009-09-20 15:09 . 2009-10-04 02:51 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Application Data\skypePM
    2009-09-20 12:40 . 2009-09-20 12:40 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Yahoo
    2009-09-20 12:38 . 2009-09-20 14:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
    2009-09-20 12:38 . 2009-09-20 12:38 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Application Data\Yahoo!
    2009-09-20 12:35 . 2009-09-20 12:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
    2009-09-20 12:35 . 2009-09-20 12:38 -------- d-----w- c:\program files\Yahoo!
    2009-09-20 11:38 . 2009-09-20 11:38 -------- d-----w- c:\program files\Microsoft
    2009-09-20 11:01 . 2009-09-20 11:01 11952 ----a-w- c:\windows\system32\avgrsstx.dll
    2009-09-20 11:01 . 2009-09-20 11:01 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
    2009-09-20 11:01 . 2009-09-20 11:01 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
    2009-09-20 11:01 . 2009-09-20 11:01 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
    2009-09-20 11:01 . 2009-10-03 15:04 -------- d-----w- c:\windows\system32\drivers\Avg
    2009-09-20 11:00 . 2009-09-20 11:00 -------- d-----w- c:\program files\AVG
    2009-09-20 11:00 . 2009-10-04 04:59 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
    2009-09-19 12:59 . 2009-09-19 12:59 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Application Data\AVG8
    2009-09-19 12:56 . 2009-09-19 12:55 411368 ----a-w- c:\windows\system32\deploytk.dll
    2009-09-19 12:31 . 2009-10-02 17:45 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Temp
    2009-09-19 12:23 . 2009-09-19 12:46 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Google
    2009-09-19 12:21 . 2009-10-03 07:51 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Deployment

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-10-04 06:01 . 2009-08-01 23:01 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Application Data\Skype
    2009-09-21 06:20 . 2009-08-01 21:26 -------- d-----w- c:\program files\Common Files\Adobe
    2009-09-20 13:58 . 2009-08-01 21:45 -------- d-----w- c:\program files\Microsoft Silverlight
    2009-09-19 12:55 . 2009-08-01 21:28 -------- d-----w- c:\program files\Java
    2009-08-30 08:37 . 2009-08-30 08:37 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Application Data\Ahead
    2009-08-30 08:37 . 2009-08-01 20:49 42288 ----a-w- c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2009-08-30 08:34 . 2009-08-30 08:34 -------- d-----w- c:\program files\Microsoft ActiveSync
    2009-08-30 08:32 . 2009-08-30 08:32 -------- d-----w- c:\program files\Microsoft.NET
    2009-08-01 22:54 . 2009-08-01 22:54 21425 ----a-w- c:\windows\system32\drivers\AegisP.sys
    2009-08-01 21:47 . 2009-08-01 21:47 137 ----a-w- c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\fusioncache.dat
    2009-07-26 13:44 . 2009-07-26 13:44 48448 ----a-w- c:\windows\system32\sirenacm.dll
    2009-07-25 14:34 . 2009-07-25 14:34 21640 ----a-w- c:\windows\system32\emptyregdb.dat
    .

    ((((((((((((((((((((((((((((( SnapShot@2009-10-04_05.24.11 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2009-10-04 06:04 . 2009-10-04 06:04 16384 c:\windows\temp\Perflib_Perfdata_bb4.dat
    + 2009-10-04 06:03 . 2009-10-04 06:03 16384 c:\windows\temp\Perflib_Perfdata_288.dat
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Skype "= "c:\program files\Skype\Phone\Skype.exe" [2009-07-16 25607976]
    "Google Update "= "c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-09-19 133104]
    "Messenger (Yahoo!) "= "c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-05-26 4351216]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IMJPMIG8.1 "= "c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-10 208952]
    "PHIME2002ASync "= "c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
    "PHIME2002A "= "c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
    "ehTray "= "c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
    "Apoint "= "c:\program files\Apoint\Apoint.exe" [2005-10-07 176128]
    "igfxtray "= "c:\windows\system32\igfxtray.exe" [2006-06-06 94208]
    "igfxhkcmd "= "c:\windows\system32\hkcmd.exe" [2006-06-06 77824]
    "igfxpers "= "c:\windows\system32\igfxpers.exe" [2006-06-06 118784]
    "SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe" [2009-09-19 149280]
    "IntelZeroConfig "= "c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-02-21 819200]
    "IntelWireless "= "c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-02-21 970752]
    "NeroFilterCheck "= "c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
    "AVG8_TRAY "= "c:\progra~1\AVG\AVG8\avgtray.exe" [2009-10-03 2023704]
    "Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
    "QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2009-09-04 417792]
    "iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE "= "c:\windows\system32\CTFMON.EXE" [2004-08-10 15360]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
    2009-09-20 11:01 11952 ----a-w- c:\windows\system32\avgrsstx.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "UpdatesDisableNotify "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe "=
    "c:\\Program Files\\Messenger\\msmsgs.exe "=
    "c:\\Program Files\\AVG\\AVG8\\avgupd.exe "=
    "c:\\Program Files\\AVG\\AVG8\\avgnsx.exe "=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
    "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
    "c:\\Program Files\\iTunes\\iTunes.exe "=
    "c:\\Program Files\\Skype\\Phone\\Skype.exe "=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "110:TCP "= 110:TCP:svchost

    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [9/20/2009 2:01 PM 335240]
    R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [9/20/2009 2:01 PM 108552]
    R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [9/20/2009 2:00 PM 297752]
    S3 DCALEXICO;DCALEXICO;c:\windows\system32\drivers\DCalexico.sys --> c:\windows\system32\drivers\DCalexico.sys [?]
    .
    Contents of the 'Scheduled Tasks' folder

    2009-10-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1757981266-484763869-839522115-1003Core.job
    - c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-09-19 12:31]

    2009-10-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1757981266-484763869-839522115-1003UA.job
    - c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-09-19 12:31]

    2009-10-04 c:\windows\Tasks\User_Feed_Synchronization-{4D00303E-894C-433E-BF3A-F390846AFF33}.job
    - c:\windows\system32\msfeedssync.exe [2008-08-22 00:05]
    .
    .
    ------- Supplementary Scan -------
    .
    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyOverride = *.local
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-10-04 09:03
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
    @Denied: (A 2) (Everyone)
    @= "FlashBroker "
    "LocalizedString "= "@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101 "

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
    "Enabled "=dword:00000001

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
    @= "c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe "

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
    @= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
    @Denied: (A 2) (Everyone)
    @= "IFlashBroker3 "

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
    @= "{00020424-0000-0000-C000-000000000046} "

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
    @= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
    "Version "= "1.0 "
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(856)
    c:\windows\system32\sxs.dll
    c:\windows\System32\BCMLogon.dll

    - - - - - - - > 'explorer.exe'(2380)
    c:\program files\Windows Media Player\wmpband.dll
    c:\windows\system32\msi.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\IEFRAME.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\program files\Intel\Wireless\Bin\EvtEng.exe
    c:\program files\Intel\Wireless\Bin\S24EvMon.exe
    c:\program files\Intel\Wireless\Bin\WLKEEPER.exe
    c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\windows\ehome\ehRecvr.exe
    c:\windows\ehome\ehSched.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\program files\Intel\Wireless\Bin\RegSrvc.exe
    c:\program files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    c:\windows\ehome\mcrdsvc.exe
    c:\program files\AVG\AVG8\avgrsx.exe
    c:\progra~1\AVG\AVG8\avgnsx.exe
    c:\windows\system32\dllhost.exe
    c:\windows\system32\wscntfy.exe
    c:\windows\ehome\ehmsas.exe
    c:\program files\AVG\AVG8\avgtray.exe
    c:\program files\Apoint\hidfind.exe
    c:\program files\Apoint\ApntEx.exe
    c:\program files\Intel\Wireless\Bin\Dot1XCfg.exe
    c:\program files\Yahoo!\Messenger\Ymsgr_tray.exe
    c:\program files\iPod\bin\iPodService.exe
    .
    **************************************************************************
    .
    Completion time: 2009-10-04 9:08 - machine was rebooted
    ComboFix-quarantined-files.txt 2009-10-04 06:08
    ComboFix2.txt 2009-10-04 05:28

    Pre-Run: 15,231,979,520 bytes free
    Post-Run: 15,197,999,104 bytes free

    221
    ============================================

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:10:35 AM, on 10/4/2009
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18241)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgnsx.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\Program Files\Apoint\Apoint.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\Program Files\Apoint\HidFind.exe
    C:\Program Files\Apoint\Apntex.exe
    C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\explorer.exe
    C:\Documents and Settings\Ghaleb Madhoun\My Documents\Downloads\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe "
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe "
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Ghaleb Madhoun\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
    O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1253950627795
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

    --
    End of file - 8704 bytes
     
    Andy Cool,
    #5
  7. 2009/10/04
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    .....
     
    broni,
    #6
  8. 2009/10/04
    Andy Cool

    Andy Cool Inactive Thread Starter

    Joined:
    2007/10/12
    Messages:
    208
    Likes Received:
    0
    So what do I need to do now???
     
    Andy Cool,
    #7
  9. 2009/10/04
    Andy Cool

    Andy Cool Inactive Thread Starter

    Joined:
    2007/10/12
    Messages:
    208
    Likes Received:
    0
    Hi Broni,

    I re did the steps before and i'm posting the combo fix and the HJT logs again.

    ComboFix 09-10-01.05 - Ghaleb Madhoun 10/04/2009 13:05.4.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1256.961.1033.18.503.147 [GMT 3:00]
    Running from: c:\documents and settings\Ghaleb Madhoun\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\Ghaleb Madhoun\Desktop\CFScript.txt
    AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

    FILE ::
    "c:\windows\system32\csrss9.dll "
    "c:\windows\system32\ezsidmv.dat "
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\system32\ezsidmv.dat

    .
    ((((((((((((((((((((((((( Files Created from 2009-09-04 to 2009-10-04 )))))))))))))))))))))))))))))))
    .

    2009-10-03 06:49 . 2001-08-17 19:36 5632 ----a-w- c:\windows\system32\ptpusb.dll
    2009-10-03 06:49 . 2004-08-03 21:56 159232 ----a-w- c:\windows\system32\ptpusd.dll
    2009-10-03 06:49 . 2004-08-03 19:58 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
    2009-10-03 06:49 . 2004-08-03 19:58 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
    2009-10-03 06:31 . 2009-10-03 06:55 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Application Data\Apple Computer
    2009-10-03 06:30 . 2008-04-17 10:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll
    2009-10-03 06:30 . 2009-05-18 11:17 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
    2009-10-03 06:29 . 2009-10-03 06:29 -------- d-----w- c:\program files\iPod
    2009-10-03 06:29 . 2009-10-03 06:30 -------- d-----w- c:\program files\iTunes
    2009-10-03 06:29 . 2009-10-03 06:30 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
    2009-10-03 06:29 . 2009-10-03 06:29 -------- d-----w- c:\program files\Bonjour
    2009-10-03 06:28 . 2009-10-03 06:28 -------- d-----w- c:\program files\QuickTime
    2009-10-03 06:27 . 2009-10-03 06:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
    2009-10-03 06:27 . 2009-10-03 06:27 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Apple
    2009-10-03 06:27 . 2009-10-03 06:27 -------- d-----w- c:\program files\Apple Software Update
    2009-10-03 06:27 . 2009-08-28 16:42 40448 ----a-w- c:\windows\system32\drivers\usbaapl.sys
    2009-10-03 06:27 . 2009-08-28 16:42 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll
    2009-10-03 06:26 . 2009-10-03 06:29 -------- d-----w- c:\program files\Common Files\Apple
    2009-10-03 06:26 . 2009-10-03 06:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
    2009-10-03 06:26 . 2009-10-03 06:50 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Apple Computer
    2009-09-28 09:31 . 2009-10-03 11:20 -------- d-----w- C:\$AVG8.VAULT$
    2009-09-27 16:07 . 2009-09-27 16:07 -------- d-----w- c:\windows\Sun
    2009-09-20 18:33 . 2009-09-20 18:34 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Adobe
    2009-09-20 15:09 . 2009-10-04 09:30 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Application Data\skypePM
    2009-09-20 12:40 . 2009-09-20 12:40 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Yahoo
    2009-09-20 12:38 . 2009-09-20 14:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
    2009-09-20 12:38 . 2009-09-20 12:38 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Application Data\Yahoo!
    2009-09-20 12:35 . 2009-09-20 12:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
    2009-09-20 12:35 . 2009-09-20 12:38 -------- d-----w- c:\program files\Yahoo!
    2009-09-20 11:38 . 2009-09-20 11:38 -------- d-----w- c:\program files\Microsoft
    2009-09-20 11:01 . 2009-09-20 11:01 11952 ----a-w- c:\windows\system32\avgrsstx.dll
    2009-09-20 11:01 . 2009-09-20 11:01 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
    2009-09-20 11:01 . 2009-09-20 11:01 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
    2009-09-20 11:01 . 2009-09-20 11:01 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
    2009-09-20 11:01 . 2009-10-04 06:22 -------- d-----w- c:\windows\system32\drivers\Avg
    2009-09-20 11:00 . 2009-09-20 11:00 -------- d-----w- c:\program files\AVG
    2009-09-20 11:00 . 2009-10-04 04:59 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
    2009-09-19 12:59 . 2009-09-19 12:59 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Application Data\AVG8
    2009-09-19 12:56 . 2009-09-19 12:55 411368 ----a-w- c:\windows\system32\deploytk.dll
    2009-09-19 12:31 . 2009-10-02 17:45 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Temp
    2009-09-19 12:23 . 2009-09-19 12:46 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Google
    2009-09-19 12:21 . 2009-10-03 07:51 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Deployment

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-10-04 10:00 . 2009-08-01 23:01 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Application Data\Skype
    2009-09-21 06:20 . 2009-08-01 21:26 -------- d-----w- c:\program files\Common Files\Adobe
    2009-09-20 13:58 . 2009-08-01 21:45 -------- d-----w- c:\program files\Microsoft Silverlight
    2009-09-19 12:55 . 2009-08-01 21:28 -------- d-----w- c:\program files\Java
    2009-08-30 08:37 . 2009-08-30 08:37 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Application Data\Ahead
    2009-08-30 08:37 . 2009-08-01 20:49 42288 ----a-w- c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2009-08-30 08:34 . 2009-08-30 08:34 -------- d-----w- c:\program files\Microsoft ActiveSync
    2009-08-30 08:32 . 2009-08-30 08:32 -------- d-----w- c:\program files\Microsoft.NET
    2009-08-01 22:54 . 2009-08-01 22:54 21425 ----a-w- c:\windows\system32\drivers\AegisP.sys
    2009-08-01 21:47 . 2009-08-01 21:47 137 ----a-w- c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\fusioncache.dat
    2009-07-26 13:44 . 2009-07-26 13:44 48448 ----a-w- c:\windows\system32\sirenacm.dll
    2009-07-25 14:34 . 2009-07-25 14:34 21640 ----a-w- c:\windows\system32\emptyregdb.dat
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Skype "= "c:\program files\Skype\Phone\Skype.exe" [2009-07-16 25607976]
    "Google Update "= "c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-09-19 133104]
    "Messenger (Yahoo!) "= "c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-05-26 4351216]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IMJPMIG8.1 "= "c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-10 208952]
    "PHIME2002ASync "= "c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
    "PHIME2002A "= "c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
    "ehTray "= "c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
    "Apoint "= "c:\program files\Apoint\Apoint.exe" [2005-10-07 176128]
    "igfxtray "= "c:\windows\system32\igfxtray.exe" [2006-06-06 94208]
    "igfxhkcmd "= "c:\windows\system32\hkcmd.exe" [2006-06-06 77824]
    "igfxpers "= "c:\windows\system32\igfxpers.exe" [2006-06-06 118784]
    "SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe" [2009-09-19 149280]
    "IntelZeroConfig "= "c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-02-21 819200]
    "IntelWireless "= "c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-02-21 970752]
    "NeroFilterCheck "= "c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
    "AVG8_TRAY "= "c:\progra~1\AVG\AVG8\avgtray.exe" [2009-10-03 2023704]
    "Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
    "QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2009-09-04 417792]
    "iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE "= "c:\windows\system32\CTFMON.EXE" [2004-08-10 15360]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
    2009-09-20 11:01 11952 ----a-w- c:\windows\system32\avgrsstx.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "UpdatesDisableNotify "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe "=
    "c:\\Program Files\\Messenger\\msmsgs.exe "=
    "c:\\Program Files\\AVG\\AVG8\\avgupd.exe "=
    "c:\\Program Files\\AVG\\AVG8\\avgnsx.exe "=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
    "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
    "c:\\Program Files\\iTunes\\iTunes.exe "=
    "c:\\Program Files\\Skype\\Phone\\Skype.exe "=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "110:TCP "= 110:TCP:svchost

    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [9/20/2009 2:01 PM 335240]
    R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [9/20/2009 2:01 PM 108552]
    R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [9/20/2009 2:00 PM 297752]
    S3 DCALEXICO;DCALEXICO;c:\windows\system32\drivers\DCalexico.sys --> c:\windows\system32\drivers\DCalexico.sys [?]
    .
    Contents of the 'Scheduled Tasks' folder

    2009-10-03 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1757981266-484763869-839522115-1003Core.job
    - c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-09-19 12:31]

    2009-10-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1757981266-484763869-839522115-1003UA.job
    - c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-09-19 12:31]

    2009-10-04 c:\windows\Tasks\User_Feed_Synchronization-{4D00303E-894C-433E-BF3A-F390846AFF33}.job
    - c:\windows\system32\msfeedssync.exe [2008-08-22 00:05]
    .
    .
    ------- Supplementary Scan -------
    .
    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyOverride = *.local
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-10-04 13:13
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
    @Denied: (A 2) (Everyone)
    @= "FlashBroker "
    "LocalizedString "= "@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101 "

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
    "Enabled "=dword:00000001

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
    @= "c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe "

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
    @= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
    @Denied: (A 2) (Everyone)
    @= "IFlashBroker3 "

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
    @= "{00020424-0000-0000-C000-000000000046} "

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
    @= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
    "Version "= "1.0 "
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(860)
    c:\windows\System32\BCMLogon.dll
    .
    Completion time: 2009-10-04 13:16
    ComboFix-quarantined-files.txt 2009-10-04 10:16
    ComboFix2.txt 2009-10-04 06:08
    ComboFix3.txt 2009-10-04 05:28

    Pre-Run: 15,148,208,128 bytes free
    Post-Run: 15,116,451,840 bytes free

    180

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 4:40:27 PM, on 10/4/2009
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18241)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgnsx.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\Program Files\Apoint\Apoint.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\Program Files\Apoint\HidFind.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Apoint\Apntex.exe
    C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\explorer.exe
    C:\Documents and Settings\Ghaleb Madhoun\My Documents\Downloads\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe "
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe "
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Ghaleb Madhoun\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
    O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1253950627795
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

    --
    End of file - 8685 bytes
     
    Andy Cool,
    #8
  10. 2009/10/04
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Recovery Console

    With malware infections being as they are today, it's strongly recommended to have the Windows Recovery Console pre-installed on your machine before doing any malware removal.

    The Windows Recovery Console will allow you to boot up into a special recovery (repair) mode. This allows us to more easily help you should your computer have a problem after an attempted removal of malware. It is a simple procedure that will only take a few moments of your time.


    Go to Microsoft's website => http://support.microsoft.com/kb/310994

    Select the download that's appropriate for your Operating System

    [​IMG]


    Download the file & save it as it's originally named.


    ---------------------------------------------------------------------

    Transfer all files you just downloaded, to the desktop of the infected computer.

    --------------------------------------------------------------------


    Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools

    [​IMG]


    • Drag the setup package onto ComboFix.exe and drop it.

    • Follow the prompts to start ComboFix and when prompted, agree to the End-User License Agreement to install the Microsoft Recovery Console.


      [​IMG]


    • At the next prompt, click 'Yes' to run the full ComboFix scan.

    • When the tool is finished, it will produce a report for you.
    Please post the C:\ComboFix.txt, and fresh HijackThis log in your next reply.
     
    broni,
    #9
  11. 2009/10/04
    Andy Cool

    Andy Cool Inactive Thread Starter

    Joined:
    2007/10/12
    Messages:
    208
    Likes Received:
    0
    Hi Broni,

    Thanks a lot for your help..I did the requested and below are 2 fresh logs

    ComboFix 09-10-04.01 - Ghaleb Madhoun 10/04/2009 20:14.5.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1256.961.1033.18.503.335 [GMT 3:00]
    Running from: c:\documents and settings\Ghaleb Madhoun\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\Ghaleb Madhoun\Desktop\WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
    AV: AVG Anti-Virus Free *On-access scanning disabled* (Updated) {17DDD097-36FF-435F-9E1B-52D74245D6BF}
    .

    ((((((((((((((((((((((((( Files Created from 2009-09-04 to 2009-10-04 )))))))))))))))))))))))))))))))
    .

    2009-10-04 14:55 . 2009-10-04 14:55 56 ---ha-w- c:\windows\system32\ezsidmv.dat
    2009-10-03 06:49 . 2001-08-17 19:36 5632 ----a-w- c:\windows\system32\ptpusb.dll
    2009-10-03 06:49 . 2004-08-03 21:56 159232 ----a-w- c:\windows\system32\ptpusd.dll
    2009-10-03 06:49 . 2004-08-03 19:58 15104 -c--a-w- c:\windows\system32\dllcache\usbscan.sys
    2009-10-03 06:49 . 2004-08-03 19:58 15104 ----a-w- c:\windows\system32\drivers\usbscan.sys
    2009-10-03 06:31 . 2009-10-03 06:55 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Application Data\Apple Computer
    2009-10-03 06:30 . 2008-04-17 10:12 107368 ----a-w- c:\windows\system32\GEARAspi.dll
    2009-10-03 06:30 . 2009-05-18 11:17 26600 ----a-w- c:\windows\system32\drivers\GEARAspiWDM.sys
    2009-10-03 06:29 . 2009-10-03 06:29 -------- d-----w- c:\program files\iPod
    2009-10-03 06:29 . 2009-10-03 06:30 -------- d-----w- c:\program files\iTunes
    2009-10-03 06:29 . 2009-10-03 06:30 -------- d-----w- c:\documents and settings\All Users\Application Data\{755AC846-7372-4AC8-8550-C52491DAA8BD}
    2009-10-03 06:29 . 2009-10-03 06:29 -------- d-----w- c:\program files\Bonjour
    2009-10-03 06:28 . 2009-10-03 06:28 -------- d-----w- c:\program files\QuickTime
    2009-10-03 06:27 . 2009-10-03 06:29 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple Computer
    2009-10-03 06:27 . 2009-10-03 06:27 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Apple
    2009-10-03 06:27 . 2009-10-03 06:27 -------- d-----w- c:\program files\Apple Software Update
    2009-10-03 06:27 . 2009-08-28 16:42 40448 ----a-w- c:\windows\system32\drivers\usbaapl.sys
    2009-10-03 06:27 . 2009-08-28 16:42 2065696 ----a-w- c:\windows\system32\usbaaplrc.dll
    2009-10-03 06:26 . 2009-10-03 06:29 -------- d-----w- c:\program files\Common Files\Apple
    2009-10-03 06:26 . 2009-10-03 06:49 -------- d-----w- c:\documents and settings\All Users\Application Data\Apple
    2009-10-03 06:26 . 2009-10-03 06:50 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Apple Computer
    2009-09-28 09:31 . 2009-10-03 11:20 -------- d-----w- C:\$AVG8.VAULT$
    2009-09-27 16:07 . 2009-09-27 16:07 -------- d-----w- c:\windows\Sun
    2009-09-20 18:33 . 2009-09-20 18:34 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Adobe
    2009-09-20 15:09 . 2009-10-04 14:55 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Application Data\skypePM
    2009-09-20 12:40 . 2009-09-20 12:40 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Yahoo
    2009-09-20 12:38 . 2009-09-20 14:06 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo! Companion
    2009-09-20 12:38 . 2009-09-20 12:38 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Application Data\Yahoo!
    2009-09-20 12:35 . 2009-09-20 12:39 -------- d-----w- c:\documents and settings\All Users\Application Data\Yahoo!
    2009-09-20 12:35 . 2009-09-20 12:38 -------- d-----w- c:\program files\Yahoo!
    2009-09-20 11:38 . 2009-09-20 11:38 -------- d-----w- c:\program files\Microsoft
    2009-09-20 11:01 . 2009-09-20 11:01 11952 ----a-w- c:\windows\system32\avgrsstx.dll
    2009-09-20 11:01 . 2009-09-20 11:01 108552 ----a-w- c:\windows\system32\drivers\avgtdix.sys
    2009-09-20 11:01 . 2009-09-20 11:01 335240 ----a-w- c:\windows\system32\drivers\avgldx86.sys
    2009-09-20 11:01 . 2009-09-20 11:01 27784 ----a-w- c:\windows\system32\drivers\avgmfx86.sys
    2009-09-20 11:01 . 2009-10-04 15:49 -------- d-----w- c:\windows\system32\drivers\Avg
    2009-09-20 11:00 . 2009-09-20 11:00 -------- d-----w- c:\program files\AVG
    2009-09-20 11:00 . 2009-10-04 04:59 -------- d-----w- c:\documents and settings\All Users\Application Data\avg8
    2009-09-19 12:59 . 2009-09-19 12:59 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Application Data\AVG8
    2009-09-19 12:56 . 2009-09-19 12:55 411368 ----a-w- c:\windows\system32\deploytk.dll
    2009-09-19 12:31 . 2009-10-02 17:45 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Temp
    2009-09-19 12:23 . 2009-09-19 12:46 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Google
    2009-09-19 12:21 . 2009-10-03 07:51 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Deployment

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-10-04 16:39 . 2009-08-01 23:01 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Application Data\Skype
    2009-09-21 06:20 . 2009-08-01 21:26 -------- d-----w- c:\program files\Common Files\Adobe
    2009-09-20 13:58 . 2009-08-01 21:45 -------- d-----w- c:\program files\Microsoft Silverlight
    2009-09-19 12:55 . 2009-08-01 21:28 -------- d-----w- c:\program files\Java
    2009-08-30 08:37 . 2009-08-30 08:37 -------- d-----w- c:\documents and settings\Ghaleb Madhoun\Application Data\Ahead
    2009-08-30 08:37 . 2009-08-01 20:49 42288 ----a-w- c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\GDIPFONTCACHEV1.DAT
    2009-08-30 08:34 . 2009-08-30 08:34 -------- d-----w- c:\program files\Microsoft ActiveSync
    2009-08-30 08:32 . 2009-08-30 08:32 -------- d-----w- c:\program files\Microsoft.NET
    2009-08-01 22:54 . 2009-08-01 22:54 21425 ----a-w- c:\windows\system32\drivers\AegisP.sys
    2009-08-01 21:47 . 2009-08-01 21:47 137 ----a-w- c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\fusioncache.dat
    2009-07-26 13:44 . 2009-07-26 13:44 48448 ----a-w- c:\windows\system32\sirenacm.dll
    2009-07-25 14:34 . 2009-07-25 14:34 21640 ----a-w- c:\windows\system32\emptyregdb.dat
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Skype "= "c:\program files\Skype\Phone\Skype.exe" [2009-07-16 25607976]
    "Google Update "= "c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" [2009-09-19 133104]
    "Messenger (Yahoo!) "= "c:\program files\Yahoo!\Messenger\YahooMessenger.exe" [2009-05-26 4351216]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "IMJPMIG8.1 "= "c:\windows\IME\imjp8_1\IMJPMIG.EXE" [2004-08-10 208952]
    "PHIME2002ASync "= "c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
    "PHIME2002A "= "c:\windows\system32\IME\TINTLGNT\TINTSETP.EXE" [2004-08-10 455168]
    "ehTray "= "c:\windows\ehome\ehtray.exe" [2005-08-05 64512]
    "Apoint "= "c:\program files\Apoint\Apoint.exe" [2005-10-07 176128]
    "igfxtray "= "c:\windows\system32\igfxtray.exe" [2006-06-06 94208]
    "igfxhkcmd "= "c:\windows\system32\hkcmd.exe" [2006-06-06 77824]
    "igfxpers "= "c:\windows\system32\igfxpers.exe" [2006-06-06 118784]
    "SunJavaUpdateSched "= "c:\program files\Java\jre6\bin\jusched.exe" [2009-09-19 149280]
    "IntelZeroConfig "= "c:\program files\Intel\Wireless\bin\ZCfgSvc.exe" [2007-02-21 819200]
    "IntelWireless "= "c:\program files\Intel\Wireless\Bin\ifrmewrk.exe" [2007-02-21 970752]
    "NeroFilterCheck "= "c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
    "AVG8_TRAY "= "c:\progra~1\AVG\AVG8\avgtray.exe" [2009-10-03 2023704]
    "Adobe Reader Speed Launcher "= "c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2009-02-27 35696]
    "QuickTime Task "= "c:\program files\QuickTime\QTTask.exe" [2009-09-04 417792]
    "iTunesHelper "= "c:\program files\iTunes\iTunesHelper.exe" [2009-09-21 305440]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE "= "c:\windows\system32\CTFMON.EXE" [2004-08-10 15360]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\avgrsstarter]
    2009-09-20 11:01 11952 ----a-w- c:\windows\system32\avgrsstx.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "UpdatesDisableNotify "=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "c:\\Program Files\\Windows Live\\Messenger\\wlcsdk.exe "=
    "c:\\Program Files\\Messenger\\msmsgs.exe "=
    "c:\\Program Files\\AVG\\AVG8\\avgupd.exe "=
    "c:\\Program Files\\AVG\\AVG8\\avgnsx.exe "=
    "c:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
    "c:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe "=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe "=
    "c:\\Program Files\\iTunes\\iTunes.exe "=
    "c:\\Program Files\\Skype\\Phone\\Skype.exe "=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "110:TCP "= 110:TCP:svchost

    R1 AvgLdx86;AVG Free AVI Loader Driver x86;c:\windows\system32\drivers\avgldx86.sys [9/20/2009 2:01 PM 335240]
    R1 AvgTdiX;AVG Free8 Network Redirector;c:\windows\system32\drivers\avgtdix.sys [9/20/2009 2:01 PM 108552]
    R2 avg8wd;AVG Free8 WatchDog;c:\progra~1\AVG\AVG8\avgwdsvc.exe [9/20/2009 2:00 PM 297752]
    S3 DCALEXICO;DCALEXICO;c:\windows\system32\drivers\DCalexico.sys --> c:\windows\system32\drivers\DCalexico.sys [?]
    .
    Contents of the 'Scheduled Tasks' folder

    2009-10-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1757981266-484763869-839522115-1003Core.job
    - c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-09-19 12:31]

    2009-10-04 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-1757981266-484763869-839522115-1003UA.job
    - c:\documents and settings\Ghaleb Madhoun\Local Settings\Application Data\Google\Update\GoogleUpdate.exe [2009-09-19 12:31]

    2009-10-04 c:\windows\Tasks\User_Feed_Synchronization-{4D00303E-894C-433E-BF3A-F390846AFF33}.job
    - c:\windows\system32\msfeedssync.exe [2008-08-22 00:05]
    .
    .
    ------- Supplementary Scan -------
    .
    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyOverride = *.local
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-10-04 20:22
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
    @Denied: (A 2) (Everyone)
    @= "FlashBroker "
    "LocalizedString "= "@c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101 "

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
    "Enabled "=dword:00000001

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
    @= "c:\\WINDOWS\\system32\\Macromed\\Flash\\FlashUtil10c.exe "

    [HKEY_LOCAL_MACHINE\software\Classes\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
    @= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
    @Denied: (A 2) (Everyone)
    @= "IFlashBroker3 "

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
    @= "{00020424-0000-0000-C000-000000000046} "

    [HKEY_LOCAL_MACHINE\software\Classes\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
    @= "{FAB3E735-69C7-453B-A446-B6823C6DF1C9} "
    "Version "= "1.0 "
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'winlogon.exe'(860)
    c:\windows\System32\BCMLogon.dll

    - - - - - - - > 'explorer.exe'(1916)
    c:\program files\Windows Media Player\wmpband.dll
    c:\windows\system32\msi.dll
    c:\windows\system32\ieframe.dll
    c:\windows\system32\webcheck.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    Completion time: 2009-10-04 20:25
    ComboFix-quarantined-files.txt 2009-10-04 17:25
    ComboFix2.txt 2009-10-04 10:16
    ComboFix3.txt 2009-10-04 06:08
    ComboFix4.txt 2009-10-04 05:28

    Pre-Run: 15,104,323,584 bytes free
    Post-Run: 15,098,195,968 bytes free

    WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT= "Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS= "Windows XP Media Center Edition" /noexecute=optin /fastdetect

    189
    =========================================

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 8:25:47 PM, on 10/4/2009
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18241)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgnsx.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\Program Files\Apoint\Apoint.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Apoint\HidFind.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Apoint\Apntex.exe
    C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\explorer.exe
    C:\Documents and Settings\Ghaleb Madhoun\My Documents\Downloads\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe "
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe "
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Ghaleb Madhoun\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
    O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1253950627795
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

    --
    End of file - 8611 bytes
     
    Andy Cool,
    #10
  12. 2009/10/04
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Excellent :)

    Download Dr.Web CureIt to the desktop:
    ftp://ftp.drweb.com/pub/drweb/cureit/drweb-cureit.exe
    • Doubleclick the drweb-cureit.exe file and click Scan to run express scan. Click OK in pop-up window to allow scan.
    • This will scan the files currently running in memory and when something is found, click the Yes button when it asks you if you want to cure it. This is only a short scan.
    • Once the short scan has finished, select Complete scan.
    • Click the green arrow [​IMG] at the right, and the scan will start.
    • Click Yes to all if it asks if you want to cure/move the file.
    • When the scan has finished, in the menu, click File and choose Save report list
    • Save the report to your desktop. The report will be called DrWeb.csv
    • Close Dr.Web Cureit.
    • Important! Reboot your computer because it could be possible that files in use will be moved/deleted during reboot.
    • Copy and paste that log in the next reply. You can use Notepad to open the DrWeb.cvs report.

    NOTE. During the scan, pop-up window will open asking for full version purchase. Simply close the window by clicking on X in upper right corner.


    Post fresh HijackThis log as well.
     
    broni,
    #11
  13. 2009/10/04
    Andy Cool

    Andy Cool Inactive Thread Starter

    Joined:
    2007/10/12
    Messages:
    208
    Likes Received:
    0
    Hi Broni,
    The ftp is not working..i downloaded the file from the website but i am unable to install it...it gives an error message..
    Appreciate your help
     
    Andy Cool,
    #12
  14. 2009/10/04
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    ...and the error is?
     
    broni,
    #13
  15. 2009/10/04
    Andy Cool

    Andy Cool Inactive Thread Starter

    Joined:
    2007/10/12
    Messages:
    208
    Likes Received:
    0
    can't install to the selected folder or something like that..i change the folder and same issue...
    Sorry forgot the exact message..
    Shall I download it again and try???
     
    Andy Cool,
    #14
  16. 2009/10/04
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    No.

    Download, and install AVP Tool.
    After installation, leave all settings as they're, and simply click on Scan button.
    When scan is done, and any objects are found, click on Neutralize all button.
    Next, click Reports... button, then Save to file....
    Save the file to know location as report.txt.
    Open report.txt in Notepad, copy all content, and post it in your next reply.

    Post fresh HJT log as well.
     
    broni,
    #15
  17. 2009/10/04
    Andy Cool

    Andy Cool Inactive Thread Starter

    Joined:
    2007/10/12
    Messages:
    208
    Likes Received:
    0
    Hi Broni,

    Thanks for your time and help...below are the kaspersky and HJT logs.
    I think i'm clean now..

    Scan
    ----
    Scanned: 5225
    Detected: 0
    Untreated: 0
    Start time: 10/4/2009 10:51:38 PM
    Duration: 00:06:46
    Finish time: 10/4/2009 10:58:24 PM


    Detected
    --------
    Status,Object
    -------------


    Events
    ------
    Time,Name,Status,Reason
    -----------------------
    10/4/2009 10:52:05 PM,Running module: smss.exe\smss.exe,ok,scanned
    10/4/2009 10:52:06 PM,File: C:\WINDOWS\System32\smss.exe,ok,scanned
    10/4/2009 10:52:06 PM,Running module: smss.exe\ntdll.dll,ok,scanned
    10/4/2009 10:52:07 PM,File: C:\WINDOWS\system32\ntdll.dll,ok,scanned
    10/4/2009 10:52:07 PM,Running module: csrss.exe\csrss.exe,ok,scanned
    10/4/2009 10:52:07 PM,File: C:\WINDOWS\system32\csrss.exe,ok,scanned
    10/4/2009 10:52:07 PM,Running module: csrss.exe\ntdll.dll,ok,scanned
    10/4/2009 10:52:07 PM,File: C:\WINDOWS\system32\ntdll.dll,ok,scanned
    10/4/2009 10:52:07 PM,Running module: csrss.exe\CSRSRV.dll,ok,scanned
    10/4/2009 10:52:07 PM,File: C:\WINDOWS\system32\CSRSRV.dll,ok,scanned
    10/4/2009 10:52:07 PM,Running module: csrss.exe\basesrv.dll,ok,scanned
    10/4/2009 10:52:07 PM,File: C:\WINDOWS\system32\basesrv.dll,ok,scanned
    10/4/2009 10:52:07 PM,Running module: csrss.exe\winsrv.dll,ok,scanned
    10/4/2009 10:52:07 PM,File: C:\WINDOWS\system32\winsrv.dll,ok,scanned
    10/4/2009 10:52:07 PM,Running module: csrss.exe\USER32.dll,ok,scanned
    10/4/2009 10:52:07 PM,File: C:\WINDOWS\system32\USER32.dll,ok,scanned
    10/4/2009 10:52:07 PM,Running module: csrss.exe\KERNEL32.dll,ok,scanned
    10/4/2009 10:52:08 PM,File: C:\WINDOWS\system32\KERNEL32.dll,ok,scanned
    10/4/2009 10:52:08 PM,Running module: csrss.exe\GDI32.dll,ok,scanned
    10/4/2009 10:52:08 PM,File: C:\WINDOWS\system32\GDI32.dll,ok,scanned
    10/4/2009 10:52:08 PM,Running module: csrss.exe\LPK.DLL,ok,scanned


    Statistics
    ----------
    Object,Scanned,Detected,Untreated,Deleted,Moved to Quarantine,Archives,Packed files,Password protected,Corrupted
    ----------------------------------------------------------------------------------------------------------------


    Settings
    --------
    Parameter,Value
    ---------------
    Security Level,Recommended
    Action,Prompt for action when the scan is complete
    Run mode,Manually
    File types,Scan all files
    Scan only new and changed files,No
    Scan archives,All
    Scan embedded OLE objects,All
    Skip if object is larger than,No
    Skip if scan takes longer than,No
    Parse email formats,No
    Scan password-protected archives,No
    Enable iChecker technology,No
    Enable iSwift technology,No
    Show detected threats on "Detected" tab,Yes
    Rootkits search,Yes
    Deep rootkits search,No
    Use heuristic analyzer,Yes


    Quarantine
    ----------
    Status,Object,Size,Added
    ------------------------


    Backup
    ------
    Status,Object,Size
    ------------------


    =====================================================

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:00:20 PM, on 10/4/2009
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18241)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgnsx.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\Program Files\Apoint\Apoint.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\WINDOWS\system32\igfxpers.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Apoint\HidFind.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Apoint\Apntex.exe
    C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
    C:\Documents and Settings\Ghaleb Madhoun\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\Documents and Settings\Ghaleb Madhoun\Local Settings\Application Data\Google\Chrome\Application\chrome.exe
    C:\Program Files\Windows NT\Accessories\WORDPAD.EXE
    C:\Documents and Settings\Ghaleb Madhoun\My Documents\Downloads\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
    O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe "
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe "
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Ghaleb Madhoun\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
    O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - Startup: is-8UHL2.lnk = C:\Documents and Settings\Ghaleb Madhoun\Desktop\Virus Removal Tool\is-8UHL2\startup.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1253950627795
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

    --
    End of file - 9006 bytes
     
    Andy Cool,
    #16
  18. 2009/10/04
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Print this post out, since you won't have an access to it, at some point.

    1. Open HijackThis.

    2. Close all windows, except for HijackThis.

    3. Put checkmarks next to the following HijackThis entries:

    - O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    - O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
    - O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')


    4. You should also checkmark following entries (these are unnecessary startups; no actual programs will be removed):

    - O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
    - O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
    - O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
    - O4 - HKLM\..\Run: [igfxtray] C:\WINDOWS\system32\igfxtray.exe
    - O4 - HKLM\..\Run: [igfxpers] C:\WINDOWS\system32\igfxpers.exe
    - O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe "
    - O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    - O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe "
    - O4 - HKCU\..\Run: [Google Update] "C:\Documents and Settings\Ghaleb Madhoun\Local Settings\Application Data\Google\Update\GoogleUpdate.exe" /c
    - O4 - HKCU\..\Run: [Messenger (Yahoo!)] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
    - O4 - Startup: is-8UHL2.lnk = C:\Documents and Settings\Ghaleb Madhoun\Desktop\Virus Removal Tool\is-8UHL2\startup.exe


    5. Click on Fix checked button.

    6. Restart computer.

    7. Post new HijackThis log.
     
    broni,
    #17
  19. 2009/10/07
    Andy Cool

    Andy Cool Inactive Thread Starter

    Joined:
    2007/10/12
    Messages:
    208
    Likes Received:
    0
    Hi Broni,

    Apologies for delay in reply as I was out of town. Below is the new HJT log hope i'm clean now.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:32:19 AM, on 10/8/2009
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v8.00 (8.00.6001.18241)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\eHome\ehRecvr.exe
    C:\WINDOWS\eHome\ehSched.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe
    C:\PROGRA~1\AVG\AVG8\avgrsx.exe
    C:\PROGRA~1\AVG\AVG8\avgnsx.exe
    C:\WINDOWS\system32\dllhost.exe
    C:\WINDOWS\ehome\ehtray.exe
    C:\Program Files\Apoint\Apoint.exe
    C:\WINDOWS\system32\hkcmd.exe
    C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
    C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
    C:\PROGRA~1\AVG\AVG8\avgtray.exe
    C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe
    C:\Program Files\Skype\Phone\Skype.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\eHome\ehmsas.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Apoint\HidFind.exe
    C:\Program Files\Apoint\Apntex.exe
    C:\Program Files\Intel\Wireless\Bin\Dot1XCfg.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Documents and Settings\Ghaleb Madhoun\My Documents\Downloads\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: &Yahoo! Toolbar Helper - {02478D38-C3F9-4efb-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
    O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O2 - BHO: WormRadar.com IESiteBlocker.NavFilter - {3CA2F312-6F6E-4B53-A66E-4E65E497C8C0} - C:\Program Files\AVG\AVG8\avgssie.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O2 - BHO: SingleInstance Class - {FDAD4DA1-61A2-4FD8-9C17-86F7AC245081} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\YTSingleInstance.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
    O4 - HKLM\..\Run: [igfxhkcmd] C:\WINDOWS\system32\hkcmd.exe
    O4 - HKLM\..\Run: [IntelZeroConfig] "C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe "
    O4 - HKLM\..\Run: [IntelWireless] "C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" /tf Intel PROSet/Wireless
    O4 - HKLM\..\Run: [AVG8_TRAY] C:\PROGRA~1\AVG\AVG8\avgtray.exe
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe "
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra 'Tools' menuitem: Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1253950627795
    O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - http://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
    O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program Files\AVG\AVG8\avgpp.dll
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O20 - Winlogon Notify: avgrsstarter - C:\WINDOWS\SYSTEM32\avgrsstx.dll
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: AVG Free8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\PROGRA~1\AVG\AVG8\avgwdsvc.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
    O23 - Service: Intel(R) PROSet/Wireless Service (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
    O23 - Service: Intel(R) PROSet/Wireless SSO Service (WLANKEEPER) - Intel(R) Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
    O23 - Service: Yahoo! Updater (YahooAUService) - Yahoo! Inc. - C:\Program Files\Yahoo!\SoftwareUpdate\YahooAUService.exe

    --
    End of file - 7520 bytes
     
    Andy Cool,
    #18
  20. 2009/10/07
    broni

    broni Moderator Malware Analyst

    Joined:
    2002/08/01
    Messages:
    21,701
    Likes Received:
    116
    Your computer is clean :)

    1. Download Temp File Cleaner (TFC)
    Double click on TFC.exe to run the program.
    Click on Start button to begin cleaning process.
    TFC will close all running programs, and it may ask you to restart computer.

    2. Turn off System Restore:

    - Windows XP:
    1. Click Start.
    2. Right-click the My Computer icon, and then click Properties.
    3. Click the System Restore tab.
    4. Check "Turn off System Restore ".
    5. Click Apply.
    6. When turning off System Restore, the existing restore points will be deleted. Click Yes to do this.
    7. Click OK.
    - Windows Vista:
    1. Click Start.
    2. Right-click the Computer icon, and then click Properties.
    3. Click on System Protection under the Tasks column on the left side
    4. Click on Continue on the "User Account Control" window that pops up
    5. Under the System Protection tab, find Available Disks
    6. Uncheck the box for any drive you wish to disable system restore on (in most cases, drive "C: ")
    7. When turning off System Restore, the existing restore points will be deleted. Click "Turn System Restore Off" on the popup window to do this.
    8. Click OK

    3. Restart computer.

    4. Turn System Restore on.

    5. Make sure, Windows Updates are current.

    [SIZE= "4"]6. If any Trojan was listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately![/SIZE]

    7. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

    8. Run defrag at your convenience.

    9. Read How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html

    10. Please, let me know, how is your computer doing.
     
    broni,
    #19
  21. 2009/10/08
    Andy Cool

    Andy Cool Inactive Thread Starter

    Joined:
    2007/10/12
    Messages:
    208
    Likes Received:
    0
    Hi Broni,

    I did all the above steps and my PC is Trojan/Virus Free....Thanks a lot for your help :) I really appreciate it...

    Please close this subject as resolved.

    Again thanks and regards..
     
    Andy Cool,
    #20
Page 1 of 2

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...