Solved Need some help for my son's PC

[Resolved]Need some help for my son's PC

My son has somehow managed to get his PC infected. I've run Spybot, Malwarebytes Antimalware and Avir Antivirus and they've all cleaned up a bunch of stuff. I'm posting the HJT log to see if there's anything the others have missed. It seems to be a lot better than it was when I first started on it, I could only get it to boot into Safe Mode, it was freezing solid right after the desktop loaded.

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:31:52 PM, on 7/26/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTHELPER.EXE
E:\Program Files\LogMeIn\x86\LogMeInSystray.exe
E:\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Skype\Phone\bak\Skype.exe
C:\program files\steam\steam.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Xfire\xfire.exe
C:\Program Files\Common Files\AOL\Loader\aolload.exe
E:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\WINDOWS\system32\$sys$filesystem\$sys$DRMServer.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\CDProxyServ.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\hjt\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O3 - Toolbar: fdkowvbp - {D0B319CC-BD7D-4AD1-AFD0-0AEA47E33831} - C:\WINDOWS\fdkowvbp.dll (file missing)
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [NapsterShell] C:\Program Files\Napster\napster.exe /systray
O4 - HKLM\..\Run: [LogMeIn GUI] "E:\Program Files\LogMeIn\x86\LogMeInSystray.exe "
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "E:\iTunes\iTunesHelper.exe "
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe "
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\bak\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe "
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O15 - Trusted Zone: *.doginhispen.com
O15 - Trusted Zone: *.whataboutadog.com
O15 - Trusted Zone: *.whataboutarabit.com
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS2\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O20 - AppInit_DLLs:
O23 - Service: Plug and Play Device Manager ($sys$DRMServer) - First 4 Internet Ltd - C:\WINDOWS\system32\$sys$filesystem\$sys$DRMServer.exe
O23 - Service: Avira AntiVir Personal "“ Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal "“ Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: XCP CD Proxy (CD_Proxy) - Unknown owner - C:\WINDOWS\CDProxyServ.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O24 - Desktop Component 0: Privacy Protection - (no file)

--
End of file - 7812 bytes

 

Hi Bill
Looks like there may still be some baddies on there.

Please do this.

Please re-open HiJackThis and scan only. Check the boxes next to all the entries listed below.

O3 - Toolbar: fdkowvbp - {D0B319CC-BD7D-4AD1-AFD0-0AEA47E33831} - C:\WINDOWS\fdkowvbp.dll (file missing)
O15 - Trusted Zone: *.doginhispen.com
O15 - Trusted Zone: *.whataboutadog.com
O15 - Trusted Zone: *.whataboutarabit.com
O24 - Desktop Component 0: Privacy Protection - (no file)

Now close all windows other than HiJackThis, then click Fix Checked.

Close HJT.

Now run Combofix.

Download ComboFix from Here to your Desktop.

It's best to disable realtime protection applications as they sometimes interfere with the tool.
Check this link for any applicable programs you may have.

• Close all open programs and windows
• Double click combofix.exe and follow the prompts.
• Vista users right click Combofix.exe and select Run As Administrator.
• When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply

Note: Do not mouseclick combofix's window while its running. That may cause it to stall

Note - ComboFix may reset a number of Internet Explorer's settings, including making it the default browser.

Note - Combofix makes some changes when run to prevent autorun/autoplay of ALL CDs, floppies and USB devices, to assist with malware removal & increase security. If this is an issue or makes it difficult for you to use those devices, please ask how to reset it.

Thanks
Geri

 

Hi Geri,

Here are the new logs;

ComboFix 08-07-26.1 - Alex 2008-07-26 16:22:54.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1629 [GMT -4:00]
Running from: C:\Documents and Settings\Alex\Desktop\ComboFix.exe
* Created a new restore point

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\Alex\Application Data\macromedia\Flash Player\#SharedObjects\ZXPYQ5ER\interclick.com
C:\Documents and Settings\Alex\Application Data\macromedia\Flash Player\#SharedObjects\ZXPYQ5ER\interclick.com\ud.sol
C:\Documents and Settings\Alex\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com
C:\Documents and Settings\Alex\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#interclick.com\settings.sol
C:\WINDOWS\system32\_000008_.tmp.dll

.
((((((((((((((((((((((((( Files Created from 2008-06-26 to 2008-07-26 )))))))))))))))))))))))))))))))
.

2008-07-26 10:15 . 2008-07-23 20:09 38,472 --a------ C:\WINDOWS\system32\drivers\mbamswissarmy.sys
2008-07-26 10:13 . 2008-07-26 10:14 135 --a------ C:\WINDOWS\wininit.ini
2008-07-23 14:35 . 2008-07-23 14:35 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ESET
2008-07-23 14:25 . 2008-07-23 14:25 <DIR> d-------- C:\Program Files\uTorrent
2008-07-23 14:25 . 2008-07-23 17:06 <DIR> d-------- C:\Documents and Settings\Alex\Application Data\uTorrent
2008-07-15 19:09 . 2008-07-15 19:09 42,320 --a------ C:\WINDOWS\system32\xfcodec.dll
2008-07-09 18:50 . 1998-05-29 09:51 274,432 --a------ C:\WINDOWS\system32\VCT32150.dll
2008-07-09 18:50 . 1997-09-03 16:58 195,584 --a------ C:\WINDOWS\system32\MVoice.vxp
2008-07-08 22:16 . 2006-05-24 19:58 87,600 --a------ C:\Can You Do The Matrix.vtf
2008-07-08 22:16 . 2006-05-24 20:03 138 --a------ C:\Can You Do The Matrix.vmt
2008-07-08 19:10 . 2008-07-08 19:10 216,199 --a------ C:\WINDOWS\CEVO CSS LAN GUI v2.0 Uninstaller.exe
2008-07-06 19:48 . 2008-07-06 19:48 <DIR> d-------- C:\Program Files\Avira
2008-07-06 19:31 . 2008-07-06 19:31 <DIR> d-------- C:\Program Files\Alwil Software
2008-07-06 19:31 . 2003-03-18 16:20 1,060,864 --a------ C:\WINDOWS\system32\MFC71.dll
2008-07-06 19:16 . 2004-03-03 21:30 125,184 --a------ C:\WINDOWS\system32\drivers\imagesrv.sys
2008-07-06 19:16 . 2004-03-03 21:30 5,504 --a------ C:\WINDOWS\system32\drivers\imagedrv.sys
2008-07-06 19:15 . 2008-07-06 19:16 <DIR> d-------- C:\Program Files\Common Files\Ahead
2008-07-06 19:15 . 2008-07-06 19:15 <DIR> d-------- C:\Program Files\Ahead
2008-07-06 19:15 . 2001-07-06 14:41 569,344 --a------ C:\WINDOWS\system32\imagr5.dll
2008-07-06 19:15 . 2001-07-06 12:44 544,768 --a------ C:\WINDOWS\system32\imagx5.dll
2008-07-06 19:15 . 2001-07-06 18:24 283,920 --a------ C:\WINDOWS\system32\ImagXpr5.dll
2008-07-06 19:15 . 2001-07-09 11:50 155,648 --a------ C:\WINDOWS\system32\NeroCheck.exe
2008-07-06 19:15 . 2000-06-26 11:45 106,496 --a------ C:\WINDOWS\system32\TwnLib20.dll
2008-07-06 19:15 . 2001-06-26 08:15 38,912 --a------ C:\WINDOWS\system32\picn20.dll
2008-07-06 19:12 . 2001-08-17 13:28 794,654 --a--c--- C:\WINDOWS\system32\dllcache\usr1801.sys
2008-07-06 19:11 . 2004-08-03 22:59 2,015,232 --a--c--- C:\WINDOWS\system32\dllcache\ntkrpamp.exe
2008-07-06 19:10 . 2001-08-23 08:00 1,875,968 --a--c--- C:\WINDOWS\system32\dllcache\msir3jp.lex
2008-07-06 19:09 . 2001-08-23 08:00 13,463,552 --a--c--- C:\WINDOWS\system32\dllcache\hwxjpn.dll
2008-07-06 19:08 . 2001-08-17 12:13 980,034 --a--c--- C:\WINDOWS\system32\dllcache\cicap.sys
2008-07-06 19:07 . 2004-08-04 00:56 1,888,992 --a--c--- C:\WINDOWS\system32\dllcache\ati3duag.dll
2008-07-06 19:06 . 2004-08-03 23:18 2,148,352 --a--c--- C:\WINDOWS\system32\dllcache\ntkrnlmp.exe
2008-07-06 19:06 . 2001-08-17 14:56 66,048 --a--c--- C:\WINDOWS\system32\dllcache\s3legacy.dll
2008-07-06 14:45 . 2008-07-06 14:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\LogMeIn
2008-06-28 15:05 . 2008-07-06 19:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Avira
2008-06-28 15:04 . 2008-07-26 10:15 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
2008-06-28 15:04 . 2008-06-28 15:04 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
2008-06-28 15:04 . 2008-06-28 15:04 <DIR> d-------- C:\Documents and Settings\Alex\Application Data\Malwarebytes
2008-06-28 15:04 . 2008-07-23 20:09 17,144 --a------ C:\WINDOWS\system32\drivers\mbam.sys
2008-06-28 15:02 . 2008-07-26 11:30 <DIR> d-------- C:\Program Files\SpywareBlaster
2008-06-28 14:40 . 2006-10-27 04:26 69,632 -ra------ C:\WINDOWS\system32\vuins32.dll
2008-06-28 14:40 . 2007-04-16 23:58 42,496 -ra------ C:\WINDOWS\system32\drivers\fetnd5bv.sys
2008-06-28 14:38 . 2001-08-17 12:13 27,165 --a------ C:\WINDOWS\system32\drivers\fetnd5.sys
2008-06-28 14:38 . 2001-08-17 12:13 27,165 --a--c--- C:\WINDOWS\system32\dllcache\fetnd5.sys
2008-06-28 14:32 . 2008-06-28 14:32 <DIR> d-------- C:\WINDOWS\system32\Lang
2008-06-28 14:32 . 2008-06-28 14:32 940,794 --a------ C:\WINDOWS\system32\LoopyMusic.wav
2008-06-28 14:32 . 2008-06-28 14:32 146,650 --a------ C:\WINDOWS\system32\BuzzingBee.wav
2008-06-28 14:30 . 2008-06-28 14:30 <DIR> d-------- C:\WINDOWS\system32\RTCOM
2008-06-28 14:30 . 2006-08-01 03:02 49,152 -r------- C:\WINDOWS\system32\ChCfg.exe
2008-06-28 14:29 . 2008-06-28 14:29 <DIR> d-------- C:\Program Files\Realtek
2008-06-28 14:18 . 2008-06-28 14:18 <DIR> d-------- C:\Program Files\My Company Name
2008-06-28 14:17 . 2007-12-05 02:53 356,352 --a------ C:\WINDOWS\system32\NVUNINST.EXE
2008-06-28 14:17 . 2007-12-04 13:41 356,352 --a------ C:\WINDOWS\system32\nvudisp.exe
2008-06-28 14:17 . 2008-06-28 14:18 165,437 --a------ C:\WINDOWS\system32\nvapps.xml
2008-06-28 14:17 . 2007-12-04 13:41 17,737 --a------ C:\WINDOWS\system32\nvdisp.nvu
2008-06-28 14:09 . 2006-10-17 08:22 9,216 -ra------ C:\WINDOWS\system32\drivers\videX32.sys
2008-06-28 14:08 . 2008-06-28 14:08 <DIR> d-------- C:\Program Files\VIA
2008-06-28 14:08 . 2005-11-17 03:46 337,320 -ra------ C:\WINDOWS\system32\difxapi.dll
2008-06-28 14:07 . 2005-03-09 02:53 36,352 -ra------ C:\WINDOWS\system32\drivers\AmdK8.sys
2008-06-28 13:59 . 2004-08-04 00:56 2,134,528 --a--c--- C:\WINDOWS\system32\dllcache\smtpsnap.dll
2008-06-28 13:58 . 2008-06-28 13:58 749 -rah----- C:\WINDOWS\WindowsShell.Manifest
2008-06-28 13:58 . 2008-06-28 13:58 749 -rah----- C:\WINDOWS\system32\wuaucpl.cpl.manifest
2008-06-28 13:58 . 2008-06-28 13:58 749 -rah----- C:\WINDOWS\system32\sapi.cpl.manifest
2008-06-28 13:58 . 2008-06-28 13:58 749 -rah----- C:\WINDOWS\system32\nwc.cpl.manifest
2008-06-28 13:58 . 2008-06-28 13:58 749 -rah----- C:\WINDOWS\system32\ncpa.cpl.manifest
2008-06-28 13:58 . 2008-06-28 13:58 488 -rah----- C:\WINDOWS\system32\logonui.exe.manifest
2008-06-28 13:52 . 2001-08-23 08:00 24,661 --a------ C:\WINDOWS\system32\spxcoins.dll
2008-06-28 13:52 . 2001-08-23 08:00 24,661 --a--c--- C:\WINDOWS\system32\dllcache\spxcoins.dll
2008-06-28 13:52 . 2004-08-04 01:58 13,753 -ra------ C:\WINDOWS\SET93.tmp
2008-06-28 13:52 . 2001-08-23 08:00 13,312 --a------ C:\WINDOWS\system32\irclass.dll
2008-06-28 13:52 . 2001-08-23 08:00 13,312 --a--c--- C:\WINDOWS\system32\dllcache\irclass.dll
2008-06-28 13:51 . 2004-08-04 01:57 1,086,058 -ra------ C:\WINDOWS\SET87.tmp
2008-06-28 13:51 . 2004-08-04 02:03 1,042,903 -ra------ C:\WINDOWS\SET84.tmp

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-26 20:18 --------- d-----w C:\Documents and Settings\Alex\Application Data\Xfire
2008-07-26 20:18 --------- d-----w C:\Documents and Settings\Alex\Application Data\Skype
2008-07-26 20:17 --------- d-----w C:\Program Files\Steam
2008-07-26 15:33 --------- d-s---w C:\Program Files\Xfire
2008-07-26 15:30 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-28 18:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\Grisoft
2008-06-28 18:29 315,392 ----a-w C:\WINDOWS\HideWin.exe
2008-06-28 18:29 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-06-28 15:40 --------- d-----w C:\Documents and Settings\Alex\Application Data\Lavasoft
2008-06-24 23:55 --------- d-----w C:\Program Files\GameGuardian
2008-06-08 04:52 --------- d-----w C:\Documents and Settings\Alex\Application Data\InstallShield
2008-06-05 21:56 107,888 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-06-05 21:56 --------- d--h--r C:\Documents and Settings\Alex\Application Data\SecuROM
2008-06-05 21:51 --------- d-----w C:\Program Files\GameSpy
2008-06-05 21:20 669,184 ----a-w C:\WINDOWS\system32\pbsvc.exe
2008-06-05 21:20 66,872 ----a-w C:\WINDOWS\system32\PnkBstrA.exe
2008-06-05 21:20 22,328 ----a-w C:\WINDOWS\system32\drivers\PnkBstrK.sys
2008-06-05 21:20 22,328 ----a-w C:\Documents and Settings\Alex\Application Data\PnkBstrK.sys
2008-06-05 21:20 103,736 ----a-w C:\WINDOWS\system32\PnkBstrB.exe
.

((((((((((((((((((((((((((((((((((((((((((((( AWF ))))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
----a-w 67,112 2006-08-01 20:35:36 C:\Program Files\AIM\bak\aim.exe

----a-w 50,736 2007-04-27 21:17:26 C:\Program Files\AIM6\bak\aim6.exe
----a-w 50,528 2008-01-03 16:15:06 C:\Program Files\AIM6\aim6.exe

----a-w 28,672 2001-11-29 06:00:00 C:\Program Files\Creative\SBLive\Program\bak\ADGJDet.exe

----a-w 1,175,552 2007-01-21 18:09:52 C:\Program Files\KSE\nHancer 32bit\bak\nHancer.exe

----a-w 1,667,584 2004-08-04 06:06:34 C:\Program Files\Messenger\bak\msmsgs.exe
------w 1,667,584 2004-08-04 05:06:34 C:\Program Files\Messenger\msmsgs.exe

----a-w 5,354,792 2006-07-30 00:34:04 C:\Program Files\MSN Messenger\bak\MsnMsgr.Exe
----a-w 5,674,352 2007-01-19 16:54:56 C:\Program Files\MSN Messenger\msnmsgr.exe

----a-w 282,624 2007-04-27 13:41:54 C:\Program Files\QuickTime\bak\bak\qttask.exe
----a-w 286,720 2007-12-11 15:56:54 C:\Program Files\QuickTime\QTTask.exe

----a-w 282,624 2007-04-27 13:41:54 C:\Program Files\QuickTime\bak\bak\qttask.exe

----a-w 25,590,312 2007-03-12 19:05:44 C:\Program Files\Skype\Phone\bak\Skype.exe

----a-w 106,496 2002-07-12 23:15:12 C:\WINDOWS\bak\SiSUSBrg.exe

----a-w 90,112 2000-05-11 06:00:00 C:\WINDOWS\bak\UpdReg.EXE

----a-w 257,088 2007-06-01 20:51:26 E:\iTunes\bak\iTunesHelper.exe
----a-w 267,048 2007-12-11 17:10:26 E:\iTunes\iTunesHelper.exe

----a-w 294,912 2003-04-14 20:11:52 E:\NetDrive\bak\netdrive.exe

.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr "= "C:\Program Files\MSN Messenger\MsnMsgr.Exe" [2007-01-19 12:54 5674352]
"Skype "= "C:\Program Files\Skype\Phone\bak\Skype.exe" [2007-03-12 15:05 25590312]
"DW4 "= "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe" [N/A]
"Aim6 "= "C:\Program Files\AIM6\aim6.exe" [2008-01-03 12:15 50528]
"Steam "= "c:\program files\steam\steam.exe" [2008-03-28 00:57 1271032]
"ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NapsterShell "= "C:\Program Files\Napster\napster.exe" [N/A]
"LogMeIn GUI "= "E:\Program Files\LogMeIn\x86\LogMeInSystray.exe" [2007-09-12 10:20 63048]
"QuickTime Task "= "C:\Program Files\QuickTime\qttask.exe" [2007-12-11 11:56 286720]
"iTunesHelper "= "E:\iTunes\iTunesHelper.exe" [2007-12-11 13:10 267048]
"SunJavaUpdateSched "= "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 04:25 144784]
"NvCplDaemon "= "C:\WINDOWS\system32\NvCpl.dll" [2007-12-04 13:41 8523776]
"NvMediaCenter "= "C:\WINDOWS\system32\NvMcTray.dll" [2007-12-04 13:41 81920]
"NeroFilterCheck "= "C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"avgnt "= "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" [2008-07-18 01:08 266497]
"WINDVDPatch "= "CTHELPER.EXE" [2002-07-02 18:56 24576 C:\WINDOWS\system32\CTHELPER.EXE]
"nwiz "= "nwiz.exe" [2007-12-04 13:41 1626112 C:\WINDOWS\system32\nwiz.exe]
"RTHDCPL "= "RTHDCPL.EXE" [2007-08-10 03:21 16384000 C:\WINDOWS\RTHDCPL.exe]

C:\Documents and Settings\Alex\Start Menu\Programs\Startup\
Xfire.lnk - C:\Program Files\Xfire\xfire.exe [2008-07-15 19:09:02 3050832]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Reader Speed Launch.lnk - C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2004-12-14 05:44:06 29696]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\LMIinit]
2007-10-18 20:47 75064 C:\WINDOWS\system32\LMIinit.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs "=

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.XFR1 "= xfcodec.dll

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"UpdatesDisableNotify "=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall "= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe "=
"C:\\Program Files\\Messenger\\msmsgs.exe "=
"C:\\Program Files\\Xfire\\xfire.exe "=
"E:\\EA GAMES\\MOHAA\\moh_Breakthrough.exe "=
"C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe "=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe "=
"C:\\Program Files\\MSN Messenger\\livecall.exe "=
"C:\\Program Files\\Steam\\Steam.exe "=
"E:\\iTunes\\iTunes.exe "=
"D:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\Crysis.exe "=
"D:\\Program Files\\Electronic Arts\\Crytek\\Crysis\\Bin32\\CrysisDedicatedServer.exe "=
"C:\\WINDOWS\\system32\\PnkBstrA.exe "=
"C:\\WINDOWS\\system32\\PnkBstrB.exe "=
"C:\\Program Files\\uTorrent\\uTorrent.exe "=
"C:\\Program Files\\Skype\\Phone\\bak\\Skype.exe "=

R0 $sys$cor;$sys$cor;C:\WINDOWS\system32\Drivers\$sys$cor.sys [2005-07-04 08:52]
R0 videX32;videX32;C:\WINDOWS\system32\DRIVERS\videX32.sys [2006-10-17 08:22]
R2 $sys$DRMServer;Plug and Play Device Manager;C:\WINDOWS\system32\$sys$filesystem\$sys$DRMServer.exe [2004-12-14 05:49]
R2 CD_Proxy;XCP CD Proxy;C:\WINDOWS\CDProxyServ.exe [2004-10-07 10:42]
R2 LMIInfo;LogMeIn Kernel Information Provider;E:\Program Files\LogMeIn\x86\RaInfo.sys [2008-02-28 15:31]
R2 LMIRfsDriver;LogMeIn Remote File System Driver;C:\WINDOWS\system32\drivers\LMIRfsDriver.sys [2007-09-12 10:20]
R2 Viewpoint Manager Service;Viewpoint Manager Service;C:\Program Files\Viewpoint\Common\ViewpointService.exe [2007-01-04 17:38]
R3 FET5X86V;VIA Rhine-Family Fast-Ethernet Adapter Driver Service;C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2007-04-16 23:58]
S1 $sys$crater;$sys$crater;C:\WINDOWS\system32\$sys$filesystem\crater.sys [2005-07-04 06:51]
S3 AN983;ADMtek AN983/AN985/ADM951X 10/100Mbps Fast Ethernet Adapter;C:\WINDOWS\system32\DRIVERS\AN983.sys [2004-08-03 23:31]
S3 cdiskdun;cdiskdun;C:\DOCUME~1\Alex\LOCALS~1\Temp\cdiskdun.sys []
S3 FastNIC;SMC EZ Card 10/100 (SMC1244TX V2) Driver;C:\WINDOWS\system32\DRIVERS\FastNIC.sys [2001-10-17 09:09]
S3 grio8drv;grio8drv;C:\DOCUME~1\Alex\LOCALS~1\Temp\grio8drv.sys []
S3 SCREAMINGBDRIVER;Screaming Bee Audio;C:\WINDOWS\system32\drivers\ScreamingBAudio.sys []
S3 SetupNTGLM7X;SetupNTGLM7X;F:\NTGLM7X.sys []
S3 ytcpip6;ytcpip6;C:\DOCUME~1\Alex\LOCALS~1\Temp\ytcpip6.sys []

*Newly Created Service* - CATCHME
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder
2008-07-18 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job - s! ":C:\Program Files\Apple Software Update\SoftwareUpdate.exe-taskSYSTEM0" []
.
.
------- Supplementary Scan -------
.
R0 -: HKCU-Main,Start Page = about:blank
R1 -: HKCU-SearchURL,(Default) = hxxp://www.google.com/search?q=%s
O8 -: E&xport to Microsoft Excel - C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000


**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-26 16:24:15
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
Completion time: 2008-07-26 16:26:50
ComboFix-quarantined-files.txt 2008-07-26 20:26:48

Pre-Run: 3,101,589,504 bytes free
Post-Run: 6,645,403,648 bytes free

230


Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:35:33 PM, on 7/26/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\CTHELPER.EXE
E:\Program Files\LogMeIn\x86\LogMeInSystray.exe
E:\iTunes\iTunesHelper.exe
C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Skype\Phone\bak\Skype.exe
C:\program files\steam\steam.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Xfire\xfire.exe
C:\Program Files\Common Files\AOL\Loader\aolload.exe
C:\WINDOWS\system32\$sys$filesystem\$sys$DRMServer.exe
E:\Program Files\LogMeIn\x86\LMIGuardian.exe
C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\WINDOWS\CDProxyServ.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\iPod\bin\iPodService.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\wscntfy.exe
C:\hjt\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O4 - HKLM\..\Run: [WINDVDPatch] CTHELPER.EXE
O4 - HKLM\..\Run: [NapsterShell] C:\Program Files\Napster\napster.exe /systray
O4 - HKLM\..\Run: [LogMeIn GUI] "E:\Program Files\LogMeIn\x86\LogMeInSystray.exe "
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "E:\iTunes\iTunesHelper.exe "
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe "
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\bak\Skype.exe" /nosplash /minimized
O4 - HKCU\..\Run: [DW4] "C:\Program Files\The Weather Channel FW\Desktop Weather\DesktopWeather.exe "
O4 - HKCU\..\Run: [Aim6] "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp
O4 - HKCU\..\Run: [Steam] "c:\program files\steam\steam.exe" -silent
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: Xfire.lnk = C:\Program Files\Xfire\xfire.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {20A60F0D-9AFA-4515-A0FD-83BD84642501} (Checkers Class) - http://messenger.zone.msn.com/binary/msgrchkr.cab56986.cab
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} (UnoCtrl Class) - http://messenger.zone.msn.com/EN-CA/a-UNO1/GAME_UNO1.cab
O16 - DPF: {B8BE5E93-A60C-4D26-A2DC-220313175592} (MSN Games - Installer) - http://messenger.zone.msn.com/binary/ZIntro.cab56649.cab
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab
O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab56986.cab
O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
O20 - AppInit_DLLs:
O23 - Service: Plug and Play Device Manager ($sys$DRMServer) - First 4 Internet Ltd - C:\WINDOWS\system32\$sys$filesystem\$sys$DRMServer.exe
O23 - Service: Avira AntiVir Personal "“ Free Antivirus Scheduler (AntiVirScheduler) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe
O23 - Service: Avira AntiVir Personal "“ Free Antivirus Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: XCP CD Proxy (CD_Proxy) - Unknown owner - C:\WINDOWS\CDProxyServ.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
O24 - Desktop Component 0: Privacy Protection - (no file)

--
End of file - 7491 bytes

 

Hi Bill
Please do this.

Download FindAWF from the link below, saving to the desktop.

http://noahdfear.geekstogo.com/FindAWF.exe

Double click it to run. Choose option 1 press enter.

Let the program run, a notepad will open after it has finished.

Please copy and paste the results back here.

Also I see uTorrent on the machine, I'm sure you know the dangers with P2P so I won't post the speech.

thanks
Geri

 

Hi Geri,

I didn't realize what utorrent was, now that I know, it has been removed. Thanks for the heads up.

Here's the log you requested.


Find AWF report by noahdfear ©2006
Version 1.40

The current date is: Sun 07/27/2008
The current time is: 12:28:06.76


bak folders found
~~~~~~~~~~~


Directory of C:\WINDOWS\BAK

07/12/2002 07:15 PM 106,496 SiSUSBrg.exe
05/11/2000 02:00 AM 90,112 UpdReg.EXE
2 File(s) 196,608 bytes

Directory of C:\PROGRA~1\AIM\BAK

08/01/2006 04:35 PM 67,112 aim.exe
1 File(s) 67,112 bytes

Directory of C:\PROGRA~1\AIM6\BAK

04/27/2007 05:17 PM 50,736 aim6.exe
1 File(s) 50,736 bytes

Directory of C:\PROGRA~1\MESSEN~1\BAK

08/04/2004 02:06 AM 1,667,584 msmsgs.exe
1 File(s) 1,667,584 bytes

Directory of C:\PROGRA~1\MSNMES~1\BAK

07/29/2006 08:34 PM 5,354,792 MsnMsgr.Exe
1 File(s) 5,354,792 bytes

Directory of C:\PROGRA~1\QUICKT~1\BAK

0 File(s) 0 bytes

Directory of C:\PROGRA~1\KSE\NHANCE~1\BAK

01/21/2007 02:09 PM 1,175,552 nHancer.exe
1 File(s) 1,175,552 bytes

Directory of C:\PROGRA~1\QUICKT~1\BAK\BAK

04/27/2007 09:41 AM 282,624 qttask.exe
1 File(s) 282,624 bytes

Directory of C:\PROGRA~1\SKYPE\PHONE\BAK

03/12/2007 03:05 PM 25,590,312 Skype.exe
1 File(s) 25,590,312 bytes

Directory of C:\PROGRA~1\CREATIVE\SBLIVE\PROGRAM\BAK

11/29/2001 02:00 AM 28,672 ADGJDet.exe
1 File(s) 28,672 bytes

Directory of C:\PROGRA~1\SKYPE\PHONE\BAK\BAK

0 File(s) 0 bytes

Directory of E:\ITUNES\BAK

06/01/2007 04:51 PM 257,088 iTunesHelper.exe
1 File(s) 257,088 bytes

Directory of E:\NETDRIVE\BAK

04/14/2003 04:11 PM 294,912 netdrive.exe
1 File(s) 294,912 bytes


Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~

106496 Jul 12 2002 "C:\WINDOWS\bak\SiSUSBrg.exe "
106496 Jul 12 2002 "D:\Drivers\SiS AGP\AGP\USB\Win2K_XP\WinXPUSB\SiSUSBrg.exe "
90112 May 11 2000 "C:\WINDOWS\bak\UpdReg.EXE "
67112 Aug 1 2006 "C:\Program Files\AIM\bak\aim.exe "
50528 Jan 3 2008 "C:\Program Files\AIM6\aim6.exe "
50736 Apr 27 2007 "C:\Program Files\AIM6\bak\aim6.exe "
1667584 Aug 4 2004 "C:\Program Files\Messenger\msmsgs.exe "
1667584 Aug 4 2004 "C:\Program Files\Messenger\bak\msmsgs.exe "
1694208 Oct 13 2004 "C:\WINDOWS\SoftwareDistribution\Download\561c9bea035f5195ab841bef0d7c79b4\sp2gdr\msmsgs.exe "
1694208 Oct 13 2004 "C:\WINDOWS\SoftwareDistribution\Download\561c9bea035f5195ab841bef0d7c79b4\sp2qfe\msmsgs.exe "
5674352 Jan 19 2007 "C:\Program Files\MSN Messenger\msnmsgr.exe "
5354792 Jul 29 2006 "C:\Program Files\MSN Messenger\bak\MsnMsgr.Exe "
286720 Dec 11 2007 "C:\Program Files\QuickTime\QTTask.exe "
282624 Apr 27 2007 "C:\Program Files\QuickTime\bak\bak\qttask.exe "
1175552 Jan 21 2007 "C:\Program Files\KSE\nHancer 32bit\bak\nHancer.exe "
286720 Dec 11 2007 "C:\Program Files\QuickTime\QTTask.exe "
282624 Apr 27 2007 "C:\Program Files\QuickTime\bak\bak\qttask.exe "
25590312 Mar 12 2007 "C:\Program Files\Skype\Phone\bak\Skype.exe "
28672 Nov 29 2001 "C:\Program Files\Creative\SBLive\Program\bak\ADGJDet.exe "
102400 Dec 25 2007 "C:\WINDOWS\Installer\{18388EF8-E0A3-442B-8BFE-E2F1B3D05C91}\iTunesIco.exe "
116008 Dec 11 2007 "C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 7.5.0.20\iTunesSetupAdmin.exe "
267048 Dec 11 2007 "E:\iTunes\iTunesHelper.exe "
257088 Jun 1 2007 "E:\iTunes\bak\iTunesHelper.exe "
294912 Apr 14 2003 "E:\NetDrive\bak\netdrive.exe "


end of report

 

Hi Bill

Highlight and copy the bolded list of files below.

"C:\WINDOWS\bak\SiSUSBrg.exe "
"C:\WINDOWS\bak\UpdReg.EXE "
"C:\Program Files\AIM\bak\aim.exe "
"C:\Program Files\KSE\nHancer 32bit\bak\nHancer.exe "
"C:\Program Files\Skype\Phone\bak\Skype.exe "
"C:\Program Files\Creative\SBLive\Program\bak\ADGJDet.exe"

• Run FindAWF again and select option 2.
• Press any key to continue at the Thank you screen.
• A text file will open named files.txt.
• Click below the line in files.txt, then right click and paste the list of files.
• Close files.txt and save the changes.
• FindAWF will restore the files to their original location and automatically do another scan.
• When complete, awf.txt will open.
• Please post it's contents.

Thanks
Geri

 

Hi Geri,

Here's the newest log;


Find AWF report by noahdfear ©2006
Version 1.40
Option 2 run successfully

The current date is: Sun 07/27/2008
The current time is: 15:23:20.53


bak folders found
~~~~~~~~~~~


Directory of C:\WINDOWS\BAK

07/12/2002 07:15 PM 106,496 SiSUSBrg.exe
05/11/2000 02:00 AM 90,112 UpdReg.EXE
2 File(s) 196,608 bytes

Directory of C:\PROGRA~1\AIM\BAK

08/01/2006 04:35 PM 67,112 aim.exe
1 File(s) 67,112 bytes

Directory of C:\PROGRA~1\AIM6\BAK

04/27/2007 05:17 PM 50,736 aim6.exe
1 File(s) 50,736 bytes

Directory of C:\PROGRA~1\MESSEN~1\BAK

08/04/2004 02:06 AM 1,667,584 msmsgs.exe
1 File(s) 1,667,584 bytes

Directory of C:\PROGRA~1\MSNMES~1\BAK

07/29/2006 08:34 PM 5,354,792 MsnMsgr.Exe
1 File(s) 5,354,792 bytes

Directory of C:\PROGRA~1\QUICKT~1\BAK

0 File(s) 0 bytes

Directory of C:\PROGRA~1\KSE\NHANCE~1\BAK

01/21/2007 02:09 PM 1,175,552 nHancer.exe
1 File(s) 1,175,552 bytes

Directory of C:\PROGRA~1\QUICKT~1\BAK\BAK

04/27/2007 09:41 AM 282,624 qttask.exe
1 File(s) 282,624 bytes

Directory of C:\PROGRA~1\SKYPE\PHONE\BAK

03/12/2007 03:05 PM 25,590,312 Skype.exe
1 File(s) 25,590,312 bytes

Directory of C:\PROGRA~1\CREATIVE\SBLIVE\PROGRAM\BAK

11/29/2001 02:00 AM 28,672 ADGJDet.exe
1 File(s) 28,672 bytes

Directory of C:\PROGRA~1\SKYPE\PHONE\BAK\BAK

0 File(s) 0 bytes

Directory of E:\ITUNES\BAK

06/01/2007 04:51 PM 257,088 iTunesHelper.exe
1 File(s) 257,088 bytes

Directory of E:\NETDRIVE\BAK

04/14/2003 04:11 PM 294,912 netdrive.exe
1 File(s) 294,912 bytes


Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~

106496 Jul 12 2002 "C:\WINDOWS\SiSUSBrg.exe "
106496 Jul 12 2002 "C:\WINDOWS\bak\SiSUSBrg.exe "
106496 Jul 12 2002 "D:\Drivers\SiS AGP\AGP\USB\Win2K_XP\WinXPUSB\SiSUSBrg.exe "
90112 May 11 2000 "C:\WINDOWS\UpdReg.EXE "
90112 May 11 2000 "C:\WINDOWS\bak\UpdReg.EXE "
67112 Aug 1 2006 "C:\Program Files\AIM\aim.exe "
67112 Aug 1 2006 "C:\Program Files\AIM\bak\aim.exe "
50528 Jan 3 2008 "C:\Program Files\AIM6\aim6.exe "
50736 Apr 27 2007 "C:\Program Files\AIM6\bak\aim6.exe "
1667584 Aug 4 2004 "C:\Program Files\Messenger\msmsgs.exe "
1667584 Aug 4 2004 "C:\Program Files\Messenger\bak\msmsgs.exe "
1694208 Oct 13 2004 "C:\WINDOWS\SoftwareDistribution\Download\561c9bea035f5195ab841bef0d7c79b4\sp2gdr\msmsgs.exe "
1694208 Oct 13 2004 "C:\WINDOWS\SoftwareDistribution\Download\561c9bea035f5195ab841bef0d7c79b4\sp2qfe\msmsgs.exe "
5674352 Jan 19 2007 "C:\Program Files\MSN Messenger\msnmsgr.exe "
5354792 Jul 29 2006 "C:\Program Files\MSN Messenger\bak\MsnMsgr.Exe "
286720 Dec 11 2007 "C:\Program Files\QuickTime\QTTask.exe "
282624 Apr 27 2007 "C:\Program Files\QuickTime\bak\bak\qttask.exe "
1175552 Jan 21 2007 "C:\Program Files\KSE\nHancer 32bit\nHancer.exe "
1175552 Jan 21 2007 "C:\Program Files\KSE\nHancer 32bit\bak\nHancer.exe "
286720 Dec 11 2007 "C:\Program Files\QuickTime\QTTask.exe "
282624 Apr 27 2007 "C:\Program Files\QuickTime\bak\bak\qttask.exe "
25590312 Mar 12 2007 "C:\Program Files\Skype\Phone\Skype.exe "
25590312 Mar 12 2007 "C:\Program Files\Skype\Phone\bak\Skype.exe "
28672 Nov 29 2001 "C:\Program Files\Creative\SBLive\Program\ADGJDet.exe "
28672 Nov 29 2001 "C:\Program Files\Creative\SBLive\Program\bak\ADGJDet.exe "
102400 Dec 25 2007 "C:\WINDOWS\Installer\{18388EF8-E0A3-442B-8BFE-E2F1B3D05C91}\iTunesIco.exe "
116008 Dec 11 2007 "C:\Documents and Settings\All Users\Application Data\Apple Computer\Installer Cache\iTunes 7.5.0.20\iTunesSetupAdmin.exe "
267048 Dec 11 2007 "E:\iTunes\iTunesHelper.exe "
257088 Jun 1 2007 "E:\iTunes\bak\iTunesHelper.exe "
294912 Apr 14 2003 "E:\NetDrive\bak\netdrive.exe "


end of report

 

Hi Bill
OK now this.

Highlight and copy the bolded list of folders below.

C:\WINDOWS\bak
C:\WINDOWS\bak
C:\Program Files\AIM\bak
C:\Program Files\AIM6\bak
C:\Program Files\Messenger\bak
C:\Program Files\MSN Messenger\bak
C:\Program Files\QuickTime\bak\bak
C:\Program Files\KSE\nHancer 32bit\bak
C:\Program Files\QuickTime\bak\bak
C:\Program Files\Skype\Phone\bak
C:\Program Files\Creative\SBLive\Program\bak
E:\iTunes\bak
E:\NetDrive\bak

• Run FindAWF again and select option 3.
• A text file will open named folders.txt.
• Click below the line in folders.txt, then right click and paste the list of folders.
• Close folders.txt and save the changes.
• FindAWF will delete the folders and automatically do another scan.
• When complete, awf.txt will open.
• Please post it's contents.

Thanks
Geri

 

Hi Geri,

Here's the new log;


Find AWF report by noahdfear ©2006
Version 1.40
Option 3 run successfully

The current date is: Tue 07/29/2008
The current time is: 18:06:05.46


bak folders found
~~~~~~~~~~~


Directory of C:\PROGRA~1\QUICKT~1\BAK

0 File(s) 0 bytes

Directory of C:\PROGRA~1\QUICKT~1\BAK\BAK

04/27/2007 09:41 AM 282,624 qttask.exe
1 File(s) 282,624 bytes

Directory of C:\PROGRA~1\SKYPE\PHONE\BAK

0 File(s) 0 bytes

Directory of C:\PROGRA~1\SKYPE\PHONE\BAK\BAK

0 File(s) 0 bytes


Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~

286720 Dec 11 2007 "C:\Program Files\QuickTime\QTTask.exe "
282624 Apr 27 2007 "C:\Program Files\QuickTime\bak\bak\qttask.exe "
286720 Dec 11 2007 "C:\Program Files\QuickTime\QTTask.exe "
282624 Apr 27 2007 "C:\Program Files\QuickTime\bak\bak\qttask.exe "


end of report

 

Hi Bill
OK that is interesting.

Please run option 3 again and add this.

C:\Program Files\QuickTime\bak
C:\Program Files\QuickTime\bak

If you get a no bak files under this...
Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~

Then Run FindAWF again and select option 4. it Returns to the main menu when complete.
Close FindAWF by typing E and hitting enter.


Now there was a couple files in the CF log that were hard to get much info on so lets run a on-line scan.

Scanning with Kaspersky WebScanner

You will be promted to install an ActiveX component from Kaspersky, Click Yes.

• The program will launch and then begin downloading the latest definition files:
• Once the files have been downloaded click on NEXT
  
• Now click on Scan Settings
• In the scan settings make that the following are selected:
  • Scan using the following Anti-Virus database:
  • Extended (if available otherwise Standard)
  • Scan Options:
  • Scan Archives
    Scan Mail Bases
• Click OK
• Now under select a target to scan:
  • Select My Computer
• This will program will start and scan your system.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
  • Now click on the Save as Text button:
• Save the file to your desktop.

Please post the Kaspersky results.

Thanks
Geri

 

Hi Geri,

Sorry to be so long posting back. Here is the result of the AWF scan, when I tried to do the Kaspersky scan I got this message;

Kaspersky Online Scanner license has expired!

It would not continue after that. I went into add/remove programs and did an uninstall on it but that did not help.


Find AWF report by noahdfear ©2006
Version 1.40
Option 3 run successfully

The current date is: Sat 08/09/2008
The current time is: 14:54:14.76


bak folders found
~~~~~~~~~~~


Directory of C:\PROGRA~1\QUICKT~1\BAK

0 File(s) 0 bytes

Directory of C:\PROGRA~1\QUICKT~1\BAK\BAK

04/27/2007 09:41 AM 282,624 qttask.exe
1 File(s) 282,624 bytes

Directory of C:\PROGRA~1\SKYPE\PHONE\BAK

0 File(s) 0 bytes

Directory of C:\PROGRA~1\SKYPE\PHONE\BAK\BAK

0 File(s) 0 bytes


Duplicate files of bak directory contents
~~~~~~~~~~~~~~~~~~~~~~~

286720 Dec 11 2007 "C:\Program Files\QuickTime\QTTask.exe "
282624 Apr 27 2007 "C:\Program Files\QuickTime\bak\bak\qttask.exe "
286720 Dec 11 2007 "C:\Program Files\QuickTime\QTTask.exe "
282624 Apr 27 2007 "C:\Program Files\QuickTime\bak\bak\qttask.exe "


end of report

 

Hi Bill
OK manually remove these BAK folders.
C:\Program Files\QuickTime\bak
C:\Program Files\SKYPE\PHONE\BAK

Kaspersky has changed there scan again. Here are the new instructions.

Please do an online scan with Kaspersky WebScanner

Click on “Accept” If your pop –up blocker blocks any windows from opening.

Click Run on the window that opens.
Windows Vista users you must open the web browser using the Run as Administrator command.

• The program will launch and then begin downloading the latest definition files:
• Under Scan on the left side.Click on My Computer
• This will start the program and scan your system.
• Click the “Scan Report” On the left side.
• The scan will take a while so be patient and let it run.
• Once the scan is complete it will display if your system has been infected.
  • Click the Save Report As button, and in the Browse dialog box, type a name for the scan report file that you want to create and select its type Text file. Click OK to save the file.:
• Save the text file to your desktop.
• Copy and paste that information in your next post.

Please post the Kaspersky results.

Thanks
Geri

 

Hi Geri,

I tried the Kaspersky scan again last night, it ran for a couple hours and the machine froze up tight, had to power it off. I will try it again tonight and see what happens.

 

Hi Geri,

Here's the result of the kaspersky scan;

KASPERSKY ONLINE SCANNER 7 REPORT
Wednesday, August 13, 2008
Operating System: Microsoft Windows XP Professional Service Pack 2 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Wednesday, August 13, 2008 17:11:18
Records in database: 1089740
--------------------------------------------------------------------------------

Scan settings:
Scan using the following database: extended
Scan archives: yes
Scan mail databases: yes

Scan area - My Computer:
C:\
D:\
E:\
F:\
G:\

Scan statistics:
Files scanned: 86228
Threat name: 4
Infected objects: 7
Suspicious objects: 0
Duration of the scan: 01:05:48


File name / Threat name / Threats count
C:\Documents and Settings\Alex\My Documents\mirc621.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.621 1
C:\Documents and Settings\Alex\My Documents\mirc631.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.631 1
D:\Downloads\LogMeIn.exe Infected: not-a-virus:RemoteAdmin.Win32.RemotelyAnywhere.a 1
D:\Downloads\LogMeIn.exe Infected: not-a-virus:RemoteAdmin.Win32.RemotelyAnywhere.c 1
D:\Downloads\mirc621.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.621 1
E:\mIRC1\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.631 1
E:\mIRC2\mirc.exe Infected: not-a-virus:Client-IRC.Win32.mIRC.621 1

The selected area was scanned.

 

Hi Bill
OK, well those are not really infections to be worried about.
mIRC is a on-line chat program.
LogMeIn RemoteAnywhere is a remote administration tool so you can check emails and such from another computer.

Click Start>Run in the run box copy and paste or type ComboFix /u then hit Enter to uninstall ComboFix and remove the files/folders it created. This action will also reset the System Restore points, removing the infected files there as well.

How is the computer running?

Geri

 

Hi Geri,

I ran the combofix uninstall as recommended. According to my son, the machine is performing very well again. Looks like we can consider this closed, thanks very much for the help.


Bill

 

Hi Bill
OK that's good to hear. You're welcome.

I'm sure you seen this before but I'll post it again.

Please look at this link for some preventive recommendations, It could keep you from ending up back here to the Spyware and Virus Removal Forums.
http://www.windowsbbs.com/showthread.php?t=67958

I'll mark this one resolved.

Tell your son to...
Surf Safely.
Geri