1. You are viewing our forum as a guest. For full access please Register. WindowsBBS.com is completely free, paid for by advertisers and donations.

Regedit Opens then Closes

Discussion in 'Malware and Virus Removal Archive' started by xy0n28, 2008/06/03.

  1. 2008/06/03
    xy0n28

    xy0n28 Inactive Thread Starter

    Joined:
    2008/06/03
    Messages:
    4
    Likes Received:
    0
    Like the title says, my regedit opens a MS-DOS like window then closes ultra fast. It has been bugging me for quite some time now, but I was always too lazy to fix it. But just today I encountered a Spyware(?) pop-up that turned my background into a blue/yellow warning sign. I was browsing around looking for possible solutions that I re-discovered that my regedit doesn't work.

    However, I think I may have been able to fix the spyware problem, by running Spybot Search and Destroy, but I'm not too sure.

    I would greatly appreciate it if you guys can look at my log and tell me what should and shouldn't be there, and hopefully make my regedit functional again. Thanks

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 8:33:00 PM, on 6/3/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Viewpoint\Common\ViewpointService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKUS\S-1-5-18\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'Default user')
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.2.1.87.cab
    O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin11USA.cab
    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
    O16 - DPF: {A2E05F45-F127-4092-B9F7-9A02C3E04C77} (HGPlugin7USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin7USA.cab
    O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
    O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
    O23 - Service: Apache - Unknown owner - C:\Program Files\Apache Group\Apache\Apache.exe (file missing)
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: McAfee Real-time Scanner (McShield) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe (file missing)
    O23 - Service: McAfee SystemGuards (McSysmon) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe (file missing)
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: Serviço de protocolo Microsoft SSVP (svchostx) - Unknown owner - C:\WINDOWS\system\svchost.exe (file missing)
    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

    --
    End of file - 5801 bytes
     
    xy0n28,
    #1
  2. 2008/06/03
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Welcome to WindowsBBS xy0n28,

    We need to use another tool that will give us a better look at things. Download Deckard's System Scanner (dss.exe) and save it to your desktop.
    • Close all applications and windows.
    • Double click on dss.exe to run it and follow the prompts.
    • When the scan is complete, two text files will open; main.txt, which will be maximized and extra.txt, which will be minimized.
    Post the contents of main.txt only for now.
     
    noahdfear,
    #2


  3. to hide this advert.

  4. 2008/06/04
    xy0n28

    xy0n28 Inactive Thread Starter

    Joined:
    2008/06/03
    Messages:
    4
    Likes Received:
    0
    Hello noahdfear, thanks for the quick reply and welcome. After running dss.exe, this is the content of my main.txt

    Thanks again for your helping me.

    Deckard's System Scanner v20071014.68
    Run by Hen on 2008-06-04 17:53:03
    Computer is in Normal Mode.
    --------------------------------------------------------------------------------

    -- System Restore --------------------------------------------------------------

    System Restore is disabled; attempting to re-enable...success.


    -- Last 1 Restore Point(s) --
    1: 2008-06-04 21:53:08 UTC - RP1 - System Checkpoint


    Backed up registry hives.
    Performed disk cleanup.



    -- HijackThis (run as Hen.exe) -------------------------------------------------

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 5:54:10 PM, on 6/4/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Viewpoint\Common\ViewpointService.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    C:\WINDOWS\system32\drwtsn32.exe
    C:\WINDOWS\system32\drwtsn32.exe
    C:\Documents and Settings\Hen\Desktop\dss.exe
    C:\PROGRA~1\TRENDM~1\HIJACK~1\Hen.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKUS\S-1-5-18\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'Default user')
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.2.1.87.cab
    O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin11USA.cab
    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
    O16 - DPF: {A2E05F45-F127-4092-B9F7-9A02C3E04C77} (HGPlugin7USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin7USA.cab
    O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
    O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
    O23 - Service: Apache - Unknown owner - C:\Program Files\Apache Group\Apache\Apache.exe (file missing)
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: McAfee Real-time Scanner (McShield) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe (file missing)
    O23 - Service: McAfee SystemGuards (McSysmon) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe (file missing)
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: Serviço de protocolo Microsoft SSVP (svchostx) - Unknown owner - C:\WINDOWS\system\svchost.exe (file missing)
    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

    --
    End of file - 5853 bytes

    -- File Associations -----------------------------------------------------------

    .bat - batfile - DefaultIcon - C:\Program Files\Stardock\Object Desktop\IconPackager\Themes\PixOffice\Pix Office.icl,58
    .hlp - hlpfile - DefaultIcon - C:\WINDOWS\System32\shell32.dll,23
    .inf - inffile - DefaultIcon - C:\WINDOWS\system32\shell32.dll,69
    .ini - inifile - DefaultIcon - C:\Program Files\Stardock\Object Desktop\IconPackager\Themes\PixOffice\Pix Office.icl,48
    .js - JSFile - DefaultIcon - C:\WINDOWS\System32\WScript.exe,3
    .reg - regfile - DefaultIcon - C:\WINDOWS\regedit.exe,1
    .txt - txtfile - DefaultIcon - C:\Program Files\Stardock\Object Desktop\IconPackager\Themes\PixOffice\Pix Office.icl,60
    .vbs - VBSFile - DefaultIcon - C:\WINDOWS\system32\WScript.exe,2


    -- Drivers: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled ---------------------

    R0 giveio - c:\windows\system32\giveio.sys
    R0 speedfan - c:\windows\system32\speedfan.sys <Not Verified; Windows (R) 2000 DDK provider; Windows (R) 2000 DDK driver>
    R1 BIOS - c:\windows\system32\drivers\bios.sys <Not Verified; BIOSTAR Group; BIOSTAR I/O driver fle>
    R1 oreans32 - c:\windows\system32\drivers\oreans32.sys
    R1 SCDEmu - c:\windows\system32\drivers\scdemu.sys <Not Verified; PowerISO Computing, Inc.; scdemu>
    R1 XPROTECTOR - c:\windows\system32\drivers\oreans.sys
    R2 ithsgt - c:\windows\system32\drivers\ithsgt.sys
    R2 lilsgt - c:\windows\system32\drivers\lilsgt.sys
    R2 npkcrypt - c:\nexon\maplestory\npkcrypt.sys <Not Verified; INCA Internet Co., Ltd.; nProtect KeyCrypt Driver>
    R3 kbdcap - c:\windows\system32\drivers\kbdcap.sys
    R3 Tetris (Tetris driver) - c:\windows\system32\drivers\tetris.sys

    S0 IFP700 (iRiver Internet Audio Player IFP-700) - c:\windows\system32\drivers\ifp700.sys (file missing)
    S2 SVKP - c:\windows\system32\svkp.sys (file missing)
    S2 zntport (NTPort Library Driver) - c:\windows\system32\zntport.sys (file missing)
    S3 ¥Ã•¥Ã˜°Ãª¤¤¥Ã1 - c:\documents and settings\hen\desktop\maplestory\gg\ve5 1032\nvid999.sys (file missing)
    S3 CEDRIVER52 - c:\program files\cheat engine\dbk32.sys (file missing)
    S3 CEDRIVER53 - c:\program files\cheat engine\dbk32.sys (file missing)
    S3 cheetah1 - c:\documents and settings\hen\desktop\cheetah engine\ce12\cheetah.sys (file missing)
    S3 DADriv1 - c:\documents and settings\hen\desktop\maplestory\da\dak32.sys (file missing)
    S3 DISK_DRIVE32 - c:\documents and settings\hen\desktop\xaim\ms hack\angelpugshit\disk_1024.sys (file missing)
    S3 geebers12 - c:\documents and settings\hen\desktop\ms\mss\ez\nvid888.sys (file missing)
    S3 iCheat1 - c:\documents and settings\hen\desktop\icheat\nvid999.sys (file missing)
    S3 IlvMoneyDRIVER53 - c:\documents and settings\hen\desktop\maplestory\gg\ilvmoney1055.sys (file missing)
    S3 jamilah - c:\jamilah.sys (file missing)
    S3 kaspersky1 - c:\documents and settings\hen\desktop\kasper\kaspersky.sys (file missing)
    S3 MzBot.sys - c:\program files\xentare\mzbot.sys (file missing)
    S3 Pcouffin (Low level access layer for CD devices) - c:\windows\system32\drivers\pcouffin.sys (file missing)
    S3 pohci13F - c:\docume~1\hen\locals~1\temp\pohci13f.sys (file missing)
    S3 saruen - c:\documents and settings\hen\desktop\ms\saruen.sys (file missing)
    S3 sejt1 - c:\documents and settings\hen\desktop\ms\mss\sejt.sys (file missing)
    S3 SHAK31 - c:\documents and settings\hen\desktop\ms\re 4.2\shak3.sys (file missing)
    S3 SoRa01 - c:\documents and settings\hen\desktop\maple ****\engine\sora remak engine 2.6\sora.sys (file missing)
    S3 spuce1 - c:\documents and settings\hen\desktop\ms\mss\spuce2\spuce2\spuce 2.0\spuce.sys (file missing)
    S3 xp1 - c:\documents and settings\hen\desktop\ms\xpengine\xp.sys (file missing)
    S3 zenos1 - c:\documents and settings\hen\desktop\ms\zenos.sys (file missing)


    -- Services: 0-Boot, 1-System, 2-Auto, 3-Demand, 4-Disabled --------------------

    R2 Viewpoint Manager Service - "c:\program files\viewpoint\common\viewpointservice.exe" <Not Verified; Viewpoint Corporation; Viewpoint Manager>
    R4 Apple Mobile Device - "c:\program files\common files\apple\mobile device support\bin\applemobiledeviceservice.exe" <Not Verified; Apple, Inc.; Apple Mobile Device Service>

    S2 Apache - "c:\program files\apache group\apache\apache.exe" --ntservice (file missing)
    S2 McShield (McAfee Real-time Scanner) - c:\progra~1\mcafee\viruss~1\mcshield.exe (file missing)
    S2 McSysmon (McAfee SystemGuards) - c:\progra~1\mcafee\viruss~1\mcsysmon.exe (file missing)
    S2 svchostx (Serviço de protocolo Microsoft SSVP) - c:\windows\system\svchost.exe (file missing)


    -- Device Manager: Disabled ----------------------------------------------------

    No disabled devices found.


    -- Scheduled Tasks -------------------------------------------------------------

    2008-06-04 09:02:01 284 --a------ C:\WINDOWS\Tasks\AppleSoftwareUpdate.job
    2006-10-10 18:07:58 360 --a------ C:\WINDOWS\Tasks\Symantec NetDetect.job


    -- Files created between 2008-05-04 and 2008-06-04 -----------------------------

    2031-07-05 11:45:18 0 d-------- C:\Documents and Settings\Hen\errorlogs
    2008-06-03 20:32:41 0 d-------- C:\Program Files\Trend Micro
    2008-06-03 20:06:16 691545 --a------ C:\WINDOWS\unins000.exe
    2008-06-03 20:06:16 2548 --a------ C:\WINDOWS\unins000.dat
    2008-06-01 00:07:53 0 d-------- C:\Documents and Settings\All Users\Application Data\NexonUS
    2008-05-30 22:41:21 0 d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
    2008-05-30 00:47:19 0 d-------- C:\Documents and Settings\Hen\Contacts
    2008-05-30 00:32:16 0 d--hs--c- C:\Program Files\Common Files\WindowsLiveInstaller
    2008-05-30 00:32:02 0 d-------- C:\Program Files\Windows Live
    2008-05-30 00:31:46 0 d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-05-24 01:23:23 0 d-------- C:\Program Files\Guild Wars #2
    2008-05-14 18:58:41 0 d-------- C:\Program Files\Steam
    2008-05-13 19:23:06 0 d-------- C:\Program Files\Common Files\Apple
    2008-05-11 01:07:07 0 d-------- C:\Documents and Settings\All Users\Application Data\PrevxCSI
    2008-05-11 01:05:44 0 dr-h----- C:\Documents and Settings\Hen\Recent
    2008-05-09 22:04:33 0 d-------- C:\WINDOWS\system32\Adobe


    -- Find3M Report ---------------------------------------------------------------

    2008-06-03 21:40:23 0 d-------- C:\Documents and Settings\Hen\Application Data\Skype
    2008-06-03 20:59:52 0 d-------- C:\Documents and Settings\Hen\Application Data\PrevxCSI
    2008-05-31 08:10:16 0 d-------- C:\Program Files\PPStream
    2008-05-30 18:32:21 0 d-------- C:\Program Files\SystemRequirementsLab
    2008-05-30 18:32:19 0 d-------- C:\Documents and Settings\Hen\Application Data\SystemRequirementsLab
    2008-05-30 17:00:25 0 d-------- C:\Documents and Settings\Hen\Application Data\Hamachi
    2008-05-30 00:32:16 0 d-------- C:\Program Files\Common Files
    2008-05-19 23:14:22 0 d-------- C:\Program Files\Hamachi
    2008-05-19 22:20:17 0 d---s---- C:\Program Files\Xfire
    2008-05-17 14:47:46 0 d-------- C:\Documents and Settings\Hen\Application Data\uTorrent
    2008-05-16 18:57:07 0 d-------- C:\Documents and Settings\Hen\Application Data\Xfire
    2008-05-13 19:26:32 0 d-------- C:\Program Files\iTunes
    2008-05-13 19:26:17 0 d-------- C:\Program Files\iPod
    2008-05-13 19:25:13 0 d-------- C:\Program Files\QuickTime
    2008-05-13 19:20:50 0 d-------- C:\Program Files\Apple Software Update
    2008-05-11 01:07:31 0 d-------- C:\Program Files\Cheat Engine
    2008-05-09 22:05:55 0 d-------- C:\Documents and Settings\Hen\Application Data\Adobe
    2008-05-09 22:04:48 1287 --a------ C:\WINDOWS\mozver.dat
    2008-04-29 19:10:21 0 d-------- C:\Program Files\Boilsoft Video Splitter
    2008-04-25 13:10:37 0 d-------- C:\Program Files\Bethesda Softworks
    2008-04-22 23:59:01 0 d-------- C:\Program Files\Creative
    2008-04-17 22:27:00 0 d-------- C:\Program Files\Guild Wars
    2008-04-15 21:55:24 0 d-------- C:\Program Files\iPod 2 iPod
    2008-04-08 19:25:05 0 d-------- C:\Documents and Settings\Hen\Application Data\dvdcss


    -- Registry Dump ---------------------------------------------------------------

    *Note* empty entries & legit default entries are not shown


    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MSConfig "= "C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe" [08/04/2004 03:56 AM]
    "NvCplDaemon "= "C:\WINDOWS\system32\NvCpl.dll" [06/01/2006 05:22 PM]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe "= "C:\WINDOWS\system32\ctfmon.exe" [08/04/2004 03:56 AM]

    [HKEY_USERS\.default\software\microsoft\windows\currentversion\run]
    "MSMSGS "= "C:\Program Files\Messenger\msmsgs.exe" /background

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
    "DisableRegistryTools "=0 (0x0)
    "NoDispBackgroundPage "=0 (0x0)
    "NoDispScrSavPage "=0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MCPClient]
    C:\PROGRA~1\COMMON~1\Stardock\mcpstub.dll 01/31/2005 03:13 PM 49152 C:\PROGRA~1\COMMON~1\Stardock\MCPStub.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
    C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll 12/06/2005 09:16 PM 176128 C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\WbSrv.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "appinit_dlls "=wbsys.dll

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\vds]
    @= "Service "

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\{533C5B84-EC70-11D2-9505-00C04F79DEAF}]
    @= "Volume shadow copy "

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
    "C:\Program Files\AIM6\aim6.exe" /d locale=en-US ee://aol/imApp

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
    C:\WINDOWS\system32\ctfmon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lphc3sgj0e9dt]
    C:\WINDOWS\system32\lphc3sgj0e9dt.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
    "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
    RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PPS Accelerator]
    C:\Program Files\PPStream\ppsap.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "Apple Mobile Device "=2 (0x2)




    -- Hosts -----------------------------------------------------------------------

    127.0.0.1 martymane.net
    127.0.0.1 www.martymane.net
    127.0.0.1 http://www.martymane.net
    127.0.0.1 gameguard.mapleglobal.com
    127.0.0.1 gameguard.mapleglobal.com
    127.0.0.1 gameguard.mapleglobal.com
    127.0.0.1 bin.errorprotector.com ## added by CiD
    127.0.0.1 br.errorsafe.com ## added by CiD
    127.0.0.1 br.winantivirus.com ## added by CiD
    127.0.0.1 br.winfixer.com ## added by CiD

    66 more entries in hosts file.


    -- End of Deckard's System Scanner: finished at 2008-06-04 17:54:37 ------------
     
    xy0n28,
    #3
  5. 2008/06/05
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Some entries in your log suggest you have installed Messenger Plus 3, and possibly the sponsor program along with it. The sponsor is a well known and documented distributor of the LOP infection, so I recommend you uninstall it. Once uninstalled, you can re-install it if you wish, but make sure you do NOT install the sponsor. Personally, I would not have an application that is supported by known distributors of malware and therefore recommend you keep it off.

    Now, you have some file associations that need repaired. Highlight and copy the bolded command below.

    "%userprofile%\desktop\dss.exe" /daft
    • Click Start>Run and paste the command in, then hit enter.
    • An interface of Deckards file association fix will open.
    • Click Scan.
    • Check the box next to the following entries, then click Fix.
      • .bat
      • .hlp
      • .inf
      • .ini
      • .js
      • .reg
      • .txt
      • .vbs
    • Exit when complete.


    Next, download ComboFix by sUBs from here, saving the file to your desktop.


    Please disable realtime protection applications as they sometimes interfere with the tool. Check this link for your applicable programs.

    • Close all open programs and windows
    • Double click combofix.exe and follow the prompts.
    • It may reboot your computer and resume running when you logon. Wait for it to complete. When finished, it will open a log for you. Post that log and a new HijackThis log in your next reply.
    Note: Do not mouseclick combofix's window while its running. That may cause it to stall
     
    noahdfear,
    #4
  6. 2008/06/06
    xy0n28

    xy0n28 Inactive Thread Starter

    Joined:
    2008/06/03
    Messages:
    4
    Likes Received:
    0
    Hello again, I did everything as you said, but I ran into some problems(?) while ComboFix was scanning. Though ComboFix was able to finish scanning and provide me with a log file, it was during the scanning process that I kept getting these pop-ups saying "Windows cannot open this file..." I wasn't sure of what to do, so I just tried to ignore it and see if the scanning will continue, but it didn't. So I ended up pressing cancel each time that pop-up came back.

    Other than that, everything went smoothly. Here are the logs you asked for. Thanks again for assisting me. :D

    ComboFix 08-06-05.3 - Hen 2008-06-06 1:40:08.1 - NTFSx86
    Running from: C:\Documents and Settings\Hen\Desktop\ComboFix.exe
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\hosts
    C:\WINDOWS\system32\drivers\Xprotector.sys
    C:\WINDOWS\system32\msconfig.dll

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_SMONITOR
    -------\Legacy_XPROTECTOR
    -------\Service_XPROTECTOR


    ((((((((((((((((((((((((( Files Created from 2008-05-06 to 2008-06-06 )))))))))))))))))))))))))))))))
    .

    2031-07-05 11:45 . 2005-10-09 13:13 <DIR> d-------- C:\Documents and Settings\Hen\errorlogs
    2008-06-04 17:52 . 2008-06-04 17:52 <DIR> d-------- C:\Deckard
    2008-06-03 20:32 . 2008-06-03 20:32 <DIR> d-------- C:\Program Files\Trend Micro
    2008-06-03 20:06 . 2008-06-03 20:04 691,545 --a------ C:\WINDOWS\unins000.exe
    2008-06-03 20:06 . 2008-06-03 20:06 2,548 --a------ C:\WINDOWS\unins000.dat
    2008-06-03 19:53 . 2003-06-25 16:05 266,360 --a------ C:\WINDOWS\system32\TweakUI.exe
    2008-06-03 19:53 . 2002-06-21 15:09 160,217 --a------ C:\WINDOWS\system32\PowerToysLicense.rtf
    2008-06-01 08:32 . 2008-06-01 08:32 268 --ah----- C:\sqmdata01.sqm
    2008-06-01 08:32 . 2008-06-01 08:32 244 --ah----- C:\sqmnoopt01.sqm
    2008-06-01 00:07 . 2008-06-01 00:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\NexonUS
    2008-05-31 19:35 . 2008-05-31 19:35 268 --ah----- C:\sqmdata00.sqm
    2008-05-31 19:35 . 2008-05-31 19:35 244 --ah----- C:\sqmnoopt00.sqm
    2008-05-30 22:41 . 2008-05-30 22:41 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
    2008-05-30 10:23 . 2007-07-30 19:19 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
    2008-05-30 10:23 . 2007-07-30 19:19 207,736 --a------ C:\WINDOWS\system32\muweb.dll
    2008-05-30 10:23 . 2007-07-30 19:19 30,072 --a------ C:\WINDOWS\system32\mucltui.dll.mui
    2008-05-30 00:47 . 2008-05-30 00:47 <DIR> d-------- C:\Documents and Settings\Hen\Contacts
    2008-05-30 00:32 . 2008-06-06 01:33 <DIR> d-------- C:\Program Files\Windows Live
    2008-05-30 00:32 . 2008-05-30 00:38 <DIR> d--hsc--- C:\Program Files\Common Files\WindowsLiveInstaller
    2008-05-30 00:31 . 2008-05-30 00:31 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-05-27 11:05 . 2008-06-01 14:23 54,156 --ah----- C:\WINDOWS\QTFont.qfn
    2008-05-27 11:05 . 2008-05-27 11:05 1,409 --a------ C:\WINDOWS\QTFont.for
    2008-05-24 01:23 . 2008-04-10 23:10 <DIR> d-------- C:\Program Files\Guild Wars #2
    2008-05-14 18:58 . 2008-05-27 18:06 <DIR> d-------- C:\Program Files\Steam
    2008-05-13 19:23 . 2008-05-13 19:23 <DIR> d-------- C:\Program Files\Common Files\Apple
    2008-05-11 01:07 . 2008-05-11 01:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\PrevxCSI
    2008-05-09 22:04 . 2008-05-09 22:52 <DIR> d-------- C:\WINDOWS\system32\Adobe

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-06 05:36 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-06-06 05:33 --------- d-----w C:\Program Files\Common Files\Symantec Shared
    2008-06-06 04:48 --------- d-----w C:\Documents and Settings\Hen\Application Data\Skype
    2008-06-05 21:27 --------- d-----w C:\Documents and Settings\Hen\Application Data\Hamachi
    2008-06-04 00:59 --------- d-----w C:\Documents and Settings\Hen\Application Data\PrevxCSI
    2008-06-04 00:11 --------- d-----w C:\Program Files\Spybot - Search & Destroy
    2008-05-31 12:10 --------- d-----w C:\Program Files\PPStream
    2008-05-30 22:32 --------- d-----w C:\Program Files\SystemRequirementsLab
    2008-05-30 22:32 --------- d-----w C:\Documents and Settings\Hen\Application Data\SystemRequirementsLab
    2008-05-20 03:14 --------- d-----w C:\Program Files\Hamachi
    2008-05-20 03:13 25,280 ----a-w C:\WINDOWS\system32\drivers\hamachi.sys
    2008-05-20 02:20 --------- d-s---w C:\Program Files\Xfire
    2008-05-17 18:47 --------- d-----w C:\Documents and Settings\Hen\Application Data\uTorrent
    2008-05-16 22:57 --------- d-----w C:\Documents and Settings\Hen\Application Data\Xfire
    2008-05-13 23:26 --------- d-----w C:\Program Files\iTunes
    2008-05-13 23:26 --------- d-----w C:\Program Files\iPod
    2008-05-13 23:25 --------- d-----w C:\Program Files\QuickTime
    2008-05-13 23:20 --------- d-----w C:\Program Files\Apple Software Update
    2008-05-11 05:07 --------- d-----w C:\Program Files\Cheat Engine
    2008-04-29 23:10 --------- d-----w C:\Program Files\Boilsoft Video Splitter
    2008-04-25 17:10 --------- d-----w C:\Program Files\Bethesda Softworks
    2008-04-23 03:59 --------- d-----w C:\Program Files\Creative
    2008-04-18 02:27 --------- d-----w C:\Program Files\Guild Wars
    2008-04-16 01:55 --------- d-----w C:\Program Files\iPod 2 iPod
    2008-04-08 23:25 --------- d-----w C:\Documents and Settings\Hen\Application Data\dvdcss
    2007-04-01 01:53 92,064 ----a-w C:\Documents and Settings\Hen\mqdmmdm.sys
    2007-04-01 01:53 9,232 ----a-w C:\Documents and Settings\Hen\mqdmmdfl.sys
    2007-04-01 01:53 79,328 ----a-w C:\Documents and Settings\Hen\mqdmserd.sys
    2007-04-01 01:53 66,656 ----a-w C:\Documents and Settings\Hen\mqdmbus.sys
    2007-04-01 01:53 6,208 ----a-w C:\Documents and Settings\Hen\mqdmcmnt.sys
    2007-04-01 01:53 5,936 ----a-w C:\Documents and Settings\Hen\mqdmwhnt.sys
    2007-04-01 01:53 4,048 ----a-w C:\Documents and Settings\Hen\mqdmcr.sys
    2007-04-01 01:53 25,600 ----a-w C:\Documents and Settings\Hen\usbsermptxp.sys
    2007-04-01 01:53 22,768 ----a-w C:\Documents and Settings\Hen\usbsermpt.sys
    2005-10-26 16:48 40,448 ----a-w C:\Documents and Settings\Hen\trial_setup.exe
    2005-02-14 00:00 13,195 ----a-w C:\Documents and Settings\Hen\zguicfgw.dat
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "combofix "= "C:\WINDOWS\system32\CF26184.exe" [2004-08-04 03:56 388608]
    "NvCplDaemon "= "C:\WINDOWS\system32\NvCpl.dll" [2006-06-01 17:22 7618560]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "MSMSGS "= "C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24 1694208]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
    "NoDispScrSavPage "= 0 (0x0)

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\MCPClient]
    C:\PROGRA~1\COMMON~1\Stardock\mcpstub.dll 2005-01-31 15:13 49152 C:\PROGRA~1\COMMON~1\Stardock\MCPStub.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
    C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll 2005-12-06 21:16 176128 C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\WbSrv.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
    "AppInit_DLLs "=wbsys.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "VIDC.XFR1 "= xfcodec.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Aim6]
    --a------ 2008-03-06 16:50 50528 C:\Program Files\AIM6\aim6.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
    --a------ 2004-08-04 03:56 15360 C:\WINDOWS\system32\ctfmon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\lphc3sgj0e9dt]
    C:\WINDOWS\system32\lphc3sgj0e9dt.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MsnMsgr]
    C:\Program Files\Windows Live\Messenger\MsnMsgr.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
    --a------ 2006-06-01 17:22 7618560 C:\WINDOWS\system32\NvCpl.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PPS Accelerator]
    --a------ 2008-01-09 05:56 171168 C:\Program Files\PPStream\ppsap.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "Apple Mobile Device "=2 (0x2)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall "= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe "=
    "C:\\Valve\\Steam\\steam.exe "=
    "C:\\Valve\\Steam\\SteamApps\\xy0n28\\condition zero\\hl.exe "=
    "C:\\Program Files\\Wizet\\MapleStory\\Patcher.exe "=
    "C:\\Program Files\\Starcraft\\StarCraft.exe "=
    "C:\\Program Files\\Wizet\\MapleStory\\NewPatcher.exe "=
    "C:\\UnrealTournament\\System\\UnrealTournament.exe "=
    "C:\\Valve\\Condition Zero\\czero.exe "=
    "C:\\Program Files\\Diablo\\Diablo.exe "=
    "C:\\Valve\\Steam\\SteamApps\\xy0n28\\counter-strike\\hl.exe "=
    "C:\\Program Files\\Diablo II\\Game.exe "=
    "C:\\Program Files\\WinMX\\WinMX.exe "=
    "C:\\Program Files\\Internet Explorer\\iexplore.exe "=
    "C:\\Program Files\\Steam-Down\\Steamengine.exe "=
    "C:\\Program Files\\Steam-Down\\Steam.exe "=
    "C:\\Program Files\\Steam-Down\\SteamApps\\ghost_pkx\\counter-strike source\\hl2.exe "=
    "C:\\Valve\\Steam\\SteamApps\\xy0n28\\half-life\\hl.exe "=
    "C:\\Program Files\\Guild Wars\\Gw.exe "=
    "C:\\WINDOWS\\system32\\windir32.exe "=
    "C:\\Program Files\\AIM\\aim.exe "=
    "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe "=
    "C:\\Program Files\\Common Files\\AOL\\1148252847\\ee\\aolsoftware.exe "=
    "C:\\Program Files\\Common Files\\AOL\\1148252847\\ee\\aim6.exe "=
    "C:\\Program Files\\LimeWire\\LimeWire.exe "=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe "=
    "C:\\Program Files\\Xfire\\Xfire.exe "=
    "C:\\Program Files\\Azureus\\Azureus.exe "=
    "C:\\Program Files\\Steam\\steamapps\\ghost_pkx\\counter-strike\\hl.exe "=
    "C:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main.exe "=
    "C:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main_amdxp.exe "=
    "C:\\Program Files\\Atari\\Neverwinter Nights 2\\nwupdate.exe "=
    "C:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2server.exe "=
    "C:\\Program Files\\Joost\\xulrunner\\tvprunner.exe "=
    "C:\\Program Files\\AIM6\\aim6.exe "=
    "C:\\Program Files\\eMule\\emule.exe "=
    "C:\\Program Files\\uTorrent\\uTorrent.exe "=
    "C:\\Program Files\\PPStream\\PPStream.exe "=
    "C:\\Program Files\\PPStream\\PPSAP.exe "=
    "C:\\Program Files\\Steam\\steamapps\\xy0n1028\\counter-strike source\\hl2.exe "=
    "C:\\Nexon\\MapleStory\\MapleStory.exe "=
    "C:\\Program Files\\Steam\\steamapps\\xy0n1028\\day of defeat source\\hl2.exe "=
    "C:\\Program Files\\iTunes\\iTunes.exe "=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe "=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe "=
    "C:\\Documents and Settings\\All Users\\Application Data\\NexonUS\\NGM\\NGM.exe "=
    "C:\Nexon\Combat Arms\CombatArms.exe "= C:\Nexon\Combat Arms\CombatArms.exe:*Enabled:CombatArms.exe
    "C:\Nexon\Combat Arms\Engine.exe "= C:\Nexon\Combat Arms\Engine.exe:*Enabled:Engine.exe
    "C:\\Program Files\\Skype\\Phone\\Skype.exe "=

    .
    Contents of the 'Scheduled Tasks' folder
    "2008-06-04 13:02:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job "
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-06 01:47:46
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    ------------------------ Other Running Processes ------------------------
    .
    C:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\wdfmgr.exe
    C:\Program Files\Viewpoint\Common\ViewpointService.exe
    C:\WINDOWS\system32\wscntfy.exe
    .
    **************************************************************************
    .
    Completion time: 2008-06-06 1:54:25 - machine was rebooted
    ComboFix-quarantined-files.txt 2008-06-06 05:54:22

    Pre-Run: 16,360,976,384 bytes free
    Post-Run: 16,346,787,840 bytes free

    200 --- E O F --- 2008-05-31 02:41:29


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 1:57:41 AM, on 6/6/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\PROGRA~1\COMMON~1\Stardock\SDMCP.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Viewpoint\Common\ViewpointService.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = local
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O4 - HKLM\..\Run: [combofix] C:\WINDOWS\system32\CF26184.exe /c C:\ComboFix\Combobatch.bat
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKUS\S-1-5-18\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background (User 'Default user')
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_04\bin\npjpi150_04.dll
    O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
    O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe (file missing)
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.2.1.87.cab
    O16 - DPF: {5F5F9FB8-878E-4455-95E0-F64B2314288A} - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin11USA.cab
    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab2.cab
    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} - http://download.divx.com/player/DivXBrowserPlugin.cab
    O16 - DPF: {A2E05F45-F127-4092-B9F7-9A02C3E04C77} (HGPlugin7USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin7USA.cab
    O16 - DPF: {BE833F39-1E0C-468C-BA70-25AAEE55775E} (System Requirements Lab) - http://www.systemrequirementslab.com/sysreqlab.cab
    O16 - DPF: {CD995117-98E5-4169-9920-6C12D4C0B548} (HGPlugin9USA Class) - http://gamedownload.ijjimax.com/gamedownload/dist/hgstart/HGPlugin9USA.cab
    O23 - Service: Apache - Unknown owner - C:\Program Files\Apache Group\Apache\Apache.exe (file missing)
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: McAfee Real-time Scanner (McShield) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcshield.exe (file missing)
    O23 - Service: McAfee SystemGuards (McSysmon) - Unknown owner - C:\PROGRA~1\McAfee\VIRUSS~1\mcsysmon.exe (file missing)
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
    O23 - Service: Serviço de protocolo Microsoft SSVP (svchostx) - Unknown owner - C:\WINDOWS\system\svchost.exe (file missing)
    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

    --
    End of file - 5232 bytes
     
    xy0n28,
    #5
  7. 2008/06/06
    noahdfear

    noahdfear Inactive

    Joined:
    2003/04/06
    Messages:
    12,178
    Likes Received:
    15
    Please restart the computer then create a new hijackThis log and post it here before we continue. Let me know if ComboFix runs again upon restart.
     
    noahdfear,
    #6

Share This Page

  1. This site uses cookies to help personalise content, tailor your experience and to keep you logged in if you register.
    By continuing to use this site, you are consenting to our use of cookies.
    Accept Learn More...