Page 2 of 4 FirstFirst 1234 LastLast
Results 11 to 20 of 37

Thread: Virtumonde / Zeno Search

  1. #11
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    Hi

    That's ok

    We need to disable TeaTimer temporarily. You can re-enable it after you're clean again:

    1. Run Spybot-S&D in Advanced Mode.
    2. If it is not already set to do this Go to the Mode menu select "Advanced Mode"
    3. On the left hand side, Click on Tools
    4. Then click on the Resident Icon in the List
    5. Uncheck "Resident TeaTimer" and OK any prompts.
    6. Restart your computer.

    After that:

    Please download VundoFix.exe to your desktop.
    • Double-click VundoFix.exe to run it.
    • Click the Scan for Vundo button.
    • Once it's done scanning, click the Remove Vundo button.
    • You will receive a prompt asking if you want to remove the files, click YES
    • Once you click yes, your desktop will go blank as it starts removing Vundo.
    • When completed, it will prompt that it will reboot your computer, click OK.
    • Please post the contents of C:\vundofix.txt and a new HiJackThis log.

    Note: It is possible that VundoFix encountered a file it could not remove.
    In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button." when VundoFix appears at reboot.

    1. Download combofix from one of these links:
    Link1
    Link2
    2. Double click combofix.exe & follow the prompts.
    3. When finished, it shall produce a log for you. Post that log in your next reply

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall

    - a fresh HijackThis log
    - combofix report
    - vundofix report
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006

  2. #12
    Junior Member
    Join Date
    Oct 2007
    Posts
    22

    Default trouble with spybot

    Ok it looks like i cannot run spy bot again. Last time this happened i removed it and re downloaded it. I will wait for your intructions this time. I did go ahead and download combo fix. I also have vundo fix on the system already but do not ave vundo.exe on my screen. Is it the same? GUessing so. I will probably not be able to do anything for about 20 hours from this time. Thanks for all the help.

  3. #13
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    Hi

    Atribune updates vundofix often, so please delete your copy of it and download new one from my link, please
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006

  4. #14
    Junior Member
    Join Date
    Oct 2007
    Posts
    22

    Default here are the log files

    VundoFix V6.5.9

    Checking Java version...

    Java version is 1.4.2.3
    Old versions of java are exploitable and should be removed.

    Scan started at 8:56:48 AM 10/4/2007

    Listing files found while scanning....

    C:\WINDOWS\system32\atpfbmlb.dll
    C:\WINDOWS\system32\blmbfpta.ini
    C:\windows\system32\dqodlcng.ini
    C:\windows\system32\elwerhno.dll
    C:\windows\system32\gncldoqd.dll
    C:\WINDOWS\system32\gtbnryib.dll
    C:\windows\system32\onhrewle.ini
    C:\WINDOWS\system32\uqxaidft.dll
    C:\windows\system32\vuuvw.bak1
    C:\windows\system32\vuuvw.bak2
    C:\windows\system32\vuuvw.ini
    C:\windows\system32\vuuvw.ini2
    C:\windows\system32\vuuvw.tmp
    C:\windows\system32\wvuuv.dll

    Beginning removal...

    Attempting to delete C:\WINDOWS\system32\atpfbmlb.dll
    C:\WINDOWS\system32\atpfbmlb.dll Could not be deleted.

    Attempting to delete C:\WINDOWS\system32\blmbfpta.ini
    C:\WINDOWS\system32\blmbfpta.ini Has been deleted!

    Attempting to delete C:\windows\system32\dqodlcng.ini
    C:\windows\system32\dqodlcng.ini Has been deleted!

    Attempting to delete C:\windows\system32\elwerhno.dll
    C:\windows\system32\elwerhno.dll Has been deleted!

    Attempting to delete C:\windows\system32\gncldoqd.dll
    C:\windows\system32\gncldoqd.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\gtbnryib.dll
    C:\WINDOWS\system32\gtbnryib.dll Could not be deleted.

    Attempting to delete C:\windows\system32\onhrewle.ini
    C:\windows\system32\onhrewle.ini Has been deleted!

    Attempting to delete C:\WINDOWS\system32\uqxaidft.dll
    C:\WINDOWS\system32\uqxaidft.dll Has been deleted!

    Attempting to delete C:\windows\system32\vuuvw.bak1
    C:\windows\system32\vuuvw.bak1 Has been deleted!

    Attempting to delete C:\windows\system32\vuuvw.bak2
    C:\windows\system32\vuuvw.bak2 Has been deleted!

    Attempting to delete C:\windows\system32\vuuvw.ini
    C:\windows\system32\vuuvw.ini Has been deleted!

    Attempting to delete C:\windows\system32\vuuvw.ini2
    C:\windows\system32\vuuvw.ini2 Has been deleted!

    Attempting to delete C:\windows\system32\vuuvw.tmp
    C:\windows\system32\vuuvw.tmp Has been deleted!

    Attempting to delete C:\windows\system32\wvuuv.dll
    C:\windows\system32\wvuuv.dll Could not be deleted.

    Performing Repairs to the registry.
    Done!

    Beginning removal...

    Attempting to delete C:\WINDOWS\system32\gtbnryib.dll
    C:\WINDOWS\system32\gtbnryib.dll Has been deleted!

    Attempting to delete C:\windows\system32\vuuvw.ini
    C:\windows\system32\vuuvw.ini Has been deleted!

    Attempting to delete C:\windows\system32\vuuvw.ini2
    C:\windows\system32\vuuvw.ini2 Has been deleted!

    Attempting to delete C:\windows\system32\wvuuv.dll
    C:\windows\system32\wvuuv.dll Could not be deleted.

    Performing Repairs to the registry.
    Done!

    Beginning removal...

    VundoFix V6.5.9

    Checking Java version...

    Java version is 1.4.2.3
    Old versions of java are exploitable and should be removed.

    Scan started at 9:21:50 AM 10/4/2007

    Listing files found while scanning....

    C:\windows\system32\vuuvw.ini
    C:\windows\system32\wvuuv.dll

    Beginning removal...

    Attempting to delete C:\windows\system32\vuuvw.ini
    C:\windows\system32\vuuvw.ini Has been deleted!

    Attempting to delete C:\windows\system32\wvuuv.dll
    C:\windows\system32\wvuuv.dll Could not be deleted.

    Performing Repairs to the registry.
    Done!

    Beginning removal...

    Attempting to delete C:\windows\system32\vuuvw.ini
    C:\windows\system32\vuuvw.ini Has been deleted!

    Attempting to delete C:\windows\system32\wvuuv.dll
    C:\windows\system32\wvuuv.dll Could not be deleted.

    Performing Repairs to the registry.
    Done!

    Beginning removal...

    VundoFix V6.5.9

    Checking Java version...

    Java version is 1.4.2.3
    Old versions of java are exploitable and should be removed.

    Scan started at 8:32:15 AM 10/5/2007

    Listing files found while scanning....

    C:\WINDOWS\system32\atpfbmlb.dll
    C:\WINDOWS\system32\mqrwdvpu.dll
    C:\windows\system32\vuuvw.bak2
    C:\windows\system32\vuuvw.ini
    C:\windows\system32\wvuuv.dll

    Beginning removal...

    Attempting to delete C:\WINDOWS\system32\mqrwdvpu.dll
    C:\WINDOWS\system32\mqrwdvpu.dll Has been deleted!

    Attempting to delete C:\windows\system32\vuuvw.bak2
    C:\windows\system32\vuuvw.bak2 Has been deleted!

    Attempting to delete C:\windows\system32\vuuvw.ini
    C:\windows\system32\vuuvw.ini Has been deleted!

    Attempting to delete C:\windows\system32\wvuuv.dll
    C:\windows\system32\wvuuv.dll Could not be deleted.

    Performing Repairs to the registry.
    Done!

    Beginning removal...

    VundoFix V6.5.9

    Checking Java version...

    Java version is 1.4.2.3
    Old versions of java are exploitable and should be removed.

    Scan started at 9:03:31 AM 10/5/2007

    Listing files found while scanning....

    C:\windows\system32\vuuvw.ini
    C:\windows\system32\wvuuv.dll

    VundoFix V6.5.9

    Checking Java version...

    Java version is 1.4.2.3
    Old versions of java are exploitable and should be removed.

    Scan started at 9:24:29 AM 10/5/2007

    Listing files found while scanning....

    C:\windows\system32\vuuvw.ini
    C:\windows\system32\wvuuv.dll

    Beginning removal...

    Attempting to delete C:\windows\system32\vuuvw.ini
    C:\windows\system32\vuuvw.ini Has been deleted!

    Attempting to delete C:\windows\system32\wvuuv.dll
    C:\windows\system32\wvuuv.dll Could not be deleted.

    Performing Repairs to the registry.
    Done!

    Beginning removal...

    Attempting to delete C:\windows\system32\vuuvw.ini
    C:\windows\system32\vuuvw.ini Has been deleted!

    Attempting to delete C:\windows\system32\wvuuv.dll
    C:\windows\system32\wvuuv.dll Could not be deleted.

    Performing Repairs to the registry.
    Done!

    VundoFix V6.5.9

    Checking Java version...

    Java version is 1.4.2.3
    Old versions of java are exploitable and should be removed.

    Scan started at 9:29:49 PM 10/9/2007

    Listing files found while scanning....

    C:\WINDOWS\system32\ispftoyq.dll
    C:\WINDOWS\system32\ivtxfheh.dll
    C:\WINDOWS\system32\qyotfpsi.ini
    C:\windows\system32\vuuvw.bak1
    C:\windows\system32\vuuvw.bak2
    C:\windows\system32\vuuvw.ini
    C:\windows\system32\wvuuv.dll

    Beginning removal...

    Attempting to delete C:\WINDOWS\system32\ispftoyq.dll
    C:\WINDOWS\system32\ispftoyq.dll Could not be deleted.

    Attempting to delete C:\WINDOWS\system32\ivtxfheh.dll
    C:\WINDOWS\system32\ivtxfheh.dll Could not be deleted.

    Attempting to delete C:\WINDOWS\system32\qyotfpsi.ini
    C:\WINDOWS\system32\qyotfpsi.ini Has been deleted!

    Attempting to delete C:\windows\system32\vuuvw.bak1
    C:\windows\system32\vuuvw.bak1 Has been deleted!

    Attempting to delete C:\windows\system32\vuuvw.bak2
    C:\windows\system32\vuuvw.bak2 Has been deleted!

    Attempting to delete C:\windows\system32\vuuvw.ini
    C:\windows\system32\vuuvw.ini Has been deleted!

    Attempting to delete C:\windows\system32\wvuuv.dll
    C:\windows\system32\wvuuv.dll Could not be deleted.

    Performing Repairs to the registry.
    Done!

    Beginning removal...

    Attempting to delete C:\WINDOWS\system32\ispftoyq.dll
    C:\WINDOWS\system32\ispftoyq.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\ivtxfheh.dll
    C:\WINDOWS\system32\ivtxfheh.dll Has been deleted!

    Attempting to delete C:\windows\system32\vuuvw.ini
    C:\windows\system32\vuuvw.ini Has been deleted!

    Attempting to delete C:\windows\system32\wvuuv.dll
    C:\windows\system32\wvuuv.dll Could not be deleted.

    Performing Repairs to the registry.
    Done!

    Beginning removal...

    Hijack This File
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:55:15 PM, on 10/9/2007
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\System32\WLTRYSVC.EXE
    C:\WINDOWS\System32\bcmwltry.exe
    C:\WINDOWS\system32\LEXBCES.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\LEXPPS.EXE
    C:\Program Files\Apoint\Apoint.exe
    C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe
    C:\Program Files\Dell\QuickSet\quickset.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program Files\Real\RealPlayer\RealPlay.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Apoint\Apntex.exe
    C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
    C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlservr.exe
    C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe
    C:\Program Files\Fisher-Price\FP3 Player\sspnotifier.exe
    C:\Program Files\Geek Superhero\GeekSuperhero.exe
    C:\Program Files\Lexmark X1100 Series\lxbkbmon.exe
    C:\Program Files\QuickTime\QTTask.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Messenger\msmsgs.exe
    C:\WINDOWS\system32\wbem\wmiapsrv.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\roscoe.exe.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/mywaybiz
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/yco...search/ie.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://us.rd.yahoo.com/customize/yco.../www.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/clientapps/Au...ch/search.html
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.yahoo.com
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - (no file)
    O1 - Hosts: 212.227.64.159 www.winmx.com
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: PopupSlapdown BHO - {1FEA39D6-46B3-4F66-BC38-4839CFE198EA} - C:\Program Files\Geek Superhero\GeekSuperheroX.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
    O2 - BHO: PhishingNet BHO - {DE3A0297-5EFF-4FF2-A48D-ABBC67D4D774} - C:\Program Files\Geek Superhero\GeekSuperheroX.dll
    O2 - BHO: (no name) - {F385598C-4C9B-4F50-8124-B2C316A3E00D} - C:\WINDOWS\system32\wvuuv.dll
    O3 - Toolbar: (no name) - {BA52B914-B692-46c4-B683-905236F6F655} - (no file)
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [DVDLauncher] "C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe"
    O4 - HKLM\..\Run: [Dell QuickSet] C:\Program Files\Dell\QuickSet\quickset.exe
    O4 - HKLM\..\Run: [UpdateManager] "C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" /r
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [RealTray] C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
    O4 - HKLM\..\Run: [DwlClient] C:\Program Files\Common Files\Dell\EUSW\Support.exe
    O4 - HKLM\..\Run: [bacstray] C:\Program Files\Broadcom\BACS\\BacsTray.exe
    O4 - HKLM\..\Run: [Lexmark X1100 Series] "C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe"
    O4 - HKLM\..\Run: [SSP Notifier] C:\Program Files\Fisher-Price\FP3 Player\sspnotifier.exe
    O4 - HKLM\..\Run: [Geek Superhero] C:\Program Files\Geek Superhero\GeekSuperhero.exe
    O4 - HKLM\..\Run: [CorelDRAW Graphics Suite 11b] C:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe /title="CorelDRAW Graphics Suite 12" /date=042606 serial=DR12WRX-0009792-RZG lang=EN
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
    O4 - HKCU\..\Run: [Stitch] C:\Program Files\Stitch\Stitch.exe
    O4 - HKCU\..\Run: [ccleaner] "C:\Program Files\CCleaner\CCleaner.exe" /AUTO
    O4 - Global Startup: QuickBooks Update Agent.lnk = C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
    O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: Bug Swatter Options - {99FEA1A2-7881-11D1-A9E2-00403320FCF2} - C:\Program Files\Geek Superhero\GeekSuperheroX.dll
    O9 - Extra button: Popup Slapdown Options - {A1100DDB-B277-4CAA-A640-B299D79FE25E} - C:\Program Files\Geek Superhero\GeekSuperheroX.dll
    O9 - Extra button: Phishing Net Options - {B1100DDB-B277-4CAA-A640-B299D79FE25E} - C:\Program Files\Geek Superhero\GeekSuperheroX.dll
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {406B5949-7190-4245-91A9-30A17DE16AD0} (Snapfish Activia) - http://www1.snapfish.com/SnapfishActivia.cab
    O16 - DPF: {6B75345B-AA36-438A-BBE6-4078B4C6984D} (HpProductDetection Class) - http://h20270.www2.hp.com/ediags/gmn...tDetection.cab
    O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAV...oadManager.ocx
    O18 - Filter hijack: text/html - {99FEA1B2-7881-11D1-A9E2-00403320FCF2} - C:\Program Files\Geek Superhero\GeekSuperheroX.dll
    O20 - Winlogon Notify: hgggdbx - hgggdbx.dll (file missing)
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LexBce Server (LexBceS) - Lexmark International, Inc. - C:\WINDOWS\system32\LEXBCES.EXE
    O23 - Service: NICSer_WPC54G - Unknown owner - C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
    O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\system32\HPZipm12.exe
    O23 - Service: Intuit QuickBooks FCS (QBFCService) - Intuit Inc. - C:\Program Files\Common Files\Intuit\QuickBooks\FCS\Intuit.QuickBooks.FCS.exe
    O23 - Service: Dell Wireless WLAN Tray Service (wltrysvc) - Unknown owner - C:\WINDOWS\System32\WLTRYSVC.EXE

    --
    End of file - 9076 bytes

  5. #15
    Junior Member
    Join Date
    Oct 2007
    Posts
    22

    Default after combo fix these are the logs

    Combo Fix
    ComboFix 07-10-09.3 - Jay 2007-10-09 22:32:26.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.659 [GMT -4:00]
    Running from: C:\Documents and Settings\Jay\Desktop\ComboFix.exe
    * Created a new restore point
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\check_LSA7.txt
    C:\Documents and Settings\All Users\Application Data.\salesmonitor
    C:\WINDOWS\cookies.ini
    C:\WINDOWS\system32\asccslpo.exe
    C:\WINDOWS\system32\bcmdqfxh.dll
    C:\WINDOWS\system32\bxvbvxul.exe
    C:\WINDOWS\system32\cjmjiuou.exe
    C:\WINDOWS\system32\clnwoist.exe
    C:\WINDOWS\system32\drivers\ApiMon.sys
    C:\WINDOWS\system32\drivers\fopn.sys
    C:\WINDOWS\SYSTEM32\drjcnltx.ini
    C:\WINDOWS\system32\etsospuh.dll
    C:\WINDOWS\system32\f02WtR
    C:\WINDOWS\system32\f02WtR\f02WtR1065.exe
    C:\WINDOWS\system32\fhagiibl.exe
    C:\WINDOWS\system32\fjfyakus.exe
    C:\WINDOWS\system32\gaeldmwc.exe
    C:\WINDOWS\system32\iaawkoxf.exe
    C:\WINDOWS\system32\iolqfwqb.exe
    C:\WINDOWS\system32\jkubebnk.exe
    C:\WINDOWS\system32\kitvhkmy.exe
    C:\WINDOWS\system32\mcnodvyi.dll
    C:\WINDOWS\SYSTEM32\mfaamvdw.ini
    C:\WINDOWS\SYSTEM32\mwbswcvq.ini
    C:\WINDOWS\system32\nexlbajk.exe
    C:\WINDOWS\system32\nhovtsoc.exe
    C:\WINDOWS\system32\nnalgiwp.exe
    C:\WINDOWS\system32\pwinsldt.exe
    C:\WINDOWS\system32\qqexpnia.exe
    C:\WINDOWS\system32\qvcwsbwm.dll
    C:\WINDOWS\system32\stera.exe
    C:\WINDOWS\system32\sycosjmq.exe
    C:\WINDOWS\system32\tgikutyb.exe
    C:\WINDOWS\system32\tlplyqnq.exe
    C:\WINDOWS\system32\vgwkmifp.exe
    C:\WINDOWS\SYSTEM32\vuuvw.ini
    C:\WINDOWS\system32\wdvmaafm.dll
    C:\WINDOWS\system32\wnbognem.exe
    C:\WINDOWS\SYSTEM32\wvuuv.dll
    C:\WINDOWS\system32\xdaoyvwj.exe
    C:\WINDOWS\system32\xjcqajhl.exe
    C:\WINDOWS\system32\xtlncjrd.dll

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


    -------\LEGACY_CMDSERVICE
    -------\LEGACY_DOMAINSERVICE
    -------\LEGACY_FOPN
    -------\LEGACY_NETWORK_MONITOR


    ((((((((((((((((((((((((( Files Created from 2007-09-10 to 2007-10-10 )))))))))))))))))))))))))))))))
    .

    2007-10-09 22:19 51,200 --a------ C:\WINDOWS\NirCmd.exe
    2007-10-07 09:40 <DIR> d-------- C:\Program Files\Trend Micro
    2007-10-05 10:51 <DIR> d-------- C:\Program Files\iPod
    2007-10-05 10:50 <DIR> d-------- C:\Program Files\iTunes
    2007-10-05 10:46 <DIR> d----c--- C:\WINDOWS\SYSTEM32\DRVSTORE
    2007-10-05 10:46 <DIR> d-------- C:\Program Files\Apple Software Update
    2007-10-05 10:46 30,336 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\usbaapl.sys
    2007-10-05 10:45 <DIR> d-------- C:\Program Files\Common Files\Apple
    2007-10-05 10:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple
    2007-10-05 08:52 <DIR> d-------- C:\Program Files\CCleaner
    2007-10-04 08:56 <DIR> d----c--- C:\VundoFix Backups
    2007-10-04 08:51 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
    2007-09-17 07:40 1,156 --a------ C:\WINDOWS\mozver.dat
    2007-09-13 21:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2007-09-13 21:41 <DIR> d-------- C:\Program Files\Geek Superhero
    2007-09-13 21:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ParetoLogic Anti-Spyware
    2007-09-10 22:32 <DIR> d--hs---- C:\WINDOWS\THVrZSBXb2x0ZXI
    2007-09-10 22:32 <DIR> d-------- C:\WINDOWS\SYSTEM32\dbl22
    2007-09-10 22:32 <DIR> d-------- C:\WINDOWS\SYSTEM32\cf2
    2007-09-10 22:32 <DIR> d-------- C:\WINDOWS\SYSTEM32\capcon

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2007-10-10 02:39 --------- d-----w C:\Program Files\Stitch
    2007-10-10 02:39 --------- d-----w C:\Documents and Settings\Jay\Application Data\Stitch
    2007-10-10 02:39 --------- d-----w C:\Documents and Settings\Jay\Application Data\Stitch
    2007-10-10 02:39 --------- d-----w C:\Documents and Settings\Jay\Application Data\Stitch
    2007-10-05 14:51 --------- d-----w C:\Documents and Settings\Jay\Application Data\Apple Computer
    2007-10-05 14:51 --------- d-----w C:\Documents and Settings\Jay\Application Data\Apple Computer
    2007-10-05 14:51 --------- d-----w C:\Documents and Settings\Jay\Application Data\Apple Computer
    2007-10-05 14:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
    2007-10-05 14:49 --------- d-----w C:\Program Files\QuickTime
    2007-09-11 04:10 --------- d-----w C:\Program Files\Funk Software
    2007-08-26 14:21 --------- d-----w C:\Documents and Settings\Jay\Application Data\AdobeUM
    2007-08-26 14:21 --------- d-----w C:\Documents and Settings\Jay\Application Data\AdobeUM
    2007-08-26 14:21 --------- d-----w C:\Documents and Settings\Jay\Application Data\AdobeUM
    2007-08-18 14:36 --------- d-----w C:\Documents and Settings\Jay\Application Data\Fisher-Price
    2007-08-18 14:36 --------- d-----w C:\Documents and Settings\Jay\Application Data\Fisher-Price
    2007-08-18 14:36 --------- d-----w C:\Documents and Settings\Jay\Application Data\Fisher-Price
    2007-08-18 14:35 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2007-08-18 14:35 --------- d-----w C:\Program Files\Fisher-Price
    2005-07-29 20:24:26 472 --sha-r C:\WINDOWS\THVrZSBXb2x0ZXI\nJpOtm1rvZUXtrK.vbs
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Apoint"="C:\Program Files\Apoint\Apoint.exe" [2004-08-21 20:04]
    "SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 19:48]
    "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-10-06 23:10]
    "DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-11 13:43]
    "Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2004-09-27 13:52]
    "UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 03:01]
    "dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-08-13 03:05]
    "RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2005-01-25 15:32]
    "DwlClient"="C:\Program Files\Common Files\Dell\EUSW\Support.exe" [2004-05-27 22:05]
    "bacstray"="C:\Program Files\Broadcom\BACS\\BacsTray.exe" [2003-12-15 14:08]
    "Lexmark X1100 Series"="C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" [2003-08-19 06:43]
    "SSP Notifier"="C:\Program Files\Fisher-Price\FP3 Player\sspnotifier.exe" [2006-07-12 11:44]
    "Geek Superhero"="C:\Program Files\Geek Superhero\GeekSuperhero.exe" [2006-12-22 12:27]
    "CorelDRAW Graphics Suite 11b"="C:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe" []
    "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24]
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-26 14:42]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24]
    "Stitch"="C:\Program Files\Stitch\Stitch.exe" [2007-08-20 10:12]
    "ccleaner"="C:\Program Files\CCleaner\CCleaner.exe" [2007-09-28 04:05]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    QuickBooks Update Agent.lnk - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2006-10-17 03:43:22]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hgggdbx]
    hgggdbx.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
    backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI]
    C:\WINDOWS\system32\WLTRAY.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
    C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet

    R2 NICSer_WPC54G;NICSer_WPC54G;C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
    R3 odysseyIM4;Odyssey Network Agent Miniport;C:\WINDOWS\system32\DRIVERS\odysseyIM4.sys
    S3 CBTNDIS5;CBTNDIS5 NDIS Protocol Driver;\??\C:\WINDOWS\system32\CBTNDIS5.SYS
    S3 SQLAgent$MICROSOFTBCM;SQLAgent$MICROSOFTBCM;C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlagent.EXE -i MICROSOFTBCM
    S3 USBAAPL;Apple Mobile USB Driver;C:\WINDOWS\system32\Drivers\usbaapl.sys

    .
    Contents of the 'Scheduled Tasks' folder
    "2007-10-06 22:47:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
    "2007-10-01 04:15:00 C:\WINDOWS\Tasks\Disk Cleanup.job"
    - C:\WINDOWS\SYSTEM32\cleanmgr.exe
    "2007-08-16 12:04:13 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2170 series#1183333652.job"
    - C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe
    "2007-10-09 22:00:00 C:\WINDOWS\Tasks\Pareto UNS.job"
    - C:\Program Files\Common Files\ParetoLogic\UUS\UUS.dll\Pareto_Update.exe
    "2007-09-12 10:54:49 C:\WINDOWS\Tasks\WebReg 20070912065448.job"
    - C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqwrg.exe
    .
    **************************************************************************

    catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-10-09 22:38:51
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    C:\WINDOWS\0.log

    scan completed successfully
    hidden files: 1

    **************************************************************************
    .
    Completion time: 2007-10-09 22:40:21 - machine was rebooted
    C:\ComboFix-quarantined-files.txt ... 2007-10-09 22:40
    .
    --- E O F ---

  6. #16
    Junior Member
    Join Date
    Oct 2007
    Posts
    22

    Default after combo Hijack log

    ComboFix 07-10-09.3 - Jay 2007-10-09 22:32:26.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.659 [GMT -4:00]
    Running from: C:\Documents and Settings\Jay\Desktop\ComboFix.exe
    * Created a new restore point
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\check_LSA7.txt
    C:\Documents and Settings\All Users\Application Data.\salesmonitor
    C:\WINDOWS\cookies.ini
    C:\WINDOWS\system32\asccslpo.exe
    C:\WINDOWS\system32\bcmdqfxh.dll
    C:\WINDOWS\system32\bxvbvxul.exe
    C:\WINDOWS\system32\cjmjiuou.exe
    C:\WINDOWS\system32\clnwoist.exe
    C:\WINDOWS\system32\drivers\ApiMon.sys
    C:\WINDOWS\system32\drivers\fopn.sys
    C:\WINDOWS\SYSTEM32\drjcnltx.ini
    C:\WINDOWS\system32\etsospuh.dll
    C:\WINDOWS\system32\f02WtR
    C:\WINDOWS\system32\f02WtR\f02WtR1065.exe
    C:\WINDOWS\system32\fhagiibl.exe
    C:\WINDOWS\system32\fjfyakus.exe
    C:\WINDOWS\system32\gaeldmwc.exe
    C:\WINDOWS\system32\iaawkoxf.exe
    C:\WINDOWS\system32\iolqfwqb.exe
    C:\WINDOWS\system32\jkubebnk.exe
    C:\WINDOWS\system32\kitvhkmy.exe
    C:\WINDOWS\system32\mcnodvyi.dll
    C:\WINDOWS\SYSTEM32\mfaamvdw.ini
    C:\WINDOWS\SYSTEM32\mwbswcvq.ini
    C:\WINDOWS\system32\nexlbajk.exe
    C:\WINDOWS\system32\nhovtsoc.exe
    C:\WINDOWS\system32\nnalgiwp.exe
    C:\WINDOWS\system32\pwinsldt.exe
    C:\WINDOWS\system32\qqexpnia.exe
    C:\WINDOWS\system32\qvcwsbwm.dll
    C:\WINDOWS\system32\stera.exe
    C:\WINDOWS\system32\sycosjmq.exe
    C:\WINDOWS\system32\tgikutyb.exe
    C:\WINDOWS\system32\tlplyqnq.exe
    C:\WINDOWS\system32\vgwkmifp.exe
    C:\WINDOWS\SYSTEM32\vuuvw.ini
    C:\WINDOWS\system32\wdvmaafm.dll
    C:\WINDOWS\system32\wnbognem.exe
    C:\WINDOWS\SYSTEM32\wvuuv.dll
    C:\WINDOWS\system32\xdaoyvwj.exe
    C:\WINDOWS\system32\xjcqajhl.exe
    C:\WINDOWS\system32\xtlncjrd.dll

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))


    -------\LEGACY_CMDSERVICE
    -------\LEGACY_DOMAINSERVICE
    -------\LEGACY_FOPN
    -------\LEGACY_NETWORK_MONITOR


    ((((((((((((((((((((((((( Files Created from 2007-09-10 to 2007-10-10 )))))))))))))))))))))))))))))))
    .

    2007-10-09 22:19 51,200 --a------ C:\WINDOWS\NirCmd.exe
    2007-10-07 09:40 <DIR> d-------- C:\Program Files\Trend Micro
    2007-10-05 10:51 <DIR> d-------- C:\Program Files\iPod
    2007-10-05 10:50 <DIR> d-------- C:\Program Files\iTunes
    2007-10-05 10:46 <DIR> d----c--- C:\WINDOWS\SYSTEM32\DRVSTORE
    2007-10-05 10:46 <DIR> d-------- C:\Program Files\Apple Software Update
    2007-10-05 10:46 30,336 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\usbaapl.sys
    2007-10-05 10:45 <DIR> d-------- C:\Program Files\Common Files\Apple
    2007-10-05 10:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple
    2007-10-05 08:52 <DIR> d-------- C:\Program Files\CCleaner
    2007-10-04 08:56 <DIR> d----c--- C:\VundoFix Backups
    2007-10-04 08:51 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
    2007-09-17 07:40 1,156 --a------ C:\WINDOWS\mozver.dat
    2007-09-13 21:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2007-09-13 21:41 <DIR> d-------- C:\Program Files\Geek Superhero
    2007-09-13 21:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ParetoLogic Anti-Spyware
    2007-09-10 22:32 <DIR> d--hs---- C:\WINDOWS\THVrZSBXb2x0ZXI
    2007-09-10 22:32 <DIR> d-------- C:\WINDOWS\SYSTEM32\dbl22
    2007-09-10 22:32 <DIR> d-------- C:\WINDOWS\SYSTEM32\cf2
    2007-09-10 22:32 <DIR> d-------- C:\WINDOWS\SYSTEM32\capcon

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2007-10-10 02:39 --------- d-----w C:\Program Files\Stitch
    2007-10-10 02:39 --------- d-----w C:\Documents and Settings\Jay\Application Data\Stitch
    2007-10-10 02:39 --------- d-----w C:\Documents and Settings\Jay\Application Data\Stitch
    2007-10-10 02:39 --------- d-----w C:\Documents and Settings\Jay\Application Data\Stitch
    2007-10-05 14:51 --------- d-----w C:\Documents and Settings\Jay\Application Data\Apple Computer
    2007-10-05 14:51 --------- d-----w C:\Documents and Settings\Jay\Application Data\Apple Computer
    2007-10-05 14:51 --------- d-----w C:\Documents and Settings\Jay\Application Data\Apple Computer
    2007-10-05 14:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
    2007-10-05 14:49 --------- d-----w C:\Program Files\QuickTime
    2007-09-11 04:10 --------- d-----w C:\Program Files\Funk Software
    2007-08-26 14:21 --------- d-----w C:\Documents and Settings\Jay\Application Data\AdobeUM
    2007-08-26 14:21 --------- d-----w C:\Documents and Settings\Jay\Application Data\AdobeUM
    2007-08-26 14:21 --------- d-----w C:\Documents and Settings\Jay\Application Data\AdobeUM
    2007-08-18 14:36 --------- d-----w C:\Documents and Settings\Jay\Application Data\Fisher-Price
    2007-08-18 14:36 --------- d-----w C:\Documents and Settings\Jay\Application Data\Fisher-Price
    2007-08-18 14:36 --------- d-----w C:\Documents and Settings\Jay\Application Data\Fisher-Price
    2007-08-18 14:35 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2007-08-18 14:35 --------- d-----w C:\Program Files\Fisher-Price
    2005-07-29 20:24:26 472 --sha-r C:\WINDOWS\THVrZSBXb2x0ZXI\nJpOtm1rvZUXtrK.vbs
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Apoint"="C:\Program Files\Apoint\Apoint.exe" [2004-08-21 20:04]
    "SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 19:48]
    "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-10-06 23:10]
    "DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-11 13:43]
    "Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2004-09-27 13:52]
    "UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 03:01]
    "dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-08-13 03:05]
    "RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2005-01-25 15:32]
    "DwlClient"="C:\Program Files\Common Files\Dell\EUSW\Support.exe" [2004-05-27 22:05]
    "bacstray"="C:\Program Files\Broadcom\BACS\\BacsTray.exe" [2003-12-15 14:08]
    "Lexmark X1100 Series"="C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" [2003-08-19 06:43]
    "SSP Notifier"="C:\Program Files\Fisher-Price\FP3 Player\sspnotifier.exe" [2006-07-12 11:44]
    "Geek Superhero"="C:\Program Files\Geek Superhero\GeekSuperhero.exe" [2006-12-22 12:27]
    "CorelDRAW Graphics Suite 11b"="C:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe" []
    "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24]
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-26 14:42]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24]
    "Stitch"="C:\Program Files\Stitch\Stitch.exe" [2007-08-20 10:12]
    "ccleaner"="C:\Program Files\CCleaner\CCleaner.exe" [2007-09-28 04:05]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    QuickBooks Update Agent.lnk - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2006-10-17 03:43:22]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hgggdbx]
    hgggdbx.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
    backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI]
    C:\WINDOWS\system32\WLTRAY.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
    C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet

    R2 NICSer_WPC54G;NICSer_WPC54G;C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
    R3 odysseyIM4;Odyssey Network Agent Miniport;C:\WINDOWS\system32\DRIVERS\odysseyIM4.sys
    S3 CBTNDIS5;CBTNDIS5 NDIS Protocol Driver;\??\C:\WINDOWS\system32\CBTNDIS5.SYS
    S3 SQLAgent$MICROSOFTBCM;SQLAgent$MICROSOFTBCM;C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlagent.EXE -i MICROSOFTBCM
    S3 USBAAPL;Apple Mobile USB Driver;C:\WINDOWS\system32\Drivers\usbaapl.sys

    .
    Contents of the 'Scheduled Tasks' folder
    "2007-10-06 22:47:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
    "2007-10-01 04:15:00 C:\WINDOWS\Tasks\Disk Cleanup.job"
    - C:\WINDOWS\SYSTEM32\cleanmgr.exe
    "2007-08-16 12:04:13 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2170 series#1183333652.job"
    - C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe
    "2007-10-09 22:00:00 C:\WINDOWS\Tasks\Pareto UNS.job"
    - C:\Program Files\Common Files\ParetoLogic\UUS\UUS.dll\Pareto_Update.exe
    "2007-09-12 10:54:49 C:\WINDOWS\Tasks\WebReg 20070912065448.job"
    - C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqwrg.exe
    .
    **************************************************************************

    catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-10-09 22:38:51
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    C:\WINDOWS\0.log

    scan completed successfully
    hidden files: 1

    **************************************************************************
    .
    Completion time: 2007-10-09 22:40:21 - machine was rebooted
    C:\ComboFix-quarantined-files.txt ... 2007-10-09 22:40
    .
    --- E O F ---

  7. #17
    Junior Member
    Join Date
    Oct 2007
    Posts
    22

    Default after combo vundo log

    i cannot find a log for the last Vundo fix scan. It said no vundo found. FIrst time this has happened.

  8. #18
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    Hi

    Open notepad and copy/paste the text in the quotebox below into it:

    Code:
    Folder::
    C:\WINDOWS\THVrZSBXb2x0ZXI
    C:\WINDOWS\SYSTEM32\dbl22
    C:\WINDOWS\SYSTEM32\cf2
    C:\WINDOWS\SYSTEM32\capcon
    
    Registry::
    [-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\hgggdbx]
    Save this as "CFScript"

    Then drag the CFScript into ComboFix.exe as you see in the screenshot below.



    This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006

  9. #19
    Junior Member
    Join Date
    Oct 2007
    Posts
    22

    Default combo fix log 1/2

    ComboFix 07-10-09.3 - Jay 2007-10-10 23:09:35.2 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.639 [GMT -4:00]
    Running from: C:\Documents and Settings\Jay\Desktop\ComboFix.exe
    Command switches used :: C:\Documents and Settings\Jay\Desktop\CFscript.txt
    * Created a new restore point
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\SYSTEM32\capcon
    C:\WINDOWS\SYSTEM32\capcon\son22011.exe
    C:\WINDOWS\SYSTEM32\cf2
    C:\WINDOWS\SYSTEM32\cf2\mac33p.exe
    C:\WINDOWS\SYSTEM32\dbl22
    C:\WINDOWS\SYSTEM32\dbl22\mano2cep.exe
    C:\WINDOWS\THVrZSBXb2x0ZXI
    C:\WINDOWS\THVrZSBXb2x0ZXI\nJpOtm1rvZUXtrK.vbs

    .
    ((((((((((((((((((((((((( Files Created from 2007-09-11 to 2007-10-11 )))))))))))))))))))))))))))))))
    .

    2007-10-10 00:40 584,192 --------- C:\WINDOWS\SYSTEM32\DLLCACHE\rpcrt4.dll
    2007-10-09 22:19 51,200 --a------ C:\WINDOWS\NirCmd.exe
    2007-10-07 09:40 <DIR> d-------- C:\Program Files\Trend Micro
    2007-10-05 10:51 <DIR> d-------- C:\Program Files\iPod
    2007-10-05 10:50 <DIR> d-------- C:\Program Files\iTunes
    2007-10-05 10:46 <DIR> d----c--- C:\WINDOWS\SYSTEM32\DRVSTORE
    2007-10-05 10:46 <DIR> d-------- C:\Program Files\Apple Software Update
    2007-10-05 10:46 30,336 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\usbaapl.sys
    2007-10-05 10:45 <DIR> d-------- C:\Program Files\Common Files\Apple
    2007-10-05 10:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple
    2007-10-05 08:52 <DIR> d-------- C:\Program Files\CCleaner
    2007-10-04 08:56 <DIR> d----c--- C:\VundoFix Backups
    2007-10-04 08:51 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
    2007-09-17 07:40 1,156 --a------ C:\WINDOWS\mozver.dat
    2007-09-13 21:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2007-09-13 21:41 <DIR> d-------- C:\Program Files\Geek Superhero
    2007-09-13 21:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ParetoLogic Anti-Spyware

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2007-10-10 07:08 --------- d-----w C:\Program Files\Stitch
    2007-10-10 07:08 --------- d-----w C:\Documents and Settings\Jay\Application Data\Stitch
    2007-10-05 14:51 --------- d-----w C:\Documents and Settings\Jay\Application Data\Apple Computer
    2007-10-05 14:50 --------- d-----w C:\Documents and Settings\All Users\Application Data\Apple Computer
    2007-10-05 14:49 --------- d-----w C:\Program Files\QuickTime
    2007-09-11 04:10 --------- d-----w C:\Program Files\Funk Software
    2007-08-26 14:21 --------- d-----w C:\Documents and Settings\Jay\Application Data\AdobeUM
    2007-08-22 12:55 96,256 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\inseng.dll
    2007-08-22 12:55 665,600 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\wininet.dll
    2007-08-22 12:55 617,984 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\urlmon.dll
    2007-08-22 12:55 55,808 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\extmgr.dll
    2007-08-22 12:55 532,480 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mstime.dll
    2007-08-22 12:55 474,112 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\shlwapi.dll
    2007-08-22 12:55 449,024 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtmled.dll
    2007-08-22 12:55 39,424 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\pngfilt.dll
    2007-08-22 12:55 357,888 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\dxtmsft.dll
    2007-08-22 12:55 3,064,832 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\mshtml.dll
    2007-08-22 12:55 251,904 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\iepeers.dll
    2007-08-22 12:55 205,824 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\dxtrans.dll
    2007-08-22 12:55 16,384 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\jsproxy.dll
    2007-08-22 12:55 151,040 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\cdfview.dll
    2007-08-22 12:55 146,432 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\msrating.dll
    2007-08-22 12:55 1,498,112 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\shdocvw.dll
    2007-08-22 12:55 1,054,208 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\danim.dll
    2007-08-22 12:55 1,022,976 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\browseui.dll
    2007-08-21 10:19 18,432 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\iedw.exe
    2007-08-21 06:15 683,520 ----a-w C:\WINDOWS\SYSTEM32\inetcomm.dll
    2007-08-21 06:15 683,520 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\inetcomm.dll
    2007-08-18 14:36 --------- d-----w C:\Documents and Settings\Jay\Application Data\Fisher-Price
    2007-08-18 14:35 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2007-08-18 14:35 --------- d-----w C:\Program Files\Fisher-Price
    2007-07-30 23:19 92,504 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\cdm.dll
    2007-07-30 23:19 92,504 ----a-w C:\WINDOWS\SYSTEM32\cdm.dll
    2007-07-30 23:19 549,720 ----a-w C:\WINDOWS\SYSTEM32\wuapi.dll
    2007-07-30 23:19 549,720 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wuapi.dll
    2007-07-30 23:19 53,080 ----a-w C:\WINDOWS\SYSTEM32\wuauclt.exe
    2007-07-30 23:19 53,080 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wuauclt.exe
    2007-07-30 23:19 43,352 ----a-w C:\WINDOWS\SYSTEM32\wups2.dll
    2007-07-30 23:19 325,976 ----a-w C:\WINDOWS\SYSTEM32\wucltui.dll
    2007-07-30 23:19 325,976 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wucltui.dll
    2007-07-30 23:19 271,224 ----a-w C:\WINDOWS\SYSTEM32\mucltui.dll
    2007-07-30 23:19 207,736 ----a-w C:\WINDOWS\SYSTEM32\muweb.dll
    2007-07-30 23:19 203,096 ----a-w C:\WINDOWS\SYSTEM32\wuweb.dll
    2007-07-30 23:19 203,096 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wuweb.dll
    2007-07-30 23:19 1,712,984 ----a-w C:\WINDOWS\SYSTEM32\wuaueng.dll
    2007-07-30 23:19 1,712,984 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wuaueng.dll
    2007-07-30 23:18 33,624 ----a-w C:\WINDOWS\SYSTEM32\WUPS.DLL
    2007-07-30 23:18 33,624 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\wups.dll
    .

    ((((((((((((((((((((((((((((( snapshot@2007-10-09_22.39.52.15 )))))))))))))))))))))))))))))))))))))))))
    .
    ----a-w 14,048 2005-10-12 23:12:25 C:\WINDOWS\$hf_mig$\KB933729\spmsg.dll
    ----a-w 213,216 2005-10-12 23:12:26 C:\WINDOWS\$hf_mig$\KB933729\spuninst.exe
    ----a-w 582,656 2007-07-09 13:16:16 C:\WINDOWS\$hf_mig$\KB933729\SP2QFE\rpcrt4.dll
    ----a-w 350,720 2007-06-19 07:24:36 C:\WINDOWS\$hf_mig$\KB933729\SP2QFE\xpsp3res.dll
    ----a-w 22,752 2005-10-12 23:12:25 C:\WINDOWS\$hf_mig$\KB933729\update\spcustom.dll
    ----a-w 716,000 2005-10-12 23:12:28 C:\WINDOWS\$hf_mig$\KB933729\update\update.exe
    ----a-w 371,424 2005-10-12 23:12:33 C:\WINDOWS\$hf_mig$\KB933729\update\updspapi.dll
    ----a-w 14,048 2007-03-06 01:22:36 C:\WINDOWS\$hf_mig$\KB941202\spmsg.dll
    ----a-w 213,216 2007-03-06 01:22:41 C:\WINDOWS\$hf_mig$\KB941202\spuninst.exe
    ----a-w 683,520 2007-08-21 06:25:02 C:\WINDOWS\$hf_mig$\KB941202\SP2QFE\inetcomm.dll
    ----a-w 22,752 2007-03-06 01:22:34 C:\WINDOWS\$hf_mig$\KB941202\update\spcustom.dll
    ----a-w 716,000 2007-03-06 01:22:59 C:\WINDOWS\$hf_mig$\KB941202\update\update.exe
    ----a-w 371,424 2007-03-06 01:23:51 C:\WINDOWS\$hf_mig$\KB941202\update\updspapi.dll
    -c----w 581,120 2004-08-04 11:00:00 C:\WINDOWS\$NtUninstallKB933729$\rpcrt4.dll
    -c----w 213,216 2005-10-12 23:12:26 C:\WINDOWS\$NtUninstallKB933729$\spuninst\spuninst.exe
    -c----w 371,424 2005-10-12 23:12:33 C:\WINDOWS\$NtUninstallKB933729$\spuninst\updspapi.dll
    -c----w 1,022,976 2007-06-15 08:12:28 C:\WINDOWS\$NtUninstallKB939653$\browseui.dll
    -c----w 151,040 2007-06-15 08:12:28 C:\WINDOWS\$NtUninstallKB939653$\cdfview.dll
    -c----w 1,054,208 2007-06-15 08:12:28 C:\WINDOWS\$NtUninstallKB939653$\danim.dll
    -c----w 357,888 2007-06-15 08:12:28 C:\WINDOWS\$NtUninstallKB939653$\dxtmsft.dll
    -c----w 205,824 2007-06-15 08:12:28 C:\WINDOWS\$NtUninstallKB939653$\dxtrans.dll
    -c----w 55,808 2007-06-15 08:12:28 C:\WINDOWS\$NtUninstallKB939653$\extmgr.dll
    -c----w 18,432 2007-06-14 10:32:36 C:\WINDOWS\$NtUninstallKB939653$\iedw.exe
    -c----w 251,904 2007-06-15 08:12:28 C:\WINDOWS\$NtUninstallKB939653$\iepeers.dll
    -c----w 96,256 2007-06-15 08:12:28 C:\WINDOWS\$NtUninstallKB939653$\inseng.dll
    -c----w 16,384 2007-06-15 08:12:28 C:\WINDOWS\$NtUninstallKB939653$\jsproxy.dll
    -c----w 3,064,320 2007-06-15 08:12:29 C:\WINDOWS\$NtUninstallKB939653$\mshtml.dll
    -c----w 449,024 2007-06-15 08:12:29 C:\WINDOWS\$NtUninstallKB939653$\mshtmled.dll
    -c----w 146,432 2007-06-15 08:12:29 C:\WINDOWS\$NtUninstallKB939653$\msrating.dll
    -c----w 532,480 2007-06-15 08:12:29 C:\WINDOWS\$NtUninstallKB939653$\mstime.dll
    -c----w 39,424 2007-06-15 08:12:29 C:\WINDOWS\$NtUninstallKB939653$\pngfilt.dll
    -c----w 1,498,112 2007-06-15 08:12:30 C:\WINDOWS\$NtUninstallKB939653$\shdocvw.dll
    -c----w 474,112 2007-06-15 08:12:30 C:\WINDOWS\$NtUninstallKB939653$\shlwapi.dll
    -c----w 616,960 2007-06-15 08:12:30 C:\WINDOWS\$NtUninstallKB939653$\urlmon.dll
    -c----w 665,600 2007-06-26 14:35:54 C:\WINDOWS\$NtUninstallKB939653$\wininet.dll
    -c----w 350,720 2007-06-14 10:08:46 C:\WINDOWS\$NtUninstallKB939653$\xpsp3res.dll
    -c----w 213,216 2007-03-06 01:22:41 C:\WINDOWS\$NtUninstallKB939653$\spuninst\spuninst.exe
    -c----w 371,424 2007-03-06 01:23:51 C:\WINDOWS\$NtUninstallKB939653$\spuninst\updspapi.dll
    -c----w 683,520 2007-05-16 15:12:02 C:\WINDOWS\$NtUninstallKB941202$\inetcomm.dll
    -c----w 213,216 2007-03-06 01:22:41 C:\WINDOWS\$NtUninstallKB941202$\spuninst\spuninst.exe
    -c----w 371,424 2007-03-06 01:23:51 C:\WINDOWS\$NtUninstallKB941202$\spuninst\updspapi.dll
    ----a-r 593,920 2007-10-10 07:00:58 C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\accicons.exe
    ----a-r 12,288 2007-10-10 07:00:58 C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
    ----a-r 135,168 2007-10-10 07:00:58 C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\misc.exe
    ----a-r 11,264 2007-10-10 07:00:58 C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
    ----a-r 27,136 2007-10-10 07:00:58 C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
    ----a-r 4,096 2007-10-10 07:00:58 C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
    ----a-r 794,624 2007-10-10 07:00:58 C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\outicon.exe
    ----a-r 249,856 2007-10-10 07:00:58 C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\pptico.exe
    ----a-r 61,440 2007-10-10 07:00:58 C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\pubs.exe
    ----a-r 23,040 2007-10-10 07:00:58 C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
    ----a-r 286,720 2007-10-10 07:00:58 C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
    ----a-r 409,600 2007-10-10 07:00:58 C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
    ----a-w 14,048 2007-03-06 01:22:36 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\spmsg.dll
    ----a-w 213,216 2007-03-06 01:22:41 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\spuninst.exe
    ----a-w 1,022,976 2007-08-22 12:55:28 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\browseui.dll
    ----a-w 151,040 2007-08-22 12:55:29 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\cdfview.dll
    ----a-w 1,054,208 2007-08-22 12:55:30 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\danim.dll
    ----a-w 357,888 2007-08-22 12:55:30 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\dxtmsft.dll
    ----a-w 205,824 2007-08-22 12:55:31 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\dxtrans.dll
    ----a-w 55,808 2007-08-22 12:55:31 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\extmgr.dll
    ----a-w 18,432 2007-08-21 10:19:39 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\iedw.exe
    ----a-w 251,904 2007-08-22 12:55:32 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\iepeers.dll
    ----a-w 96,256 2007-08-22 12:55:32 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\inseng.dll
    ----a-w 16,384 2007-08-22 12:55:32 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\jsproxy.dll
    ----a-w 3,064,832 2007-08-22 12:55:36 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\mshtml.dll
    ----a-w 449,024 2007-08-22 12:55:37 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\mshtmled.dll
    ----a-w 146,432 2007-08-22 12:55:37 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\msrating.dll
    ----a-w 532,480 2007-08-22 12:55:38 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\mstime.dll
    ----a-w 39,424 2007-08-22 12:55:38 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\pngfilt.dll
    ----a-w 1,498,112 2007-08-22 12:55:40 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\shdocvw.dll
    ----a-w 474,112 2007-08-22 12:55:41 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\shlwapi.dll
    ----a-w 617,984 2007-08-22 12:55:43 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\urlmon.dll
    ----a-w 665,600 2007-08-22 12:55:44 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\wininet.dll
    ----a-w 350,720 2007-08-21 10:13:33 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\sp2qfe\xpsp3res.dll
    ----a-w 22,752 2007-03-06 01:22:34 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\update\spcustom.dll
    ----a-w 716,000 2007-03-06 01:22:59 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\update\update.exe
    ----a-w 371,424 2007-03-06 01:23:51 C:\WINDOWS\SoftwareDistribution\Download\0474e07262334919ca66aaa879430a63\update\updspapi.dll
    ----a-w 14,048 2005-10-12 23:12:25 C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\spmsg.dll
    ----a-w 213,216 2005-10-12 23:12:26 C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\spuninst.exe
    ----a-w 584,192 2007-07-09 13:09:42 C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\SP2GDR\rpcrt4.dll
    ----a-w 115,712 2007-06-13 06:53:14 C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\SP2GDR\xpsp3res.dll
    ----a-w 582,656 2007-07-09 13:16:16 C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\SP2QFE\rpcrt4.dll
    ----a-w 350,720 2007-06-19 07:24:36 C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\SP2QFE\xpsp3res.dll
    ----a-w 22,752 2005-10-12 23:12:25 C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\update\spcustom.dll
    ----a-w 716,000 2005-10-12 23:12:28 C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\update\update.exe
    ----a-w 371,424 2005-10-12 23:12:33 C:\WINDOWS\SoftwareDistribution\Download\28d74bdac17e30d3a4336176766f2e4a\update\updspapi.dll
    ----a-w 14,048 2007-03-06 01:22:36 C:\WINDOWS\SoftwareDistribution\Download\8c426bb59cb8f380ba397304c1c563d0\spmsg.dll
    ----a-w 213,216 2007-03-06 01:22:41 C:\WINDOWS\SoftwareDistribution\Download\8c426bb59cb8f380ba397304c1c563d0\spuninst.exe
    ----a-w 683,520 2007-08-21 06:15:44 C:\WINDOWS\SoftwareDistribution\Download\8c426bb59cb8f380ba397304c1c563d0\sp2gdr\inetcomm.dll
    ----a-w 683,520 2007-08-21 06:25:02 C:\WINDOWS\SoftwareDistribution\Download\8c426bb59cb8f380ba397304c1c563d0\sp2qfe\inetcomm.dll
    ----a-w 22,752 2007-03-06 01:22:34 C:\WINDOWS\SoftwareDistribution\Download\8c426bb59cb8f380ba397304c1c563d0\update\spcustom.dll
    ----a-w 716,000 2007-03-06 01:22:59 C:\WINDOWS\SoftwareDistribution\Download\8c426bb59cb8f380ba397304c1c563d0\update\update.exe
    ----a-w 371,424 2007-03-06 01:23:51 C:\WINDOWS\SoftwareDistribution\Download\8c426bb59cb8f380ba397304c1c563d0\update\updspapi.dll
    ----a-w 1,022,976 2007-08-22 12:55:28 C:\WINDOWS\SYSTEM32\browseui.dll
    ----a-w 151,040 2007-08-22 12:55:29 C:\WINDOWS\SYSTEM32\cdfview.dll
    ----a-w 1,054,208 2007-08-22 12:55:30 C:\WINDOWS\SYSTEM32\danim.dll
    ----a-w 357,888 2007-08-22 12:55:30 C:\WINDOWS\SYSTEM32\dxtmsft.dll
    ----a-w 205,824 2007-08-22 12:55:31 C:\WINDOWS\SYSTEM32\dxtrans.dll
    ----a-w 55,808 2007-08-22 12:55:31 C:\WINDOWS\SYSTEM32\extmgr.dll
    ----a-w 251,904 2007-08-22 12:55:32 C:\WINDOWS\SYSTEM32\iepeers.dll
    ----a-w 96,256 2007-08-22 12:55:32 C:\WINDOWS\SYSTEM32\inseng.dll
    ----a-w 16,384 2007-08-22 12:55:32 C:\WINDOWS\SYSTEM32\jsproxy.dll
    ----a-w 18,089,592 2007-09-28 05:19:39 C:\WINDOWS\SYSTEM32\MRT.exe
    ----a-w 3,064,832 2007-08-22 12:55:36 C:\WINDOWS\SYSTEM32\mshtml.dll
    ----a-w 449,024 2007-08-22 12:55:37 C:\WINDOWS\SYSTEM32\mshtmled.dll
    ----a-w 146,432 2007-08-22 12:55:37 C:\WINDOWS\SYSTEM32\msrating.dll
    ----a-w 532,480 2007-08-22 12:55:38 C:\WINDOWS\SYSTEM32\mstime.dll
    ----a-w 39,424 2007-08-22 12:55:38 C:\WINDOWS\SYSTEM32\pngfilt.dll
    ----a-w 584,192 2007-07-09 13:09:42 C:\WINDOWS\SYSTEM32\rpcrt4.dll
    ----a-w 1,498,112 2007-08-22 12:55:40 C:\WINDOWS\SYSTEM32\shdocvw.dll
    ----a-w 474,112 2007-08-22 12:55:41 C:\WINDOWS\SYSTEM32\shlwapi.dll
    ------w 14,048 2005-10-12 23:12:25 C:\WINDOWS\SYSTEM32\spmsg.dll
    ----a-w 617,984 2007-08-22 12:55:43 C:\WINDOWS\SYSTEM32\urlmon.dll
    ----a-w 665,600 2007-08-22 12:55:44 C:\WINDOWS\SYSTEM32\wininet.dll
    ----a-w 350,720 2007-08-21 10:13:33 C:\WINDOWS\SYSTEM32\xpsp3res.dll
    ----atw 16,384 2007-10-10 07:09:23 C:\WINDOWS\Temp\Perflib_Perfdata_cf4.dat

  10. #20
    Junior Member
    Join Date
    Oct 2007
    Posts
    22

    Default com fix log 2nd 1/2

    ----a-r 593,920 2007-09-20 07:09:22 C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\accicons.exe
    ----a-r 12,288 2007-09-20 07:09:22 C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\cagicon.exe
    ----a-r 135,168 2007-09-20 07:09:22 C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\misc.exe
    ----a-r 11,264 2007-09-20 07:09:22 C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\mspicons.exe
    ----a-r 27,136 2007-09-20 07:09:22 C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\oisicon.exe
    ----a-r 4,096 2007-09-20 07:09:23 C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\opwicon.exe
    ----a-r 794,624 2007-09-20 07:09:23 C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\outicon.exe
    ----a-r 249,856 2007-09-20 07:09:22 C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\pptico.exe
    ----a-r 61,440 2007-09-20 07:09:22 C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\pubs.exe
    ----a-r 23,040 2007-09-20 07:09:23 C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\unbndico.exe
    ----a-r 286,720 2007-09-20 07:09:21 C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\wordicon.exe
    ----a-r 409,600 2007-09-20 07:09:21 C:\WINDOWS\Installer\{91110409-6000-11D3-8CFE-0150048383C9}\xlicons.exe
    ----a-w 1,022,976 2007-06-15 08:12:28 C:\WINDOWS\SYSTEM32\browseui.dll
    ----a-w 151,040 2007-06-15 08:12:28 C:\WINDOWS\SYSTEM32\cdfview.dll
    ----a-w 1,054,208 2007-06-15 08:12:28 C:\WINDOWS\SYSTEM32\danim.dll
    ----a-w 357,888 2007-06-15 08:12:28 C:\WINDOWS\SYSTEM32\dxtmsft.dll
    ----a-w 205,824 2007-06-15 08:12:28 C:\WINDOWS\SYSTEM32\dxtrans.dll
    ----a-w 55,808 2007-06-15 08:12:28 C:\WINDOWS\SYSTEM32\extmgr.dll
    ----a-w 251,904 2007-06-15 08:12:28 C:\WINDOWS\SYSTEM32\iepeers.dll
    ----a-w 96,256 2007-06-15 08:12:28 C:\WINDOWS\SYSTEM32\inseng.dll
    ----a-w 16,384 2007-06-15 08:12:28 C:\WINDOWS\SYSTEM32\jsproxy.dll
    ----a-w 17,474,680 2007-09-06 02:50:42 C:\WINDOWS\SYSTEM32\MRT.exe
    ----a-w 3,064,320 2007-06-15 08:12:29 C:\WINDOWS\SYSTEM32\mshtml.dll
    ----a-w 449,024 2007-06-15 08:12:29 C:\WINDOWS\SYSTEM32\mshtmled.dll
    ----a-w 146,432 2007-06-15 08:12:29 C:\WINDOWS\SYSTEM32\msrating.dll
    ----a-w 532,480 2007-06-15 08:12:29 C:\WINDOWS\SYSTEM32\mstime.dll
    ----a-w 39,424 2007-06-15 08:12:29 C:\WINDOWS\SYSTEM32\pngfilt.dll
    ----a-w 581,120 2004-08-04 11:00:00 C:\WINDOWS\SYSTEM32\RPCRT4.DLL
    ----a-w 1,498,112 2007-06-15 08:12:30 C:\WINDOWS\SYSTEM32\shdocvw.dll
    ----a-w 474,112 2007-06-15 08:12:30 C:\WINDOWS\SYSTEM32\shlwapi.dll
    ----a-w 14,048 2007-03-06 01:22:36 C:\WINDOWS\SYSTEM32\spmsg.dll
    ----a-w 616,960 2007-06-15 08:12:30 C:\WINDOWS\SYSTEM32\urlmon.dll
    ----a-w 665,600 2007-06-26 14:35:54 C:\WINDOWS\SYSTEM32\wininet.dll
    ----a-w 350,720 2007-06-14 10:08:46 C:\WINDOWS\SYSTEM32\xpsp3res.dll
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Apoint"="C:\Program Files\Apoint\Apoint.exe" [2004-08-21 20:04]
    "SunJavaUpdateSched"="C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe" [2003-11-19 19:48]
    "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-10-06 23:10]
    "DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-11 13:43]
    "Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2004-09-27 13:52]
    "UpdateManager"="C:\Program Files\Common Files\Sonic\Update Manager\sgtray.exe" [2004-01-07 03:01]
    "dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-08-13 03:05]
    "RealTray"="C:\Program Files\Real\RealPlayer\RealPlay.exe" [2005-01-25 15:32]
    "DwlClient"="C:\Program Files\Common Files\Dell\EUSW\Support.exe" [2004-05-27 22:05]
    "bacstray"="C:\Program Files\Broadcom\BACS\\BacsTray.exe" [2003-12-15 14:08]
    "Lexmark X1100 Series"="C:\Program Files\Lexmark X1100 Series\lxbkbmgr.exe" [2003-08-19 06:43]
    "SSP Notifier"="C:\Program Files\Fisher-Price\FP3 Player\sspnotifier.exe" [2006-07-12 11:44]
    "Geek Superhero"="C:\Program Files\Geek Superhero\GeekSuperhero.exe" [2006-12-22 12:27]
    "CorelDRAW Graphics Suite 11b"="C:\Program Files\Corel\Corel Graphics 12\Languages\EN\Programs\Registration.exe" []
    "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2007-06-29 06:24]
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2007-09-26 14:42]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 12:24]
    "Stitch"="C:\Program Files\Stitch\Stitch.exe" [2007-08-20 10:12]
    "ccleaner"="C:\Program Files\CCleaner\CCleaner.exe" [2007-09-28 04:05]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    QuickBooks Update Agent.lnk - C:\Program Files\Common Files\Intuit\QuickBooks\QBUpdate\qbupdate.exe [2006-10-17 03:43:22]

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Digital Line Detect.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Digital Line Detect.lnk
    backup=C:\WINDOWS\pss\Digital Line Detect.lnkCommon Startup


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Broadcom Wireless Manager UI]
    C:\WINDOWS\system32\WLTRAY.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
    C:\Program Files\Yahoo!\Messenger\ypager.exe -quiet

    R2 NICSer_WPC54G;NICSer_WPC54G;C:\Program Files\Linksys\Wireless-G Notebook Adapter\NICServ.exe
    R3 odysseyIM4;Odyssey Network Agent Miniport;C:\WINDOWS\system32\DRIVERS\odysseyIM4.sys
    S3 CBTNDIS5;CBTNDIS5 NDIS Protocol Driver;\??\C:\WINDOWS\system32\CBTNDIS5.SYS
    S3 SQLAgent$MICROSOFTBCM;SQLAgent$MICROSOFTBCM;C:\Program Files\Microsoft SQL Server\MSSQL$MICROSOFTBCM\Binn\sqlagent.EXE -i MICROSOFTBCM
    S3 USBAAPL;Apple Mobile USB Driver;C:\WINDOWS\system32\Drivers\usbaapl.sys

    .
    Contents of the 'Scheduled Tasks' folder
    "2007-10-06 22:47:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
    "2007-10-01 04:15:00 C:\WINDOWS\Tasks\Disk Cleanup.job"
    - C:\WINDOWS\SYSTEM32\cleanmgr.exe
    "2007-08-16 12:04:13 C:\WINDOWS\Tasks\FRU Task #Hewlett-Packard#hp psc 2170 series#1183333652.job"
    - C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqfrucl.exe
    "2007-10-09 22:00:00 C:\WINDOWS\Tasks\Pareto UNS.job"
    - C:\Program Files\Common Files\ParetoLogic\UUS\UUS.dll\Pareto_Update.exe
    "2007-09-12 10:54:49 C:\WINDOWS\Tasks\WebReg 20070912065448.job"
    - C:\Program Files\Hewlett-Packard\Digital Imaging\Bin\hpqwrg.exe
    .
    **************************************************************************

    catchme 0.3.1169 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2007-10-10 23:11:21
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2007-10-10 23:11:50
    C:\ComboFix-quarantined-files.txt ... 2007-10-10 23:11
    C:\ComboFix2.txt ... 2007-10-09 22:40
    .
    --- E O F ---
    Sorry too many charachters

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •