View Full Version : Smitfraud-c.toolbar888
This spyware is killing me! Please help!
i already downloaded the vundofix program, but it cant remove the one file, and when the comp restarts, vundo doesnt start up like it should. here's my logs as well, from hjt. Please help!
I really appreciate any assistance you can provide.
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 12:51:39 PM, on 05/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\WINDOWS\avp.exe
C:\Documents and Settings\All Users\Application Data\udinajkv.exe
C:\WINDOWS\smgr.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\DOCUME~1\BELGAR~1\APPLIC~1\YSTEM~1\tracert.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe
C:\Documents and Settings\Belgarion\My Documents\Programs\HiJackThis_v2.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4CEA2D99-44E5-4F7F-8F71-2D393A3387CB} - C:\WINDOWS\system32\ssqpm.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {E5225210-F293-40FE-BB2F-D5A3C7F13C47} - C:\WINDOWS\system32\iifcywv.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [IntelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [SManager] smanager.7.exe
O4 - HKLM\..\Run: [avp] C:\WINDOWS\avp.exe
O4 - HKLM\..\Run: [udinajkv.exe] C:\Documents and Settings\All Users\Application Data\udinajkv.exe
O4 - HKLM\..\Run: [SvcManager] mdmr0.exe
O4 - HKLM\..\Run: [smgr] smgr.exe
O4 - HKLM\..\Run: [Genuine] rundll32.exe "C:\WINDOWS\system32\rrcoaxft.dll",realset
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files\IGN\Download Manager\DLM.exe /windowsstart /startifwork
O4 - HKCU\..\Run: [Tair] "C:\DOCUME~1\BELGAR~1\APPLIC~1\YSTEM~1\tracert.exe" -vt yazb
O4 - HKCU\..\Run: [IpWins] C:\Program Files\Ipwindows\ipwins.exe
O4 - HKCU\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" -NoStart
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Belgarion\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {02ECD07A-22D0-4AF0-BA0A-3F6B06086D08} (GamesCampus Control) - http://www.gamescampus.com/xiah/luncher/GamesCampus.cab
O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://drivecleaner.com/.freeware/installdrivecleanerstart.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.2.100.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {6218F7B5-0D3A-48BA-AE4C-49DCFA63D400} (CSEQueryObject Object) - http://www.myheritage.com/Genoogle/Components/ActiveX/SearchEngineQuery.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1168477223166
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab
O20 - Winlogon Notify: winrzf32 - C:\WINDOWS\SYSTEM32\winrzf32.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
--
End of file - 7779 bytes
Hi Alpheus
1. Download combofix from one of these links:
Link1 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
Link2 (http://www.techsupportforum.com/sectools/sUBs/ComboFix.exe)
2. Double click combofix.exe & follow the prompts.
3. When finished, it shall produce a log for you. Post that log in your next reply
Note:
Do not mouseclick combofix's window whilst it's running. That may cause it to stall
Post:
- a fresh HijackThis log
- combofix report
"Belgarion" - 2007-06-07 9:53:38 Service Pack 2 NTFS
ComboFix 07-06-3B - Running from: "C:\Documents and Settings\Belgarion\My Documents\Programs\"
(((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))
C:\WINDOWS\system32\awvtq.dll
C:\WINDOWS\system32\mllml.dll
C:\WINDOWS\system32\pmkhe.dll
C:\WINDOWS\system32\ssqpq.dll
C:\WINDOWS\system32\adeeg.bak1
C:\WINDOWS\system32\adeeg.ini
C:\WINDOWS\system32\bknivsht.dll
C:\WINDOWS\system32\cwgwaykt.dll
C:\WINDOWS\system32\ddayx.dll
C:\WINDOWS\system32\ddccb.dll
C:\WINDOWS\system32\dikmiell.dll
C:\WINDOWS\system32\ewokxqwa.dll
C:\WINDOWS\system32\geebb.dll
C:\WINDOWS\system32\geedd.dll
C:\WINDOWS\system32\huagcemm.dll
C:\WINDOWS\system32\jkhff.dll
C:\WINDOWS\system32\jkhhf.dll
C:\WINDOWS\system32\jkklj.dll
C:\WINDOWS\system32\mljjk.dll
C:\WINDOWS\system32\mlljj.dll
C:\WINDOWS\system32\ncytkolh.dll
C:\WINDOWS\system32\otffabdc.dll
C:\WINDOWS\system32\pmkhh.dll
C:\WINDOWS\system32\vtsqn.dll
C:\WINDOWS\system32\winrzf32.dll
C:\WINDOWS\system32\qtvwa.ini
C:\WINDOWS\system32\lmllm.ini
C:\WINDOWS\system32\ehkmp.ini
C:\WINDOWS\system32\qpqss.bak1
C:\WINDOWS\system32\qpqss.ini
C:\WINDOWS\system32\xyadd.ini
C:\WINDOWS\system32\bccdd.bak1
C:\WINDOWS\system32\bccdd.ini
C:\WINDOWS\system32\bbeeg.bak1
C:\WINDOWS\system32\bbeeg.ini
C:\WINDOWS\system32\ddeeg.ini
C:\WINDOWS\system32\ffhkj.ini
C:\WINDOWS\system32\fhhkj.bak1
C:\WINDOWS\system32\fhhkj.ini
C:\WINDOWS\system32\jlkkj.bak1
C:\WINDOWS\system32\jlkkj.ini
C:\WINDOWS\system32\kjjlm.bak1
C:\WINDOWS\system32\kjjlm.ini
C:\WINDOWS\system32\jjllm.bak1
C:\WINDOWS\system32\jjllm.ini
C:\WINDOWS\system32\hhkmp.ini
C:\WINDOWS\system32\nqstv.ini
C:\WINDOWS\system32\adeeg.bak1
C:\WINDOWS\system32\adeeg.ini
C:\WINDOWS\system32\bbeeg.bak1
C:\WINDOWS\system32\bbeeg.ini
C:\WINDOWS\system32\bccdd.bak1
C:\WINDOWS\system32\bccdd.ini
C:\WINDOWS\system32\fhhkj.bak1
C:\WINDOWS\system32\fhhkj.ini
C:\WINDOWS\system32\jjllm.bak1
C:\WINDOWS\system32\jjllm.ini
C:\WINDOWS\system32\jlkkj.bak1
C:\WINDOWS\system32\jlkkj.ini
C:\WINDOWS\system32\kjjlm.bak1
C:\WINDOWS\system32\kjjlm.ini
C:\WINDOWS\system32\qpqss.bak1
C:\WINDOWS\system32\qpqss.ini
* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
-- Purity Folders:
C:\DOCUME~1\BELGAR~1\APPLIC~1\YSTEM~1
C:\DOCUME~1\BELGAR~1\Desktop.\internet explorer.lnk
C:\DOCUME~1\BELGAR~1\MYDOCU~1\FNTS~1
C:\DOCUME~1\BELGAR~1\MYDOCU~1\SCURIT~1
C:\Program Files\Common Files\ICROSO~1.NET
C:\Program Files\Common Files\SSTEM~1
C:\Program Files\Common Files\Yazzle1122OinAdmin.exe
C:\Program Files\Common Files\Yazzle1122OinUninstaller.exe
C:\Program Files\Common Files\Yazzle1162OinAdmin.exe
C:\Program Files\Common Files\Yazzle1162OinUninstaller.exe
C:\Program Files\ipwindows
C:\Program Files\ipwindows\ipwins.exe~
C:\Program Files\outerinfo
C:\Program Files\outerinfo\Terms.rtf
C:\Program Files\screensavers.com
C:\Program Files\screensavers.com\SSSInst\bin\SSSInst.dll
C:\Program Files\screensavers.com\SSSInst\bin\SSSUninst.exe
C:\Program Files\screensavers.com\Wallpaper\swpstart.exe
C:\WINDOWS\avp.exe
C:\WINDOWS\SKS~1
C:\WINDOWS\smgr.exe
C:\WINDOWS\system32\max1d1641.exe
C:\WINDOWS\system32\MBOLS~1
C:\WINDOWS\system32\wnsapiicom32.exe
C:\WINDOWS\system32\xpdx.sys
C:\WINDOWS\wr.txt
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
-------\xpdx
((((((((((((((((((((((((( Files Created from 2007-05-07 to 2007-06-07 )))))))))))))))))))))))))))))))
2007-06-07 10:02 <DIR> d-------- C:\Avenger
2007-06-07 09:53 131,124 --a------ C:\WINDOWS\system32\ycphfbbf.dll
2007-06-07 09:50 55,316 --a------ C:\WINDOWS\system32\teelnoho.dll
2007-06-06 23:52 55,316 --a------ C:\WINDOWS\system32\gmkcdloa.dll
2007-06-06 23:49 131,124 --a------ C:\WINDOWS\system32\refmdapc.dll
2007-06-06 21:11 60,928 --a------ C:\WINDOWS\system32\wsppspd.dll
2007-06-06 15:58 55,316 --a------ C:\WINDOWS\system32\fyhrohpo.dll
2007-06-06 15:58 131,124 --a------ C:\WINDOWS\system32\yxbvhdxw.dll
2007-06-06 14:20 196,608 --a------ C:\WINDOWS\system32\ssleay32.dll
2007-06-06 14:20 1,040,384 --a------ C:\WINDOWS\system32\libeay32.dll
2007-06-06 14:04 93,696 --a------ C:\WINDOWS\system32\drvkob.dll
2007-06-06 14:04 33,302 --a------ C:\WINDOWS\system32\khffeda.dll
2007-06-06 12:12 131,124 --a------ C:\WINDOWS\system32\eaqbysvu.dll
2007-06-05 20:42 93,696 --a------ C:\WINDOWS\system32\drvnig.dll
2007-06-05 20:41 33,302 --a------ C:\WINDOWS\system32\pmnolii.dll
2007-06-05 19:52 14,868 --a------ C:\WINDOWS\system32\tdlyvwdy.exe
2007-06-05 19:52 131,124 --a------ C:\WINDOWS\system32\lyrrloft.dll
2007-06-05 19:52 10,752 --a------ C:\WINDOWS\system32\j2261831.dll
2007-06-05 16:46 93,696 --a------ C:\WINDOWS\system32\drvvag.dll
2007-06-05 16:46 33,302 --a------ C:\WINDOWS\system32\cbxusro.dll
2007-06-05 16:43 131,124 --a------ C:\WINDOWS\system32\wplebtyl.dll
2007-06-05 16:41 10,752 --a------ C:\WINDOWS\system32\j7201539.dll
2007-06-05 16:40 14,868 --a------ C:\WINDOWS\system32\dheymffl.exe
2007-06-05 14:34 131,124 --a------ C:\WINDOWS\system32\erflopnf.dll
2007-06-05 14:31 14,868 --a------ C:\WINDOWS\system32\jilcnbuq.exe
2007-06-05 14:31 10,752 --a------ C:\WINDOWS\system32\j1291933.dll
2007-06-05 14:25 33,302 --a------ C:\WINDOWS\system32\xxyywxv.dll
2007-06-05 12:54 131,124 --a------ C:\WINDOWS\system32\yvcfimpc.dll
2007-06-05 12:51 14,868 --a------ C:\WINDOWS\system32\krpwkxww.exe
2007-06-05 12:51 10,752 --a------ C:\WINDOWS\system32\j2211531.dll
2007-06-05 12:29 <DIR> d-------- C:\VundoFix Backups
2007-06-05 12:07 93,696 --a------ C:\WINDOWS\system32\drvpot.dll
2007-06-05 01:52 2,580 --a------ C:\WINDOWS\system32\pdwbikda.exe
2007-06-04 21:55 93,696 --a------ C:\WINDOWS\system32\drvzak.dll
2007-06-04 19:28 93,696 --a------ C:\WINDOWS\system32\drvhos.dll
2007-06-04 19:28 57,344 --a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\gbapolox.exe
2007-06-04 18:54 5,037,072 --a------ C:\spybotsd14.exe
2007-06-04 16:07 28,160 --a------ C:\WINDOWS\system32\sysmon32.exe
2007-06-04 01:48 2,580 --a------ C:\WINDOWS\system32\gdgsdafd.exe
2007-06-03 01:48 2,580 --a------ C:\WINDOWS\system32\pbuwjwjp.exe
2007-06-02 16:32 <DIR> d-------- C:\Program Files\OLYMPUS
2007-06-02 01:47 2,580 --a------ C:\WINDOWS\system32\kqmlpalk.exe
2007-06-02 01:41 43,656 --a------ C:\stmjv.exe
2007-06-02 01:34 93,696 --a------ C:\WINDOWS\system32\drvxof.dll
2007-06-02 01:34 57,344 --a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\udinajkv.exe
2007-06-02 01:34 33,302 --------- C:\WINDOWS\system32\iifcywv.dll
2007-06-02 01:34 28,160 --a------ C:\WINDOWS\system32\winsys64.exe
2007-05-29 22:09 <DIR> d-------- C:\Program Files\Wolfenstein - Enemy Territory
2007-05-17 19:55 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\PopCap
2007-05-10 19:57 116 --a------ C:\WINDOWS\popcinfo.dat
2007-05-10 19:30 181 --a------ C:\WINDOWS\popcinfot.dat
2007-05-10 19:30 0 --a------ C:\WINDOWS\popcreg.dat
2007-05-10 19:30 <DIR> d-------- C:\Program Files\PopCap Games
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-06-01 18:33:27 47,104 ----a-w C:\WINDOWS\system32\KMVIDC32.DLL
2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-12 17:13:38 -------- d-----w C:\Program Files\MSN Messenger
2007-04-09 19:16:37 -------- d-----w C:\Program Files\Fantastic Flame Screensaver
2007-04-09 17:50:03 -------- d-----w C:\Program Files\World of Warcraft
2007-04-08 05:18:56 -------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-04-08 05:14:25 -------- d-----w C:\Program Files\Norton SystemWorks
2007-04-07 05:02:03 -------- d-----w C:\DOCUME~1\BELGAR~1\APPLIC~1\Real
2007-04-07 04:56:08 -------- d-----w C:\Program Files\Common Files\xing shared
2007-04-07 04:56:06 -------- d-----w C:\Program Files\Common Files\Real
2007-04-07 04:55:50 -------- d-----w C:\Program Files\Real
2007-03-17 13:43:01 292,864 ----a-w C:\WINDOWS\system32\winsrv.dll
2007-03-08 15:36:28 577,536 ----a-w C:\WINDOWS\system32\user32.dll
2007-03-08 15:36:28 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll
2007-03-08 15:36:28 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll
2007-03-08 13:47:48 1,843,584 ----a-w C:\WINDOWS\system32\win32k.sys
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-01-12 20:38]
{4CEA2D99-44E5-4F7F-8F71-2D393A3387CB}=C:\WINDOWS\system32\ssqpm.dll []
{53707962-6F74-2D53-2644-206D7942484F}=C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2005-05-31 02:04]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll [2006-10-12 04:25]
{8D7E4555-1237-4DEA-BF40-1977FCA588E1}=C:\WINDOWS\system32\xxyywxv.dll [2007-06-05 14:25]
{E5225210-F293-40FE-BB2F-D5A3C7F13C47}=C:\WINDOWS\system32\iifcywv.dll [2007-06-02 01:34]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2005-10-07 15:13]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 22:05]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-07-22 23:46]
"@"="" []
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-07-22 23:47]
"NWEReboot"="" []
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 04:10]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 16:57]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-04-07 00:55]
"udinajkv.exe"="C:\Documents and Settings\All Users\Application Data\udinajkv.exe" [2007-06-02 01:34]
"SvcManager"="mdmr0.exe" []
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:54]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 06:48]
"igndlm.exe"="C:\Program Files\IGN\Download Manager\DLM.exe" [2007-01-11 17:07]
"Tair"="C:\DOCUME~1\BELGAR~1\APPLIC~1\YSTEM~1\tracert.exe" []
"OM2_Monitor"="C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" [2007-04-23 18:38]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2005-05-31 02:04]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{E5225210-F293-40FE-BB2F-D5A3C7F13C47}"="C:\WINDOWS\system32\iifcywv.dll" [2007-06-02 01:34]
"{8D7E4555-1237-4DEA-BF40-1977FCA588E1}"="C:\WINDOWS\system32\xxyywxv.dll" [2007-06-05 14:25]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\xxyywxv]
xxyywxv.dll
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs*
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0c457a2e-c4a2-11db-81bd-00166f32bd22}]
AutoRun\command- E:\setup.exe
Contents of the 'Scheduled Tasks' folder
2007-06-04 14:20:02 C:\WINDOWS\tasks\AppleSoftwareUpdate.job
**************************************************************************
catchme 0.3.692 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-07 10:03:32
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Completion time: 2007-06-07 10:06:26 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-06-07 10:06
--- E O F ---
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 10:07:42 AM, on 07/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Documents and Settings\All Users\Application Data\udinajkv.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Documents and Settings\Belgarion\My Documents\Programs\HiJackThis_v2.exe
C:\WINDOWS\system32\cmd.exe
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4CEA2D99-44E5-4F7F-8F71-2D393A3387CB} - C:\WINDOWS\system32\ssqpm.dll (file missing)
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8D7E4555-1237-4DEA-BF40-1977FCA588E1} - C:\WINDOWS\system32\xxyywxv.dll
O2 - BHO: (no name) - {E5225210-F293-40FE-BB2F-D5A3C7F13C47} - C:\WINDOWS\system32\iifcywv.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [IntelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKLM\..\Run: [udinajkv.exe] C:\Documents and Settings\All Users\Application Data\udinajkv.exe
O4 - HKLM\..\Run: [SvcManager] mdmr0.exe
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files\IGN\Download Manager\DLM.exe /windowsstart /startifwork
O4 - HKCU\..\Run: [Tair] "C:\DOCUME~1\BELGAR~1\APPLIC~1\YSTEM~1\tracert.exe" -vt yazb
O4 - HKCU\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" -NoStart
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Belgarion\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {02ECD07A-22D0-4AF0-BA0A-3F6B06086D08} (GamesCampus Control) - http://www.gamescampus.com/xiah/luncher/GamesCampus.cab
O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://drivecleaner.com/.freeware/installdrivecleanerstart.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.2.100.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {6218F7B5-0D3A-48BA-AE4C-49DCFA63D400} (CSEQueryObject Object) - http://www.myheritage.com/Genoogle/Components/ActiveX/SearchEngineQuery.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1168477223166
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab
O20 - Winlogon Notify: xxyywxv - C:\WINDOWS\SYSTEM32\xxyywxv.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
--
End of file - 7434 bytes
Thanks again for your assistance Shaba, I really appreciate it. :bigthumb:
Hi
Open HijackThis, click do a system scan only and checkmark these:
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: (no name) - {4CEA2D99-44E5-4F7F-8F71-2D393A3387CB} - C:\WINDOWS\system32\ssqpm.dll (file missing)
O4 - HKLM\..\Run: [udinajkv.exe] C:\Documents and Settings\All Users\Application Data\udinajkv.exe
O4 - HKLM\..\Run: [SvcManager] mdmr0.exe
O4 - HKCU\..\Run: [Tair] "C:\DOCUME~1\BELGAR~1\APPLIC~1\YSTEM~1\tracert.exe" -vt yazb
Close all windows including browser and press fix checked.
Reboot.
Open notepad and copy/paste the text in the quotebox below into it:
File::
C:\WINDOWS\system32\ycphfbbf.dll
C:\WINDOWS\system32\teelnoho.dll
C:\WINDOWS\system32\gmkcdloa.dll
C:\WINDOWS\system32\refmdapc.dll
C:\WINDOWS\system32\wsppspd.dll
C:\WINDOWS\system32\fyhrohpo.dll
C:\WINDOWS\system32\yxbvhdxw.dll
C:\WINDOWS\system32\ssleay32.dll
C:\WINDOWS\system32\libeay32.dll
C:\WINDOWS\system32\drvkob.dll
C:\WINDOWS\system32\khffeda.dll
C:\WINDOWS\system32\eaqbysvu.dll
C:\WINDOWS\system32\drvnig.dll
C:\WINDOWS\system32\pmnolii.dll
C:\WINDOWS\system32\tdlyvwdy.exe
C:\WINDOWS\system32\lyrrloft.dll
C:\WINDOWS\system32\j2261831.dll
C:\WINDOWS\system32\drvvag.dll
C:\WINDOWS\system32\cbxusro.dll
C:\WINDOWS\system32\wplebtyl.dll
C:\WINDOWS\system32\j7201539.dll
C:\WINDOWS\system32\dheymffl.exe
C:\WINDOWS\system32\erflopnf.dll
C:\WINDOWS\system32\jilcnbuq.exe
C:\WINDOWS\system32\j1291933.dll
C:\WINDOWS\system32\xxyywxv.dll
C:\WINDOWS\system32\yvcfimpc.dll
C:\WINDOWS\system32\krpwkxww.exe
C:\WINDOWS\system32\j2211531.dll
C:\WINDOWS\system32\drvpot.dll
C:\WINDOWS\system32\pdwbikda.exe
C:\WINDOWS\system32\drvzak.dll
C:\WINDOWS\system32\drvhos.dll
C:\DOCUME~1\ALLUSE~1\APPLIC~1\gbapolox.exe
C:\WINDOWS\system32\sysmon32.exe
C:\WINDOWS\system32\gdgsdafd.exe
C:\WINDOWS\system32\pbuwjwjp.exe
C:\WINDOWS\system32\kqmlpalk.exe
C:\stmjv.exe
C:\WINDOWS\system32\drvxof.dll
C:\DOCUME~1\ALLUSE~1\APPLIC~1\udinajkv.exe
C:\WINDOWS\system32\iifcywv.dll
C:\WINDOWS\system32\winsys64.exe
Save this as ComboFix-Do.txt
Then drag the ComboFix-Do.txt into ComboFix.exe as you see in the screenshot below.
http://img.photobucket.com/albums/v666/sUBs/Combo-Do.gif
This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThislog.
ok, Here's the new logs.
"Belgarion" - 2007-06-07 13:16:12 Service Pack 2 NTFS
Command switches used :: ""C:\Documents and Settings\Belgarion\My Documents\Programs\combofix-do.txt""
(((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))
C:\WINDOWS\system32\mljgd.dll
C:\WINDOWS\system32\uwkggsoa.dll
C:\WINDOWS\system32\dgjlm.bak1
C:\WINDOWS\system32\dgjlm.ini
C:\WINDOWS\system32\dgjlm.bak1
C:\WINDOWS\system32\dgjlm.ini
* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
((((((((((((((((((((((((( Files Created from 2007-05-07 to 2007-06-07 )))))))))))))))))))))))))))))))
2007-06-07 12:13 58,420 --a------ C:\WINDOWS\system32\cdmbbmbe.dll
2007-06-07 12:13 131,124 --a------ C:\WINDOWS\system32\wxhkkimt.dll
2007-06-07 10:06 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-06-07 10:02 <DIR> d-------- C:\Avenger
2007-06-07 09:53 131,124 --a------ C:\WINDOWS\system32\ycphfbbf.dll
2007-06-07 09:50 55,316 --a------ C:\WINDOWS\system32\teelnoho.dll
2007-06-06 23:52 55,316 --a------ C:\WINDOWS\system32\gmkcdloa.dll
2007-06-06 23:49 131,124 --a------ C:\WINDOWS\system32\refmdapc.dll
2007-06-06 21:11 60,928 --a------ C:\WINDOWS\system32\wsppspd.dll
2007-06-06 15:58 55,316 --a------ C:\WINDOWS\system32\fyhrohpo.dll
2007-06-06 15:58 131,124 --a------ C:\WINDOWS\system32\yxbvhdxw.dll
2007-06-06 14:20 196,608 --a------ C:\WINDOWS\system32\ssleay32.dll
2007-06-06 14:20 1,040,384 --a------ C:\WINDOWS\system32\libeay32.dll
2007-06-06 14:04 93,696 --a------ C:\WINDOWS\system32\drvkob.dll
2007-06-06 14:04 33,302 --a------ C:\WINDOWS\system32\khffeda.dll
2007-06-06 12:12 131,124 --a------ C:\WINDOWS\system32\eaqbysvu.dll
2007-06-05 20:42 93,696 --a------ C:\WINDOWS\system32\drvnig.dll
2007-06-05 20:41 33,302 --a------ C:\WINDOWS\system32\pmnolii.dll
2007-06-05 19:52 14,868 --a------ C:\WINDOWS\system32\tdlyvwdy.exe
2007-06-05 19:52 131,124 --a------ C:\WINDOWS\system32\lyrrloft.dll
2007-06-05 19:52 10,752 --a------ C:\WINDOWS\system32\j2261831.dll
2007-06-05 16:46 93,696 --a------ C:\WINDOWS\system32\drvvag.dll
2007-06-05 16:46 33,302 --a------ C:\WINDOWS\system32\cbxusro.dll
2007-06-05 16:43 131,124 --a------ C:\WINDOWS\system32\wplebtyl.dll
2007-06-05 16:41 10,752 --a------ C:\WINDOWS\system32\j7201539.dll
2007-06-05 16:40 14,868 --a------ C:\WINDOWS\system32\dheymffl.exe
2007-06-05 14:34 131,124 --a------ C:\WINDOWS\system32\erflopnf.dll
2007-06-05 14:31 14,868 --a------ C:\WINDOWS\system32\jilcnbuq.exe
2007-06-05 14:31 10,752 --a------ C:\WINDOWS\system32\j1291933.dll
2007-06-05 14:25 33,302 --a------ C:\WINDOWS\system32\xxyywxv.dll
2007-06-05 12:54 131,124 --a------ C:\WINDOWS\system32\yvcfimpc.dll
2007-06-05 12:51 14,868 --a------ C:\WINDOWS\system32\krpwkxww.exe
2007-06-05 12:51 10,752 --a------ C:\WINDOWS\system32\j2211531.dll
2007-06-05 12:29 <DIR> d-------- C:\VundoFix Backups
2007-06-05 12:07 93,696 --a------ C:\WINDOWS\system32\drvpot.dll
2007-06-05 01:52 2,580 --a------ C:\WINDOWS\system32\pdwbikda.exe
2007-06-04 21:55 93,696 --a------ C:\WINDOWS\system32\drvzak.dll
2007-06-04 19:28 93,696 --a------ C:\WINDOWS\system32\drvhos.dll
2007-06-04 19:28 57,344 --a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\gbapolox.exe
2007-06-04 18:54 5,037,072 --a------ C:\spybotsd14.exe
2007-06-04 16:07 28,160 --a------ C:\WINDOWS\system32\sysmon32.exe
2007-06-04 01:48 2,580 --a------ C:\WINDOWS\system32\gdgsdafd.exe
2007-06-03 01:48 2,580 --a------ C:\WINDOWS\system32\pbuwjwjp.exe
2007-06-02 16:32 <DIR> d-------- C:\Program Files\OLYMPUS
2007-06-02 01:47 2,580 --a------ C:\WINDOWS\system32\kqmlpalk.exe
2007-06-02 01:41 43,656 --a------ C:\stmjv.exe
2007-06-02 01:34 93,696 --a------ C:\WINDOWS\system32\drvxof.dll
2007-06-02 01:34 57,344 --a------ C:\DOCUME~1\ALLUSE~1\APPLIC~1\udinajkv.exe
2007-06-02 01:34 33,302 --------- C:\WINDOWS\system32\iifcywv.dll
2007-06-02 01:34 28,160 --a------ C:\WINDOWS\system32\winsys64.exe
2007-05-29 22:09 <DIR> d-------- C:\Program Files\Wolfenstein - Enemy Territory
2007-05-17 19:55 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\PopCap
2007-05-10 19:57 116 --a------ C:\WINDOWS\popcinfo.dat
2007-05-10 19:30 181 --a------ C:\WINDOWS\popcinfot.dat
2007-05-10 19:30 0 --a------ C:\WINDOWS\popcreg.dat
2007-05-10 19:30 <DIR> d-------- C:\Program Files\PopCap Games
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-06-01 18:33:27 47,104 ----a-w C:\WINDOWS\system32\KMVIDC32.DLL
2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-12 17:13:38 -------- d-----w C:\Program Files\MSN Messenger
2007-04-09 19:16:37 -------- d-----w C:\Program Files\Fantastic Flame Screensaver
2007-04-09 17:50:03 -------- d-----w C:\Program Files\World of Warcraft
2007-04-08 05:18:56 -------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-04-08 05:14:25 -------- d-----w C:\Program Files\Norton SystemWorks
2007-04-07 05:02:03 -------- d-----w C:\DOCUME~1\BELGAR~1\APPLIC~1\Real
2007-04-07 04:56:08 -------- d-----w C:\Program Files\Common Files\xing shared
2007-04-07 04:56:06 -------- d-----w C:\Program Files\Common Files\Real
2007-04-07 04:55:50 -------- d-----w C:\Program Files\Real
2007-03-17 13:43:01 292,864 ----a-w C:\WINDOWS\system32\winsrv.dll
2007-03-08 15:36:28 577,536 ----a-w C:\WINDOWS\system32\user32.dll
2007-03-08 15:36:28 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll
2007-03-08 15:36:28 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll
2007-03-08 13:47:48 1,843,584 ----a-w C:\WINDOWS\system32\win32k.sys
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-01-12 20:38]
{53707962-6F74-2D53-2644-206D7942484F}=C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2005-05-31 02:04]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll [2006-10-12 04:25]
{8D7E4555-1237-4DEA-BF40-1977FCA588E1}=C:\WINDOWS\system32\xxyywxv.dll [2007-06-05 14:25]
{E5225210-F293-40FE-BB2F-D5A3C7F13C47}=C:\WINDOWS\system32\iifcywv.dll [2007-06-02 01:34]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2005-10-07 15:13]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 22:05]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-07-22 23:46]
"@"="" []
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-07-22 23:47]
"NWEReboot"="" []
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 04:10]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 16:57]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-04-07 00:55]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:54]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 06:48]
"igndlm.exe"="C:\Program Files\IGN\Download Manager\DLM.exe" [2007-01-11 17:07]
"OM2_Monitor"="C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" [2007-04-23 18:38]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2005-05-31 02:04]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{E5225210-F293-40FE-BB2F-D5A3C7F13C47}"="C:\WINDOWS\system32\iifcywv.dll" [2007-06-02 01:34]
"{8D7E4555-1237-4DEA-BF40-1977FCA588E1}"="C:\WINDOWS\system32\xxyywxv.dll" [2007-06-05 14:25]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\xxyywxv]
xxyywxv.dll
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs*
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0c457a2e-c4a2-11db-81bd-00166f32bd22}]
AutoRun\command- E:\setup.exe
Contents of the 'Scheduled Tasks' folder
2007-06-04 14:20:02 C:\WINDOWS\tasks\AppleSoftwareUpdate.job
**************************************************************************
catchme 0.3.692 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-07 13:22:00
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Completion time: 2007-06-07 13:26:02 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-06-07 13:25
C:\ComboFix2.txt ... 2007-06-07 10:06
--- E O F ---
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 1:29:10 PM, on 07/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Belgarion\My Documents\Programs\HiJackThis_v2.exe
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8D7E4555-1237-4DEA-BF40-1977FCA588E1} - C:\WINDOWS\system32\xxyywxv.dll
O2 - BHO: (no name) - {E5225210-F293-40FE-BB2F-D5A3C7F13C47} - C:\WINDOWS\system32\iifcywv.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [IntelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files\IGN\Download Manager\DLM.exe /windowsstart /startifwork
O4 - HKCU\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" -NoStart
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Belgarion\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {02ECD07A-22D0-4AF0-BA0A-3F6B06086D08} (GamesCampus Control) - http://www.gamescampus.com/xiah/luncher/GamesCampus.cab
O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://drivecleaner.com/.freeware/installdrivecleanerstart.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.2.100.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {6218F7B5-0D3A-48BA-AE4C-49DCFA63D400} (CSEQueryObject Object) - http://www.myheritage.com/Genoogle/Components/ActiveX/SearchEngineQuery.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1168477223166
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab
O20 - Winlogon Notify: xxyywxv - C:\WINDOWS\SYSTEM32\xxyywxv.dll
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
--
End of file - 7075 bytes
Hi
1. Please download The Avenger (http://swandog46.geekstogo.com/avenger.zip) by Swandog46 to your Desktop. Click on Avenger.zip to open the file Extract avenger.exe to your desktop
2. Copy all the text contained in the code box below to your Clipboard by highlighting it and pressing (Ctrl+C):
Files to delete:
C:\WINDOWS\system32\ycphfbbf.dll
C:\WINDOWS\system32\teelnoho.dll
C:\WINDOWS\system32\gmkcdloa.dll
C:\WINDOWS\system32\refmdapc.dll
C:\WINDOWS\system32\wsppspd.dll
C:\WINDOWS\system32\fyhrohpo.dll
C:\WINDOWS\system32\yxbvhdxw.dll
C:\WINDOWS\system32\drvkob.dll
C:\WINDOWS\system32\khffeda.dll
C:\WINDOWS\system32\eaqbysvu.dll
C:\WINDOWS\system32\drvnig.dll
C:\WINDOWS\system32\pmnolii.dll
C:\WINDOWS\system32\tdlyvwdy.exe
C:\WINDOWS\system32\lyrrloft.dll
C:\WINDOWS\system32\j2261831.dll
C:\WINDOWS\system32\drvvag.dll
C:\WINDOWS\system32\cbxusro.dll
C:\WINDOWS\system32\wplebtyl.dll
C:\WINDOWS\system32\j7201539.dll
C:\WINDOWS\system32\dheymffl.exe
C:\WINDOWS\system32\erflopnf.dll
C:\WINDOWS\system32\jilcnbuq.exe
C:\WINDOWS\system32\j1291933.dll
C:\WINDOWS\system32\xxyywxv.dll
C:\WINDOWS\system32\yvcfimpc.dll
C:\WINDOWS\system32\krpwkxww.exe
C:\WINDOWS\system32\j2211531.dll
C:\WINDOWS\system32\drvpot.dll
C:\WINDOWS\system32\pdwbikda.exe
C:\WINDOWS\system32\drvzak.dll
C:\WINDOWS\system32\drvhos.dll
C:\DOCUME~1\ALLUSE~1\APPLIC~1\gbapolox.exe
C:\WINDOWS\system32\sysmon32.exe
C:\WINDOWS\system32\gdgsdafd.exe
C:\WINDOWS\system32\pbuwjwjp.exe
C:\WINDOWS\system32\kqmlpalk.exe
C:\stmjv.exe
C:\WINDOWS\system32\drvxof.dll
C:\DOCUME~1\ALLUSE~1\APPLIC~1\udinajkv.exe
C:\WINDOWS\system32\iifcywv.dll
C:\WINDOWS\system32\winsys64.exe
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.
3. Now, start The Avenger program by clicking on its icon on your desktop.
Under "Script file to execute" choose "Input Script Manually".
Now click on the Magnifying Glass icon which will open a new window titled "View/edit script"
Paste the text copied to clipboard into this window by pressing (Ctrl+V).
Click Done
Now click on the Green Light to begin execution of the script
Answer "Yes" twice when prompted.
4. The Avenger will automatically do the following:
It will Restart your computer. ( In cases where the code to execute contains "Drivers to Unload", The Avenger will actually restart your system twice.)
On reboot, it will briefly open a black command window on your desktop, this is normal.
After the restart, it creates a log file that should open with the results of Avenger’s actions. This log file will be located at C:\avenger.txt
The Avenger will also have backed up all the files, etc., that you asked it to delete, and will have zipped them and moved the zip archives to C:\avenger\backup.zip.
5. Please copy/paste the content of c:\avenger.txt into your reply along with a fresh HJT log by using Add/Reply
Re-run combofix (without do or /v switch)
Post:
- a fresh HijackThis log
- c:\avenger.txt
- combofix report
Logfile of The Avenger version 1, by Swandog46
Running from registry key:
\Registry\Machine\System\CurrentControlSet\Services\okcgtory
*******************
Script file located at: \??\C:\WINDOWS\iqqluocd.txt
Script file opened successfully.
Script file read successfully
Backups directory opened successfully at C:\Avenger
*******************
Beginning to process script file:
File C:\WINDOWS\system32\ycphfbbf.dll deleted successfully.
File C:\WINDOWS\system32\teelnoho.dll deleted successfully.
File C:\WINDOWS\system32\gmkcdloa.dll deleted successfully.
File C:\WINDOWS\system32\refmdapc.dll deleted successfully.
File C:\WINDOWS\system32\wsppspd.dll deleted successfully.
File C:\WINDOWS\system32\fyhrohpo.dll deleted successfully.
File C:\WINDOWS\system32\yxbvhdxw.dll deleted successfully.
File C:\WINDOWS\system32\drvkob.dll deleted successfully.
File C:\WINDOWS\system32\khffeda.dll deleted successfully.
File C:\WINDOWS\system32\eaqbysvu.dll deleted successfully.
File C:\WINDOWS\system32\drvnig.dll deleted successfully.
File C:\WINDOWS\system32\pmnolii.dll deleted successfully.
File C:\WINDOWS\system32\tdlyvwdy.exe deleted successfully.
File C:\WINDOWS\system32\lyrrloft.dll deleted successfully.
File C:\WINDOWS\system32\j2261831.dll deleted successfully.
File C:\WINDOWS\system32\drvvag.dll deleted successfully.
File C:\WINDOWS\system32\cbxusro.dll deleted successfully.
File C:\WINDOWS\system32\wplebtyl.dll deleted successfully.
File C:\WINDOWS\system32\j7201539.dll deleted successfully.
File C:\WINDOWS\system32\dheymffl.exe deleted successfully.
File C:\WINDOWS\system32\erflopnf.dll deleted successfully.
File C:\WINDOWS\system32\jilcnbuq.exe deleted successfully.
File C:\WINDOWS\system32\j1291933.dll deleted successfully.
File C:\WINDOWS\system32\xxyywxv.dll deleted successfully.
File C:\WINDOWS\system32\yvcfimpc.dll deleted successfully.
File C:\WINDOWS\system32\krpwkxww.exe deleted successfully.
File C:\WINDOWS\system32\j2211531.dll deleted successfully.
File C:\WINDOWS\system32\drvpot.dll deleted successfully.
File C:\WINDOWS\system32\pdwbikda.exe deleted successfully.
File C:\WINDOWS\system32\drvzak.dll deleted successfully.
File C:\WINDOWS\system32\drvhos.dll deleted successfully.
File C:\DOCUME~1\ALLUSE~1\APPLIC~1\gbapolox.exe deleted successfully.
File C:\WINDOWS\system32\sysmon32.exe deleted successfully.
File C:\WINDOWS\system32\gdgsdafd.exe deleted successfully.
File C:\WINDOWS\system32\pbuwjwjp.exe deleted successfully.
File C:\WINDOWS\system32\kqmlpalk.exe deleted successfully.
File C:\stmjv.exe deleted successfully.
File C:\WINDOWS\system32\drvxof.dll deleted successfully.
File C:\DOCUME~1\ALLUSE~1\APPLIC~1\udinajkv.exe deleted successfully.
File C:\WINDOWS\system32\iifcywv.dll deleted successfully.
File C:\WINDOWS\system32\winsys64.exe deleted successfully.
Completed script processing.
*******************
Finished! Terminate.
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 2:13:01 PM, on 07/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\cmd.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Program Files\Apoint\Apntex.exe
C:\Program Files\Apoint\HidFind.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\Internet Explorer\IEXPLORE.EXE
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\system32\NOTEPAD.EXE
C:\WINDOWS\system32\cmd.exe
C:\ComboFix\vfind.cfexe
C:\Documents and Settings\Belgarion\My Documents\Programs\HiJackThis_v2.exe
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8D7E4555-1237-4DEA-BF40-1977FCA588E1} - C:\WINDOWS\system32\xxyywxv.dll (file missing)
O2 - BHO: (no name) - {E5225210-F293-40FE-BB2F-D5A3C7F13C47} - C:\WINDOWS\system32\iifcywv.dll (file missing)
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [IntelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files\IGN\Download Manager\DLM.exe /windowsstart /startifwork
O4 - HKCU\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" -NoStart
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Belgarion\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {02ECD07A-22D0-4AF0-BA0A-3F6B06086D08} (GamesCampus Control) - http://www.gamescampus.com/xiah/luncher/GamesCampus.cab
O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://drivecleaner.com/.freeware/installdrivecleanerstart.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.2.100.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {6218F7B5-0D3A-48BA-AE4C-49DCFA63D400} (CSEQueryObject Object) - http://www.myheritage.com/Genoogle/Components/ActiveX/SearchEngineQuery.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1168477223166
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab
O20 - Winlogon Notify: xxyywxv - xxyywxv.dll (file missing)
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
--
End of file - 7189 bytes
"Belgarion" - 2007-06-07 14:06:13 Service Pack 2 NTFS
ComboFix 07-06-3B - Running from: "C:\Documents and Settings\Belgarion\My Documents\Programs\"
(((((((((((((((((((((((((((((((((((((((((((( V Log )))))))))))))))))))))))))))))))))))))))))))))))))))))))
C:\WINDOWS\system32\mllmm.dll
C:\WINDOWS\system32\pmnnn.dll
C:\WINDOWS\system32\ssqpp.dll
C:\WINDOWS\system32\mmllm.ini
C:\WINDOWS\system32\nnnmp.bak1
C:\WINDOWS\system32\nnnmp.ini
C:\WINDOWS\system32\ppqss.ini
C:\WINDOWS\system32\nnnmp.bak1
C:\WINDOWS\system32\nnnmp.ini
* * * POST RUN FILES/FOLDERS * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * * *
((((((((((((((((((((((((( Files Created from 2007-05-07 to 2007-06-07 )))))))))))))))))))))))))))))))
2007-06-07 14:01 60,416 --a------ C:\WINDOWS\system32\drivers\qcnyigsh.sys
2007-06-07 14:01 126,976 --a------ C:\zip.exe
2007-06-07 14:01 1,080 --a------ C:\yhldxawi.bat
2007-06-07 13:27 58,420 --a------ C:\WINDOWS\system32\lspchefp.dll
2007-06-07 13:27 131,124 --a------ C:\WINDOWS\system32\cttitqkn.dll
2007-06-07 12:13 58,420 --a------ C:\WINDOWS\system32\cdmbbmbe.dll
2007-06-07 12:13 131,124 --a------ C:\WINDOWS\system32\wxhkkimt.dll
2007-06-07 10:06 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-06-07 10:02 <DIR> d-------- C:\Avenger
2007-06-06 14:20 196,608 --a------ C:\WINDOWS\system32\ssleay32.dll
2007-06-06 14:20 1,040,384 --a------ C:\WINDOWS\system32\libeay32.dll
2007-06-05 12:29 <DIR> d-------- C:\VundoFix Backups
2007-06-04 18:54 5,037,072 --a------ C:\spybotsd14.exe
2007-06-02 16:32 <DIR> d-------- C:\Program Files\OLYMPUS
2007-05-29 22:09 <DIR> d-------- C:\Program Files\Wolfenstein - Enemy Territory
2007-05-17 19:55 <DIR> d-------- C:\DOCUME~1\ALLUSE~1\APPLIC~1\PopCap
2007-05-10 19:57 116 --a------ C:\WINDOWS\popcinfo.dat
2007-05-10 19:30 181 --a------ C:\WINDOWS\popcinfot.dat
2007-05-10 19:30 0 --a------ C:\WINDOWS\popcreg.dat
2007-05-10 19:30 <DIR> d-------- C:\Program Files\PopCap Games
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-06-01 18:33:27 47,104 ----a-w C:\WINDOWS\system32\KMVIDC32.DLL
2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-12 17:13:38 -------- d-----w C:\Program Files\MSN Messenger
2007-04-09 19:16:37 -------- d-----w C:\Program Files\Fantastic Flame Screensaver
2007-04-09 17:50:03 -------- d-----w C:\Program Files\World of Warcraft
2007-04-08 05:18:56 -------- d-----w C:\Program Files\Common Files\Symantec Shared
2007-04-08 05:14:25 -------- d-----w C:\Program Files\Norton SystemWorks
2007-04-07 05:02:03 -------- d-----w C:\DOCUME~1\BELGAR~1\APPLIC~1\Real
2007-04-07 04:56:08 -------- d-----w C:\Program Files\Common Files\xing shared
2007-04-07 04:56:06 -------- d-----w C:\Program Files\Common Files\Real
2007-04-07 04:55:50 -------- d-----w C:\Program Files\Real
2007-03-17 13:43:01 292,864 ----a-w C:\WINDOWS\system32\winsrv.dll
2007-03-08 15:36:28 577,536 ----a-w C:\WINDOWS\system32\user32.dll
2007-03-08 15:36:28 40,960 ----a-w C:\WINDOWS\system32\mf3216.dll
2007-03-08 15:36:28 281,600 ----a-w C:\WINDOWS\system32\gdi32.dll
2007-03-08 13:47:48 1,843,584 ----a-w C:\WINDOWS\system32\win32k.sys
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-01-12 20:38]
{53707962-6F74-2D53-2644-206D7942484F}=C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2005-05-31 02:04]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll [2006-10-12 04:25]
{8D7E4555-1237-4DEA-BF40-1977FCA588E1}=C:\WINDOWS\system32\xxyywxv.dll []
{E5225210-F293-40FE-BB2F-D5A3C7F13C47}=C:\WINDOWS\system32\iifcywv.dll []
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2005-10-07 15:13]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 22:05]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-07-22 23:46]
"@"="" []
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-07-22 23:47]
"NWEReboot"="" []
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 04:10]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 16:57]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-04-07 00:55]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:54]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 06:48]
"igndlm.exe"="C:\Program Files\IGN\Download Manager\DLM.exe" [2007-01-11 17:07]
"OM2_Monitor"="C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" [2007-04-23 18:38]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2005-05-31 02:04]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{E5225210-F293-40FE-BB2F-D5A3C7F13C47}"="C:\WINDOWS\system32\iifcywv.dll" []
"{8D7E4555-1237-4DEA-BF40-1977FCA588E1}"="C:\WINDOWS\system32\xxyywxv.dll" []
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\xxyywxv]
xxyywxv.dll
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs*
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{0c457a2e-c4a2-11db-81bd-00166f32bd22}]
AutoRun\command- E:\setup.exe
Contents of the 'Scheduled Tasks' folder
2007-06-04 14:20:02 C:\WINDOWS\tasks\AppleSoftwareUpdate.job
**************************************************************************
catchme 0.3.692 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-07 14:09:51
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Completion time: 2007-06-07 14:11:31 - machine was rebooted
C:\ComboFix-quarantined-files.txt ... 2007-06-07 14:11
C:\ComboFix2.txt ... 2007-06-07 13:26
C:\ComboFix3.txt ... 2007-06-07 10:06
--- E O F ---
Hi
New stuff there but we are making progress.
Open HijackThis, click do a system scan only and checkmark these:
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: (no name) - {8D7E4555-1237-4DEA-BF40-1977FCA588E1} - C:\WINDOWS\system32\xxyywxv.dll (file missing)
O2 - BHO: (no name) - {E5225210-F293-40FE-BB2F-D5A3C7F13C47} - C:\WINDOWS\system32\iifcywv.dll (file missing)
O16 - DPF: {DF780F87-FF2B-4DF8-92D0-73DB16A1543A} (PopCapLoader Object) - http://www.popcap.com/games/popcaploader_v6.cab
O20 - Winlogon Notify: xxyywxv - xxyywxv.dll (file missing)
Close all windows including browser and press fix checked.
Please download the Killbox (http://download.bleepingcomputer.com/spyware/KillBox.exe).
Save it to the desktop.
Please run Killbox.
Select "Delete on Reboot" and "All files"
Copy the file names below to the clipboard by highlighting them and pressing Control-C:
C:\WINDOWS\system32\drivers\qcnyigsh.sys
C:\zip.exe
C:\yhldxawi.bat
C:\WINDOWS\system32\lspchefp.dll
C:\WINDOWS\system32\cttitqkn.dll
C:\WINDOWS\system32\cdmbbmbe.dll
C:\WINDOWS\system32\wxhkkimt.dll
Go to the File menu, and choose "Paste from Clipboard".
Click the red-and-white "Delete File" button. Click "Yes" at the Delete on Reboot prompt. Click "No" at the Pending Operations prompt.
If you receive a message such as: "Component 'MsComCtl.ocx' or one of its dependencies not correctly registered: a file is missing or invalid." when trying to run TheKillbox, click here (http://www.eudaemonia.me.uk/downloads/Files/missingfilesetup.exe) to download and run missingfilesetup.exe. Then try TheKillbox again..
If your computer does not restart automatically, please restart it manually.
Re-run combofix.
Post:
- a fresh HijackThis log
- combofix report
well, im not getting the problems i was before, but i am finding that i cannot access most of my controlpanel, or desktop properties, or system, or display options. it says im missing rundll32.exe here are the logs you wanted!
"Belgarion" - 2007-06-08 23:14:56 Service Pack 2 NTFS
ComboFix 07-06-3B - Running from: "C:\Documents and Settings\Belgarion\My Documents\Programs\"
((((((((((((((((((((((((( Files Created from 2007-05-09 to 2007-06-09 )))))))))))))))))))))))))))))))
2007-06-08 23:11 <DIR> d-------- C:\!KillBox
2007-06-07 18:58 <DIR> d-------- C:\Program Files\Uniblue
2007-06-07 18:58 <DIR> d-------- C:\DOCUME~1\BELGAR~1\APPLIC~1\Uniblue
2007-06-07 10:06 49,152 --a------ C:\WINDOWS\nircmd.exe
2007-06-07 10:02 <DIR> d-------- C:\Avenger
2007-06-06 14:20 196,608 --a------ C:\WINDOWS\system32\ssleay32.dll
2007-06-06 14:20 1,040,384 --a------ C:\WINDOWS\system32\libeay32.dll
2007-06-05 12:29 <DIR> d-------- C:\VundoFix Backups
2007-06-04 18:54 5,037,072 --a------ C:\spybotsd14.exe
2007-06-02 16:32 <DIR> d-------- C:\Program Files\OLYMPUS
2007-05-29 22:09 <DIR> d-------- C:\Program Files\Wolfenstein - Enemy Territory
2007-05-10 19:57 116 --a------ C:\WINDOWS\popcinfo.dat
2007-05-10 19:30 181 --a------ C:\WINDOWS\popcinfot.dat
2007-05-10 19:30 0 --a------ C:\WINDOWS\popcreg.dat
2007-05-10 19:30 <DIR> d-------- C:\Program Files\PopCap Games
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
2007-06-01 18:33:27 47,104 ----a-w C:\WINDOWS\system32\KMVIDC32.DLL
2007-04-18 16:12:23 2,854,400 ----a-w C:\WINDOWS\system32\msi.dll
2007-04-12 17:13:38 -------- d-----w C:\Program Files\MSN Messenger
2007-04-09 19:16:37 -------- d-----w C:\Program Files\Fantastic Flame Screensaver
2007-04-09 17:50:03 -------- d-----w C:\Program Files\World of Warcraft
2007-03-17 13:43:01 292,864 ----a-w C:\WINDOWS\system32\winsrv.dll
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects]
{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}=C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-01-12 20:38]
{53707962-6F74-2D53-2644-206D7942484F}=C:\PROGRA~1\SPYBOT~1\SDHelper.dll [2005-05-31 02:04]
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}=C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll [2006-10-12 04:25]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2005-10-07 15:13]
"ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2005-08-05 22:05]
"IntelZeroConfig"="C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe" [2005-07-22 23:46]
"@"="" []
"IntelWireless"="C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe" [2005-07-22 23:47]
"NWEReboot"="" []
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe" [2006-10-12 04:10]
"QuickTime Task"="C:\Program Files\QuickTime\qttask.exe" [2006-09-01 16:57]
"TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-04-07 00:55]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"msnmsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" [2007-01-19 12:54]
"DAEMON Tools"="C:\Program Files\DAEMON Tools\daemon.exe" [2006-11-12 06:48]
"igndlm.exe"="C:\Program Files\IGN\Download Manager\DLM.exe" [2007-01-11 17:07]
"OM2_Monitor"="C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" [2007-04-23 18:38]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2005-05-31 02:04]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\IntelWireless]
C:\Program Files\Intel\Wireless\Bin\LgNotify.dll
HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost *netsvcs*
Contents of the 'Scheduled Tasks' folder
2007-06-04 14:20:02 C:\WINDOWS\tasks\AppleSoftwareUpdate.job
**************************************************************************
catchme 0.3.692 W2K/XP/Vista - userland rootkit detector by Gmer, http://www.gmer.net
Rootkit scan 2007-06-08 23:17:20
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
Completion time: 2007-06-08 23:17:47
C:\ComboFix-quarantined-files.txt ... 2007-06-08 23:17
C:\ComboFix2.txt ... 2007-06-07 14:11
C:\ComboFix3.txt ... 2007-06-07 13:26
--- E O F ---
Logfile of Trend Micro HijackThis v2.0.0 (BETA)
Scan saved at 11:18:45 PM, on 08/06/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
C:\Program Files\Intel\Wireless\Bin\ZcfgSvc.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program Files\Apoint\Apoint.exe
C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe
C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe
C:\Program Files\QuickTime\qttask.exe
C:\Program Files\Common Files\Real\Update_OB\realsched.exe
C:\Program Files\MSN Messenger\msnmsgr.exe
C:\Program Files\DAEMON Tools\daemon.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\PROGRA~1\Intel\Wireless\Bin\1XConfig.exe
C:\Program Files\Apoint\HidFind.exe
C:\Program Files\Apoint\Apntex.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\internet explorer\iexplore.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\explorer.exe
C:\WINDOWS\system32\notepad.exe
C:\Documents and Settings\Belgarion\My Documents\Programs\HiJackThis_v2.exe
C:\Program Files\Java\jre1.5.0_09\bin\jucheck.exe
O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.5.0_09\bin\ssv.dll
O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint\Apoint.exe
O4 - HKLM\..\Run: [ATIPTA] "C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe"
O4 - HKLM\..\Run: [IntelZeroConfig] C:\Program Files\Intel\Wireless\bin\ZCfgSvc.exe
O4 - HKLM\..\Run: [IntelWireless] C:\Program Files\Intel\Wireless\Bin\ifrmewrk.exe /tf Intel PROSet/Wireless
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.5.0_09\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
O4 - HKCU\..\Run: [msnmsgr] "C:\Program Files\MSN Messenger\msnmsgr.exe" /background
O4 - HKCU\..\Run: [DAEMON Tools] "C:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKCU\..\Run: [igndlm.exe] C:\Program Files\IGN\Download Manager\DLM.exe /windowsstart /startifwork
O4 - HKCU\..\Run: [OM2_Monitor] "C:\Program Files\OLYMPUS\OLYMPUS Master 2\MMonitor.exe" -NoStart
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_09\bin\npjpi150_09.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Program Files\PartyGaming\PartyPoker\RunApp.exe
O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Belgarion\Start Menu\Programs\IMVU\Run IMVU.lnk
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {02ECD07A-22D0-4AF0-BA0A-3F6B06086D08} (GamesCampus Control) - http://www.gamescampus.com/xiah/luncher/GamesCampus.cab
O16 - DPF: {2D2BEE6E-3C9A-4D58-B9EC-458EDB28D0F6} - http://drivecleaner.com/.freeware/installdrivecleanerstart.cab
O16 - DPF: {39B0684F-D7BF-4743-B050-FDC3F48F7E3B} (FilePlanet Download Control Class) - http://www.fileplanet.com/fpdlmgr/cabs/FPDC_2.3.2.100.cab
O16 - DPF: {5F8469B4-B055-49DD-83F7-62B522420ECC} (Facebook Photo Uploader Control) - http://upload.facebook.com/controls/FacebookPhotoUploader.cab
O16 - DPF: {6218F7B5-0D3A-48BA-AE4C-49DCFA63D400} (CSEQueryObject Object) - http://www.myheritage.com/Genoogle/Components/ActiveX/SearchEngineQuery.dll
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1168477223166
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: EvtEng - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe
O23 - Service: RegSrvc - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe
O23 - Service: Spectrum24 Event Monitor (S24EventMonitor) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\S24EvMon.exe
O23 - Service: WLANKEEPER - Intel® Corporation - C:\Program Files\Intel\Wireless\Bin\WLKeeper.exe
--
End of file - 6567 bytes
Thanks again!
Hi
Try sfc /scannow (http://support.microsoft.com/kb/310747)
Did it help?
actually, i haven't been able to attempt that, as I don't know where my windows cd is...
if there is another option, that would be awesome. if not, i'll just have to find a windows cd.
thanks again!
Hi
You can download it also from here (http://www.richardthelionhearted.com/~merijn/winfiles.html#rundll32)
Due to the lack of feedback this Topic is closed.
If you need this topic reopened, please request this by sending the moderating team
a PM with the address of the thread. This applies only to the original topic starter.
Everyone else please begin a New Topic.