glenatcots
2007-11-07, 04:13
Greetings,
I read a bit from other posts and followed these instructions (after allowing SD 1.5 to fix everything it found):
"Please remember to post :-
An original hijackthis log ....
then ...
1. C:\vundofix.txt
2. SUPERAntiSpyware Scan Log
3. C:\ComboFix.txt
4. a new hijackthis log.( run after everything else)"
I didn't do a Kaspersky scan. Here are my logs, and thank you so much for the assistance!
Initial HJT:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:59:40 PM, on 11/6/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Yahoo!\Antivirus\ISafe.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Yahoo!\Antivirus\CAVTray.exe
C:\Program Files\Yahoo!\Antivirus\CAVRID.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACA.EXE
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\palmOne\HOTSYNC.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [EPSON Stylus CX3800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACA.EXE /P26 "EPSON Stylus CX3800 Series" /O6 "USB001" /M "Stylus CX3800"
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: HotSync Manager.LNK = C:\Program Files\palmOne\HOTSYNC.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1173733541500
O17 - HKLM\System\CCS\Services\Tcpip\..\{733B5572-84DE-41E2-94E8-32B2216299AE}: NameServer = 206.13.28.12,206.13.31.12
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
--
End of file - 4531 bytes
vundofix.txt:
VundoFix V6.5.11
Checking Java version...
Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.
Scan started at 2:29:24 PM 11/6/2007
Listing files found while scanning....
C:\windows\system32\ddccyyy.dll
C:\WINDOWS\system32\hhalofvy.dll
C:\windows\system32\rsgilgjt.ini
C:\windows\system32\tjgligsr.dll
Beginning removal...
Attempting to delete C:\windows\system32\ddccyyy.dll
C:\windows\system32\ddccyyy.dll Could not be deleted.
Attempting to delete C:\WINDOWS\system32\hhalofvy.dll
C:\WINDOWS\system32\hhalofvy.dll Has been deleted!
Attempting to delete C:\windows\system32\rsgilgjt.ini
C:\windows\system32\rsgilgjt.ini Has been deleted!
Attempting to delete C:\windows\system32\tjgligsr.dll
C:\windows\system32\tjgligsr.dll Has been deleted!
Performing Repairs to the registry.
Done!
Beginning removal...
Attempting to delete C:\windows\system32\ddccyyy.dll
C:\windows\system32\ddccyyy.dll Has been deleted!
Performing Repairs to the registry.
Done!
VundoFix V6.5.11
Checking Java version...
Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.
Scan started at 2:36:22 PM 11/6/2007
Listing files found while scanning....
No infected files were found.
VundoFix V6.5.11
Checking Java version...
Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.
Scan started at 3:43:39 PM 11/6/2007
Listing files found while scanning....
No infected files were found.
VundoFix V6.5.11
Checking Java version...
Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.
Scan started at 3:46:23 PM 11/6/2007
Listing files found while scanning....
No infected files were found.
VundoFix V6.5.11
Checking Java version...
Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.
Scan started at 4:18:37 PM 11/6/2007
Listing files found while scanning....
No infected files were found.
SUPERAntiSpyware Scan Log:
SUPERAntiSpyware Scan Log
http://www.superantispyware.com
Generated 11/06/2007 at 04:50 PM
Application Version : 3.9.1008
Core Rules Database Version : 3338
Trace Rules Database Version: 1339
Scan type : Complete Scan
Total Scan Time : 00:33:34
Memory items scanned : 378
Memory threats detected : 1
Registry items scanned : 5084
Registry threats detected : 11
File items scanned : 28336
File threats detected : 15
Adware.Vundo Variant
C:\WINDOWS\SYSTEM32\JKKJJ.DLL
C:\WINDOWS\SYSTEM32\JKKJJ.DLL
HKLM\Software\Classes\CLSID\{C553C207-7721-4BB1-9465-18F4D9E230E3}
HKCR\CLSID\{C553C207-7721-4BB1-9465-18F4D9E230E3}
HKCR\CLSID\{C553C207-7721-4BB1-9465-18F4D9E230E3}\InprocServer32
HKCR\CLSID\{C553C207-7721-4BB1-9465-18F4D9E230E3}\InprocServer32#ThreadingModel
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9BD9C6F0-7A7D-4AF6-B33E-E77AD3A0C5F1}
HKCR\CLSID\{9BD9C6F0-7A7D-4AF6-B33E-E77AD3A0C5F1}
HKCR\CLSID\{9BD9C6F0-7A7D-4AF6-B33E-E77AD3A0C5F1}\InprocServer32
HKCR\CLSID\{9BD9C6F0-7A7D-4AF6-B33E-E77AD3A0C5F1}\InprocServer32#ThreadingModel
C:\WINDOWS\SYSTEM32\SSQRR.DLL
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C553C207-7721-4BB1-9465-18F4D9E230E3}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks#{86882CA4-BE70-4BCE-AEA5-CF40EB8E0BC3}
C:\SYSTEM VOLUME INFORMATION\_RESTORE{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP472\A0039360.DLL
C:\VUNDOFIX BACKUPS\DDCCYYY.DLL.BAD
Unclassified.Unknown Origin
HKLM\Software\Microsoft\Internet Explorer\Toolbar#{11A69AE4-FBED-4832-A2BF-45AF82825583}
Malware.LocusSoftware Inc/BestSellerAntivirus
C:\DOCUMENTS AND SETTINGS\GLEN W\LOCAL SETTINGS\TEMP\INSTALL_EN.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP464\A0038644.EXE
Adware.WINSHOW
C:\DOCUMENTS AND SETTINGS\GLEN W\LOCAL SETTINGS\TEMP\WINSHOW.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP464\A0038674.EXE
Adware.ClickSpring/Yazzle
C:\DOCUMENTS AND SETTINGS\GLEN W\LOCAL SETTINGS\TEMP\YAZZLEBUNDLE-1549.EXE
Trojan.Unknown Origin
C:\SYSTEM VOLUME INFORMATION\_RESTORE{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP464\A0038643.EXE
Trojan.Downloader-Gen/Installer
C:\SYSTEM VOLUME INFORMATION\_RESTORE{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP464\A0038653.EXE
C:\WINDOWS\B122.EXE
Adware.Vundo Variant/Rel
C:\WINDOWS\SYSTEM32\JJKKJ.BAK2
C:\WINDOWS\SYSTEM32\RRQSS.BAK1
C:\WINDOWS\SYSTEM32\RRQSS.INI
ComboFix.txt:
ComboFix 07-11-02.3 - Glen W 2007-11-06 17:16:40.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.669 [GMT -8:00]
Running from: C:\Documents and Settings\Glen W\Desktop\Current\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\All Users\Application Data.\salesmonitor
C:\Documents and Settings\All Users\Start Menu\Live Safety Center.lnk
C:\Documents and Settings\All Users\Start Menu\Online Security Guide.lnk
C:\Documents and Settings\Glen W\Favorites\Online Security Guide.lnk
C:\Program Files\Temporary
C:\Temp\fCOe
C:\WINDOWS\system32\dytnquog.dll
C:\WINDOWS\system32\gbqbduvo.ini
C:\WINDOWS\system32\gouqntyd.ini
C:\WINDOWS\system32\jjkkj.bak1
C:\WINDOWS\system32\jjkkj.ini2
C:\WINDOWS\system32\jjkkj.tmp
C:\WINDOWS\system32\mkrswqeo.dll
C:\WINDOWS\system32\oiialdjy.dll
C:\WINDOWS\system32\oTt08e
C:\WINDOWS\system32\ovudbqbg.dll
C:\WINDOWS\system32\pac.txt
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\LEGACY_DOMAINSERVICE
((((((((((((((((((((((((( Files Created from 2007-10-07 to 2007-11-07 )))))))))))))))))))))))))))))))
.
2007-11-06 17:15 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-06 16:03 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2007-11-06 16:03 <DIR> d-------- C:\Documents and Settings\Glen W\Application Data\SUPERAntiSpyware.com
2007-11-06 16:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-11-06 16:02 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-11-06 15:54 <DIR> d-------- C:\Program Files\Trend Micro
2007-11-06 14:35 81,472 --a------ C:\WINDOWS\system32\xhplohos.dll
2007-11-06 14:29 <DIR> d-------- C:\VundoFix Backups
2007-11-06 08:50 87,104 --a------ C:\WINDOWS\system32\jkuusckv.dll
2007-11-06 08:47 71,232 --a------ C:\WINDOWS\system32\nlnwfsxp.exe
2007-11-06 08:45 145,984 --a------ C:\WINDOWS\system32\kplengdn.dll
2007-11-05 09:09 <DIR> d-------- C:\qrnt
2007-11-02 11:47 86,080 --a------ C:\WINDOWS\system32\ywycqhry.dll
2007-10-23 09:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-10-23 08:17 582,656 --------- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-10-23 07:41 379,224 --ahs---- C:\WINDOWS\system32\rrqss.bak2
2007-10-22 16:10 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll
2007-10-22 16:07 <DIR> d-------- C:\Temp
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-08-21 06:15 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-08-21 06:15 683,520 ------w C:\WINDOWS\system32\dllcache\inetcomm.dll
2006-01-06 21:22:12 56 --sh--r C:\WINDOWS\system32\F5631C8E67.sys
2006-01-06 21:22:13 3,350 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{04167CEF-B42C-478B-B4DA-4F1FADD8C442}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0585E8C0-8839-4138-B332-60D94881AB77}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{587FCBB2-DFD9-4174-B8ED-FC8D10CB3465}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AAF86FC0-0536-4BEB-989B-11DE86A13BB1}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C4E97293-2489-4FF6-870D-8C5677F8E20F}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CEC4B170-9A03-4343-8887-F2DDB22945B6}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 17:42]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-04-05 17:22]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-04-05 17:19]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2005-04-05 17:23]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-12-05 23:05]
"CaAvTray"="C:\Program Files\Yahoo!\Antivirus\CAVTray.exe" [2005-12-30 07:55]
"CAVRID"="C:\Program Files\Yahoo!\Antivirus\CAVRID.exe" [2005-12-30 07:55]
"EPSON Stylus CX3800 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACA.exe" [2005-02-07 19:00]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 15:45]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 14:06]
C:\Documents and Settings\Glen W\Start Menu\Programs\Startup\
HotSync Manager.LNK - C:\Program Files\palmOne\HOTSYNC.EXE [2004-02-11 18:29:02]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Glen W^Start Menu^Programs^Startup^HotSync Manager.lnk]
path=C:\Documents and Settings\Glen W\Start Menu\Programs\Startup\HotSync Manager.lnk
backup=C:\WINDOWS\pss\HotSync Manager.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cleanup]
C:\DOCUME~1\GLENW~1\LOCALS~1\Temp\200613171557_mcappins.exe /v=3 /cleanup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel Photo Downloader]
C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
"C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
"c:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
"C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MPFExe]
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msci]
C:\DOCUME~1\GLENW~1\LOCALS~1\Temp\200613171553_mcinfo.exe /insfin
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKAGENTEXE]
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe]
C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QBReminderFlash]
"C:\Program Files\Intuit\QuickBooks 2005\Atom\QBReminder.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Salestart]
"C:\Program Files\Common Files\SpyGuardPro\bm.exe" dm=http://spyguardpro.com; ad=http://spyguardpro.com
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winshow]
"C:\WINDOWS\winshow.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YOP]
C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
.
Contents of the 'Scheduled Tasks' folder
"2007-05-01 22:40:16 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2005-12-30 15:12:58 C:\WINDOWS\Tasks\ISP signup reminder 1.job"
- C:\WINDOWS\system32\OOBE\oobebaln.exe
.
**************************************************************************
catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-06 17:21:03
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-11-06 17:22:26 - machine was rebooted
.
--- E O F ---
I read a bit from other posts and followed these instructions (after allowing SD 1.5 to fix everything it found):
"Please remember to post :-
An original hijackthis log ....
then ...
1. C:\vundofix.txt
2. SUPERAntiSpyware Scan Log
3. C:\ComboFix.txt
4. a new hijackthis log.( run after everything else)"
I didn't do a Kaspersky scan. Here are my logs, and thank you so much for the assistance!
Initial HJT:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 3:59:40 PM, on 11/6/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16512)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Yahoo!\Antivirus\ISafe.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\MDM.EXE
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
C:\Program Files\Analog Devices\Core\smax4pnp.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\Program Files\Yahoo!\Antivirus\CAVTray.exe
C:\Program Files\Yahoo!\Antivirus\CAVRID.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACA.EXE
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\palmOne\HOTSYNC.EXE
C:\WINDOWS\system32\wscntfy.exe
C:\Program Files\Microsoft Office\OFFICE11\OUTLOOK.EXE
C:\Program Files\Microsoft Office\OFFICE11\WINWORD.EXE
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O4 - HKLM\..\Run: [SoundMAXPnP] C:\Program Files\Analog Devices\Core\smax4pnp.exe
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [CaAvTray] "C:\Program Files\Yahoo!\Antivirus\CAVTray.exe"
O4 - HKLM\..\Run: [CAVRID] "C:\Program Files\Yahoo!\Antivirus\CAVRID.exe"
O4 - HKLM\..\Run: [EPSON Stylus CX3800 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACA.EXE /P26 "EPSON Stylus CX3800 Series" /O6 "USB001" /M "Stylus CX3800"
O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_9
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - Startup: HotSync Manager.LNK = C:\Program Files\palmOne\HOTSYNC.EXE
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~4\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~4\OFFICE11\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1173733541500
O17 - HKLM\System\CCS\Services\Tcpip\..\{733B5572-84DE-41E2-94E8-32B2216299AE}: NameServer = 206.13.28.12,206.13.31.12
O23 - Service: CAISafe - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\ISafe.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\PROSetWired\NCS\Sync\NetSvc.exe
O23 - Service: VET Message Service (VETMSGNT) - Computer Associates International, Inc. - C:\Program Files\Yahoo!\Antivirus\VetMsg.exe
--
End of file - 4531 bytes
vundofix.txt:
VundoFix V6.5.11
Checking Java version...
Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.
Scan started at 2:29:24 PM 11/6/2007
Listing files found while scanning....
C:\windows\system32\ddccyyy.dll
C:\WINDOWS\system32\hhalofvy.dll
C:\windows\system32\rsgilgjt.ini
C:\windows\system32\tjgligsr.dll
Beginning removal...
Attempting to delete C:\windows\system32\ddccyyy.dll
C:\windows\system32\ddccyyy.dll Could not be deleted.
Attempting to delete C:\WINDOWS\system32\hhalofvy.dll
C:\WINDOWS\system32\hhalofvy.dll Has been deleted!
Attempting to delete C:\windows\system32\rsgilgjt.ini
C:\windows\system32\rsgilgjt.ini Has been deleted!
Attempting to delete C:\windows\system32\tjgligsr.dll
C:\windows\system32\tjgligsr.dll Has been deleted!
Performing Repairs to the registry.
Done!
Beginning removal...
Attempting to delete C:\windows\system32\ddccyyy.dll
C:\windows\system32\ddccyyy.dll Has been deleted!
Performing Repairs to the registry.
Done!
VundoFix V6.5.11
Checking Java version...
Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.
Scan started at 2:36:22 PM 11/6/2007
Listing files found while scanning....
No infected files were found.
VundoFix V6.5.11
Checking Java version...
Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.
Scan started at 3:43:39 PM 11/6/2007
Listing files found while scanning....
No infected files were found.
VundoFix V6.5.11
Checking Java version...
Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.
Scan started at 3:46:23 PM 11/6/2007
Listing files found while scanning....
No infected files were found.
VundoFix V6.5.11
Checking Java version...
Java version is 1.4.2.3
Old versions of java are exploitable and should be removed.
Scan started at 4:18:37 PM 11/6/2007
Listing files found while scanning....
No infected files were found.
SUPERAntiSpyware Scan Log:
SUPERAntiSpyware Scan Log
http://www.superantispyware.com
Generated 11/06/2007 at 04:50 PM
Application Version : 3.9.1008
Core Rules Database Version : 3338
Trace Rules Database Version: 1339
Scan type : Complete Scan
Total Scan Time : 00:33:34
Memory items scanned : 378
Memory threats detected : 1
Registry items scanned : 5084
Registry threats detected : 11
File items scanned : 28336
File threats detected : 15
Adware.Vundo Variant
C:\WINDOWS\SYSTEM32\JKKJJ.DLL
C:\WINDOWS\SYSTEM32\JKKJJ.DLL
HKLM\Software\Classes\CLSID\{C553C207-7721-4BB1-9465-18F4D9E230E3}
HKCR\CLSID\{C553C207-7721-4BB1-9465-18F4D9E230E3}
HKCR\CLSID\{C553C207-7721-4BB1-9465-18F4D9E230E3}\InprocServer32
HKCR\CLSID\{C553C207-7721-4BB1-9465-18F4D9E230E3}\InprocServer32#ThreadingModel
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9BD9C6F0-7A7D-4AF6-B33E-E77AD3A0C5F1}
HKCR\CLSID\{9BD9C6F0-7A7D-4AF6-B33E-E77AD3A0C5F1}
HKCR\CLSID\{9BD9C6F0-7A7D-4AF6-B33E-E77AD3A0C5F1}\InprocServer32
HKCR\CLSID\{9BD9C6F0-7A7D-4AF6-B33E-E77AD3A0C5F1}\InprocServer32#ThreadingModel
C:\WINDOWS\SYSTEM32\SSQRR.DLL
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{C553C207-7721-4BB1-9465-18F4D9E230E3}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks#{86882CA4-BE70-4BCE-AEA5-CF40EB8E0BC3}
C:\SYSTEM VOLUME INFORMATION\_RESTORE{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP472\A0039360.DLL
C:\VUNDOFIX BACKUPS\DDCCYYY.DLL.BAD
Unclassified.Unknown Origin
HKLM\Software\Microsoft\Internet Explorer\Toolbar#{11A69AE4-FBED-4832-A2BF-45AF82825583}
Malware.LocusSoftware Inc/BestSellerAntivirus
C:\DOCUMENTS AND SETTINGS\GLEN W\LOCAL SETTINGS\TEMP\INSTALL_EN.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP464\A0038644.EXE
Adware.WINSHOW
C:\DOCUMENTS AND SETTINGS\GLEN W\LOCAL SETTINGS\TEMP\WINSHOW.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP464\A0038674.EXE
Adware.ClickSpring/Yazzle
C:\DOCUMENTS AND SETTINGS\GLEN W\LOCAL SETTINGS\TEMP\YAZZLEBUNDLE-1549.EXE
Trojan.Unknown Origin
C:\SYSTEM VOLUME INFORMATION\_RESTORE{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP464\A0038643.EXE
Trojan.Downloader-Gen/Installer
C:\SYSTEM VOLUME INFORMATION\_RESTORE{202550A8-7A33-4BCA-9586-051D24DDBF8F}\RP464\A0038653.EXE
C:\WINDOWS\B122.EXE
Adware.Vundo Variant/Rel
C:\WINDOWS\SYSTEM32\JJKKJ.BAK2
C:\WINDOWS\SYSTEM32\RRQSS.BAK1
C:\WINDOWS\SYSTEM32\RRQSS.INI
ComboFix.txt:
ComboFix 07-11-02.3 - Glen W 2007-11-06 17:16:40.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.669 [GMT -8:00]
Running from: C:\Documents and Settings\Glen W\Desktop\Current\ComboFix.exe
* Created a new restore point
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\All Users\Application Data.\salesmonitor
C:\Documents and Settings\All Users\Start Menu\Live Safety Center.lnk
C:\Documents and Settings\All Users\Start Menu\Online Security Guide.lnk
C:\Documents and Settings\Glen W\Favorites\Online Security Guide.lnk
C:\Program Files\Temporary
C:\Temp\fCOe
C:\WINDOWS\system32\dytnquog.dll
C:\WINDOWS\system32\gbqbduvo.ini
C:\WINDOWS\system32\gouqntyd.ini
C:\WINDOWS\system32\jjkkj.bak1
C:\WINDOWS\system32\jjkkj.ini2
C:\WINDOWS\system32\jjkkj.tmp
C:\WINDOWS\system32\mkrswqeo.dll
C:\WINDOWS\system32\oiialdjy.dll
C:\WINDOWS\system32\oTt08e
C:\WINDOWS\system32\ovudbqbg.dll
C:\WINDOWS\system32\pac.txt
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\LEGACY_DOMAINSERVICE
((((((((((((((((((((((((( Files Created from 2007-10-07 to 2007-11-07 )))))))))))))))))))))))))))))))
.
2007-11-06 17:15 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-06 16:03 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2007-11-06 16:03 <DIR> d-------- C:\Documents and Settings\Glen W\Application Data\SUPERAntiSpyware.com
2007-11-06 16:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-11-06 16:02 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-11-06 15:54 <DIR> d-------- C:\Program Files\Trend Micro
2007-11-06 14:35 81,472 --a------ C:\WINDOWS\system32\xhplohos.dll
2007-11-06 14:29 <DIR> d-------- C:\VundoFix Backups
2007-11-06 08:50 87,104 --a------ C:\WINDOWS\system32\jkuusckv.dll
2007-11-06 08:47 71,232 --a------ C:\WINDOWS\system32\nlnwfsxp.exe
2007-11-06 08:45 145,984 --a------ C:\WINDOWS\system32\kplengdn.dll
2007-11-05 09:09 <DIR> d-------- C:\qrnt
2007-11-02 11:47 86,080 --a------ C:\WINDOWS\system32\ywycqhry.dll
2007-10-23 09:00 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-10-23 08:17 582,656 --------- C:\WINDOWS\system32\dllcache\rpcrt4.dll
2007-10-23 07:41 379,224 --ahs---- C:\WINDOWS\system32\rrqss.bak2
2007-10-22 16:10 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll
2007-10-22 16:07 <DIR> d-------- C:\Temp
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-08-21 06:15 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-08-21 06:15 683,520 ------w C:\WINDOWS\system32\dllcache\inetcomm.dll
2006-01-06 21:22:12 56 --sh--r C:\WINDOWS\system32\F5631C8E67.sys
2006-01-06 21:22:13 3,350 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{04167CEF-B42C-478B-B4DA-4F1FADD8C442}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{0585E8C0-8839-4138-B332-60D94881AB77}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{587FCBB2-DFD9-4174-B8ED-FC8D10CB3465}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AAF86FC0-0536-4BEB-989B-11DE86A13BB1}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C4E97293-2489-4FF6-870D-8C5677F8E20F}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CEC4B170-9A03-4343-8887-F2DDB22945B6}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SoundMAXPnP"="C:\Program Files\Analog Devices\Core\smax4pnp.exe" [2004-10-14 17:42]
"IgfxTray"="C:\WINDOWS\system32\igfxtray.exe" [2005-04-05 17:22]
"HotKeysCmds"="C:\WINDOWS\system32\hkcmd.exe" [2005-04-05 17:19]
"Persistence"="C:\WINDOWS\system32\igfxpers.exe" [2005-04-05 17:23]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-12-05 23:05]
"CaAvTray"="C:\Program Files\Yahoo!\Antivirus\CAVTray.exe" [2005-12-30 07:55]
"CAVRID"="C:\Program Files\Yahoo!\Antivirus\CAVRID.exe" [2005-12-30 07:55]
"EPSON Stylus CX3800 Series"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIACA.exe" [2005-02-07 19:00]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"updateMgr"="C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 15:45]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 14:06]
C:\Documents and Settings\Glen W\Start Menu\Programs\Startup\
HotSync Manager.LNK - C:\Program Files\palmOne\HOTSYNC.EXE [2004-02-11 18:29:02]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Documents and Settings^Glen W^Start Menu^Programs^Startup^HotSync Manager.lnk]
path=C:\Documents and Settings\Glen W\Start Menu\Programs\Startup\HotSync Manager.lnk
backup=C:\WINDOWS\pss\HotSync Manager.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cleanup]
C:\DOCUME~1\GLENW~1\LOCALS~1\Temp\200613171557_mcappins.exe /v=3 /cleanup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Corel Photo Downloader]
C:\Program Files\Corel\Corel Photo Album 6\MediaDetect.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Google Desktop Search]
"C:\Program Files\Google\Google Desktop Search\GoogleDesktop.exe" /startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
"c:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
"C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCAgentExe]
c:\PROGRA~1\mcafee.com\agent\mcagent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MCUpdateExe]
c:\PROGRA~1\mcafee.com\agent\mcupdate.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MPFExe]
C:\PROGRA~1\McAfee.com\PERSON~1\MpfTray.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msci]
C:\DOCUME~1\GLENW~1\LOCALS~1\Temp\200613171553_mcinfo.exe /insfin
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKAGENTEXE]
C:\PROGRA~1\McAfee\SPAMKI~1\MskAgent.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSKDetectorExe]
C:\Program Files\McAfee\SpamKiller\MSKDetct.exe /uninstall
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QBReminderFlash]
"C:\Program Files\Intuit\QuickBooks 2005\Atom\QBReminder.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RealTray]
C:\Program Files\Real\RealPlayer\RealPlay.exe SYSTEMBOOTHIDEPLAYER
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Salestart]
"C:\Program Files\Common Files\SpyGuardPro\bm.exe" dm=http://spyguardpro.com; ad=http://spyguardpro.com
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\winshow]
"C:\WINDOWS\winshow.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\YOP]
C:\PROGRA~1\Yahoo!\YOP\yop.exe /autostart
.
Contents of the 'Scheduled Tasks' folder
"2007-05-01 22:40:16 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2005-12-30 15:12:58 C:\WINDOWS\Tasks\ISP signup reminder 1.job"
- C:\WINDOWS\system32\OOBE\oobebaln.exe
.
**************************************************************************
catchme 0.3.1250 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-06 17:21:03
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-11-06 17:22:26 - machine was rebooted
.
--- E O F ---