View Full Version : Virtumonde & win32.BHO.df need some assistance
can someone assist me please :red:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 12:14:14, on 10/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\DU Meter\DUMeter.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Lexmark 9300 Series\ezprint.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\uTorrent\utorrent.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\PROGRA~1\MICROS~2\rapimgr.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\lxcqcoms.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\download\HiJackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O3 - Toolbar: Ask Toolbar - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL
O3 - Toolbar: (no name) - {11A69AE4-FBED-4832-A2BF-45AF82825583} - (no file)
O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [lxcqmon.exe] "C:\Program Files\Lexmark 9300 Series\lxcqmon.exe"
O4 - HKLM\..\Run: [Lexmark 9300 Series Fax Server] "C:\Program Files\Lexmark 9300 Series\fm3032.exe" /s
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 9300 Series\ezprint.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [LXCQCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCQtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [743fae18] rundll32.exe "C:\WINDOWS\system32\odnwqwfm.dll",b
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [µTorrent] "C:\Program Files\uTorrent\utorrent.exe"
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\utorrent.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [HijackThis startup scan] C:\download\HijackThis.exe /startupscan
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: myiHome Server.lnk = C:\Program Files\myiHome\app\myiHome-server.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1192886171859
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\WINDOWS\system32\__c0048F84.dat
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: lxcq_device - - C:\WINDOWS\system32\lxcqcoms.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
--
End of file - 7798 bytes
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Saturday, November 10, 2007 7:10:05 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 10/11/2007
Kaspersky Anti-Virus database records: 456005
-------------------------------------------------------------------------------
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
H:\
Scan Statistics:
Total number of scanned objects: 106542
Number of viruses found: 23
Number of infected objects: 103
Number of suspicious objects: 0
Duration of the scan process: 02:58:28
Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Nero\Nero8\Nero BackItUp\Cache\NeroBackItUpScheduler3.log Object is locked skipped
C:\Documents and Settings\home\Application Data\$_hpcst$.hpc Object is locked skipped
C:\Documents and Settings\home\Application Data\Mozilla\Firefox\Profiles\6dwgxii1.default\cert8.db Object is locked skipped
C:\Documents and Settings\home\Application Data\Mozilla\Firefox\Profiles\6dwgxii1.default\formhistory.dat Object is locked skipped
C:\Documents and Settings\home\Application Data\Mozilla\Firefox\Profiles\6dwgxii1.default\history.dat Object is locked skipped
C:\Documents and Settings\home\Application Data\Mozilla\Firefox\Profiles\6dwgxii1.default\key3.db Object is locked skipped
C:\Documents and Settings\home\Application Data\Mozilla\Firefox\Profiles\6dwgxii1.default\search.sqlite Object is locked skipped
C:\Documents and Settings\home\Application Data\Mozilla\Firefox\Profiles\6dwgxii1.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\home\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\home\Local Settings\Application Data\Microsoft\Messenger\stuarthend@hotmail.com\SharingMetadata\Logs\Dfsr00005.log Object is locked skipped
C:\Documents and Settings\home\Local Settings\Application Data\Microsoft\Messenger\stuarthend@hotmail.com\SharingMetadata\pending.dat Object is locked skipped
C:\Documents and Settings\home\Local Settings\Application Data\Microsoft\Messenger\stuarthend@hotmail.com\SharingMetadata\Working\database_8A74_3FC1_743F_AEB7\dfsr.db Object is locked skipped
C:\Documents and Settings\home\Local Settings\Application Data\Microsoft\Messenger\stuarthend@hotmail.com\SharingMetadata\Working\database_8A74_3FC1_743F_AEB7\fsr.log Object is locked skipped
C:\Documents and Settings\home\Local Settings\Application Data\Microsoft\Messenger\stuarthend@hotmail.com\SharingMetadata\Working\database_8A74_3FC1_743F_AEB7\fsrtmp.log Object is locked skipped
C:\Documents and Settings\home\Local Settings\Application Data\Microsoft\Messenger\stuarthend@hotmail.com\SharingMetadata\Working\database_8A74_3FC1_743F_AEB7\tmp.edb Object is locked skipped
C:\Documents and Settings\home\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\home\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\home\Local Settings\Application Data\Microsoft\Windows Live Contacts\stuarthend@hotmail.com\real\members.stg Object is locked skipped
C:\Documents and Settings\home\Local Settings\Application Data\Microsoft\Windows Live Contacts\stuarthend@hotmail.com\shadow\members.stg Object is locked skipped
C:\Documents and Settings\home\Local Settings\Application Data\Mozilla\Firefox\Profiles\6dwgxii1.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\home\Local Settings\Application Data\Mozilla\Firefox\Profiles\6dwgxii1.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\home\Local Settings\Application Data\Mozilla\Firefox\Profiles\6dwgxii1.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\home\Local Settings\Application Data\Mozilla\Firefox\Profiles\6dwgxii1.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\home\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\home\Local Settings\History\History.IE5\MSHist012007111020071111\index.dat Object is locked skipped
C:\Documents and Settings\home\Local Settings\Temp\flaAE0C.tmp Object is locked skipped
C:\Documents and Settings\home\Local Settings\Temp\hsperfdata_home\2076 Object is locked skipped
C:\Documents and Settings\home\Local Settings\Temp\WCESLog.log Object is locked skipped
C:\Documents and Settings\home\Local Settings\Temp\~DF7B4C.tmp Object is locked skipped
C:\Documents and Settings\home\Local Settings\Temp\~DF7B81.tmp Object is locked skipped
C:\Documents and Settings\home\Local Settings\Temp\~DF8AFA.tmp Object is locked skipped
C:\Documents and Settings\home\Local Settings\Temp\~DF8B06.tmp Object is locked skipped
C:\Documents and Settings\home\Local Settings\Temporary Internet Files\Content.IE5\CQUA5Z8G\mosx1024[1] Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\Documents and Settings\home\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\home\My Documents\Downloads\Nero Ultra, Essentials + Keygen Generator\Nero-7.8.5.0 eng.exe/Toolbar.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped
C:\Documents and Settings\home\My Documents\Downloads\Nero Ultra, Essentials + Keygen Generator\Nero-7.8.5.0 eng.exe RAR: infected - 1 skipped
C:\Documents and Settings\home\My Documents\kiss now\app.log Object is locked skipped
C:\Documents and Settings\home\My Documents\kiss now\eventbroker.log Object is locked skipped
C:\Documents and Settings\home\My Documents\kiss now\kissnow.log Object is locked skipped
C:\Documents and Settings\home\My Documents\kiss now\net.log Object is locked skipped
C:\Documents and Settings\home\My Documents\kiss now\runtime.log Object is locked skipped
C:\Documents and Settings\home\ntuser.dat Object is locked skipped
C:\Documents and Settings\home\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\download\DivoCodec-1.3.0.0-setup-0712.exe.part/file4 Infected: Trojan.Win32.Obfuscated.en skipped
C:\download\DivoCodec-1.3.0.0-setup-0712.exe.part Inno: infected - 1 skipped
C:\download\UltraVNC-102-Setup.exe/file04 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c skipped
C:\download\UltraVNC-102-Setup.exe/file05 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c skipped
C:\download\UltraVNC-102-Setup.exe/file34 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.1102 skipped
C:\download\UltraVNC-102-Setup.exe Inno: infected - 3 skipped
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\logs\starwind.2007-11-10.12-12-59.log Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\integ\avast.int Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\AshWebSv.ws Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\aswMaiSv.log Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\report\Resident protection.txt Object is locked skipped
C:\Program Files\AskTBar\bar\1.bin\A5POPSWT.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.az skipped
C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.az skipped
C:\Program Files\Nero\Nero8\Nero BackItUp\BIU1.txt Object is locked skipped
C:\Program Files\UltraVNC\vnchooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c skipped
C:\Program Files\UltraVNC\vncviewer.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.1102 skipped
C:\Program Files\UltraVNC\winvnc.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP259\A0021126.exe Infected: Trojan-Downloader.Win32.Agent.ehg skipped
C:\System Volume Information\_restore{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP259\A0021127.exe/data.rar/pwdump2/pwdump2.exe Infected: not-a-virus:PSWTool.Win32.PWDump.2 skipped
C:\System Volume Information\_restore{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP259\A0021127.exe/data.rar/pwdump2/samdump.dll Infected: not-a-virus:PSWTool.Win32.PWDump.2 skipped
C:\System Volume Information\_restore{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP259\A0021127.exe/data.rar/RockXP4_.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
C:\System Volume Information\_restore{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP259\A0021127.exe/data.rar Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
C:\System Volume Information\_restore{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP259\A0021127.exe RarSFX: infected - 4 skipped
C:\System Volume Information\_restore{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP259\A0021128.exe Infected: Backdoor.Win32.Rbot.eaa skipped
C:\System Volume Information\_restore{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP259\A0021132.dll Infected: not-a-virus:AdWare.Win32.SecToolBar.h skipped
C:\System Volume Information\_restore{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP262\A0021544.dll Infected: not-a-virus:AdWare.Win32.SecToolBar.h skipped
C:\System Volume Information\_restore{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP262\A0021545.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.ady skipped
C:\System Volume Information\_restore{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP262\A0021614.exe Infected: not-a-virus:AdWare.Win32.Agent.qi skipped
C:\System Volume Information\_restore{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP262\A0021657.exe Infected: Trojan-Downloader.Win32.Agent.enr skipped
C:\System Volume Information\_restore{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP263\A0021736.dll Infected: not-a-virus:AdWare.Win32.SecToolBar.h skipped
C:\System Volume Information\_restore{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP266\A0021863.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.agh skipped
C:\System Volume Information\_restore{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP268\A0022864.dll Infected: Trojan.Win32.BHO.rf skipped
C:\System Volume Information\_restore{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP268\A0022892.dll Infected: not-a-virus:AdWare.Win32.SecToolBar.h skipped
C:\System Volume Information\_restore{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP268\A0022893.dll Infected: not-a-virus:AdWare.Win32.SecToolBar.h skipped
C:\System Volume Information\_restore{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP268\A0022894.dll Infected: not-a-virus:AdWare.Win32.SecToolBar.h skipped
C:\System Volume Information\_restore{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP272\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\aqkpvsox.dll Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\WINDOWS\system32\axjffnpm.dll Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\WINDOWS\system32\bgiojdlw.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aea skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\dihijibt.dll Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\iiygaxre.dll Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\WINDOWS\system32\jcohfjca.dll Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\WINDOWS\system32\jrckcbmf.dll Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\WINDOWS\system32\kggkxqmw.dll Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\WINDOWS\system32\kmhavjhl.dll Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\WINDOWS\system32\lsopnhco.dll Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\WINDOWS\system32\mvonqjqg.dll Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\WINDOWS\system32\sdyghndc.dll Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\WINDOWS\system32\sedqqcgs.dll Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\WINDOWS\system32\tatwbdam.dll Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\WINDOWS\system32\urqnmlj.dll Infected: Trojan-Downloader.Win32.Small.gjr skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\system32\wpdprwfm.dll Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\WINDOWS\system32\wvuvspm.dll Infected: Trojan-Downloader.Win32.Small.gnb skipped
C:\WINDOWS\system32\__c00135F4.dat Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\WINDOWS\system32\__c0048F84.dat Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\WINDOWS\system32\__c004B90E.dat Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\WINDOWS\system32\__c005FB00.dat Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\WINDOWS\system32\__c0085324.dat Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\WINDOWS\system32\__c0086E10.dat Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\WINDOWS\system32\__c0097E71.dat Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\WINDOWS\system32\__c009C4DC.dat Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\WINDOWS\system32\__c00D1510.dat Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\WINDOWS\system32\__c00EDEEC.dat Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\WINDOWS\Temp\Perflib_Perfdata_650.dat Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_b18.dat Object is locked skipped
C:\WINDOWS\Temp\_avast4_\Webshlock.txt Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
D:\System Volume Information\_restore{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP272\change.log Object is locked skipped
E:\download\Nero.Ultra.Edition.v8.0.3.0.Retail-ZWTiSO\nue8.0.3.0r.iso/Nero PhotoShow Express/nero_photoshow_express_5_setup.exe/data0017 Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped
E:\download\Nero.Ultra.Edition.v8.0.3.0.Retail-ZWTiSO\nue8.0.3.0r.iso/Nero PhotoShow Express/nero_photoshow_express_5_setup.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped
E:\download\Nero.Ultra.Edition.v8.0.3.0.Retail-ZWTiSO\nue8.0.3.0r.iso/Toolbar.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped
E:\download\Nero.Ultra.Edition.v8.0.3.0.Retail-ZWTiSO\nue8.0.3.0r.iso ISO image: infected - 3 skipped
E:\download\Office 2007 Key Gen.rar/Office 2007 Key Gen/MicrosoftOfficeKeyGen.exe Infected: Backdoor.Win32.VB.bce skipped
E:\download\Office 2007 Key Gen.rar RAR: infected - 1 skipped
E:\download\PC.Tools.Registry.Mechanic.v7.1.0.1010.Incl.Crack-CFF\rminstall.exe Infected: Backdoor.Win32.IRCBot.aok skipped
E:\old h drive\download\keyfinder.exe/data.rar/xpkey.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
E:\old h drive\download\keyfinder.exe/data.rar/officekey.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
E:\old h drive\download\keyfinder.exe/data.rar Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
E:\old h drive\download\keyfinder.exe RarSFX: infected - 3 skipped
E:\old h drive\download\kf141.zip/keyfinder.exe/data.rar/xpkey.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
E:\old h drive\download\kf141.zip/keyfinder.exe/data.rar/officekey.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
E:\old h drive\download\kf141.zip/keyfinder.exe/data.rar Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
E:\old h drive\download\kf141.zip/keyfinder.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
E:\old h drive\download\kf141.zip ZIP: infected - 4 skipped
E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
E:\System Volume Information\_restore{893CE42B-E29C-403D-B83B-741AF67E01BD}\RP240\A0033982.exe/data0000.cab/Server.exe Infected: Backdoor.Win32.Dragonbot.k skipped
E:\System Volume Information\_restore{893CE42B-E29C-403D-B83B-741AF67E01BD}\RP240\A0033982.exe/data0000.cab Infected: Backdoor.Win32.Dragonbot.k skipped
E:\System Volume Information\_restore{893CE42B-E29C-403D-B83B-741AF67E01BD}\RP240\A0033982.exe Rsrc-Package: infected - 2 skipped
E:\System Volume Information\_restore{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP246\A0018767.exe/data0000.cab/wr-1-922.exe Infected: Trojan-Downloader.Win32.Small.fuq skipped
E:\System Volume Information\_restore{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP246\A0018767.exe/data0000.cab Infected: Trojan-Downloader.Win32.Small.fuq skipped
E:\System Volume Information\_restore{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP246\A0018767.exe Rsrc-Package: infected - 2 skipped
E:\System Volume Information\_restore{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP246\A0018768.exe/data0000.cab/wr-1-922.exe Infected: Trojan-Downloader.Win32.Small.fuq skipped
E:\System Volume Information\_restore{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP246\A0018768.exe/data0000.cab Infected: Trojan-Downloader.Win32.Small.fuq skipped
E:\System Volume Information\_restore{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP246\A0018768.exe Rsrc-Package: infected - 2 skipped
E:\System Volume Information\_restore{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP272\change.log Object is locked skipped
F:\movie's\Nero 8.0.3.0 Ultra Edition Retail + Keygen [h33t] [CaZoR]\Nero 8.0.3.0 Ultra Edition Retail.nrg/Nero PhotoShow Express/nero_photoshow_express_5_setup.exe;1/data0017 Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped
F:\movie's\Nero 8.0.3.0 Ultra Edition Retail + Keygen [h33t] [CaZoR]\Nero 8.0.3.0 Ultra Edition Retail.nrg/Nero PhotoShow Express/nero_photoshow_express_5_setup.exe;1 Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped
F:\movie's\Nero 8.0.3.0 Ultra Edition Retail + Keygen [h33t] [CaZoR]\Nero 8.0.3.0 Ultra Edition Retail.nrg/Toolbar.exe;1 Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped
F:\movie's\Nero 8.0.3.0 Ultra Edition Retail + Keygen [h33t] [CaZoR]\Nero 8.0.3.0 Ultra Edition Retail.nrg ISO image: infected - 3 skipped
F:\movie's\Nero.Ultra.Edition.v8.0.3.0.Retail-ZWTiSO\nue8.0.3.0r.iso/Nero PhotoShow Express/nero_photoshow_express_5_setup.exe/data0017 Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped
F:\movie's\Nero.Ultra.Edition.v8.0.3.0.Retail-ZWTiSO\nue8.0.3.0r.iso/Nero PhotoShow Express/nero_photoshow_express_5_setup.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped
F:\movie's\Nero.Ultra.Edition.v8.0.3.0.Retail-ZWTiSO\nue8.0.3.0r.iso/Toolbar.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped
F:\movie's\Nero.Ultra.Edition.v8.0.3.0.Retail-ZWTiSO\nue8.0.3.0r.iso ISO image: infected - 3 skipped
F:\movie's\Nero.Ultra.Edition.v8.0.3.0.Retail-ZWTiSO\nue8.0.3.0r.rar/nue8.0.3.0r.iso/Nero PhotoShow Express/nero_photoshow_express_5_setup.exe/data0017 Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped
F:\movie's\Nero.Ultra.Edition.v8.0.3.0.Retail-ZWTiSO\nue8.0.3.0r.rar/nue8.0.3.0r.iso/Nero PhotoShow Express/nero_photoshow_express_5_setup.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped
F:\movie's\Nero.Ultra.Edition.v8.0.3.0.Retail-ZWTiSO\nue8.0.3.0r.rar/nue8.0.3.0r.iso/Toolbar.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped
F:\movie's\Nero.Ultra.Edition.v8.0.3.0.Retail-ZWTiSO\nue8.0.3.0r.rar/nue8.0.3.0r.iso Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped
F:\movie's\Nero.Ultra.Edition.v8.0.3.0.Retail-ZWTiSO\nue8.0.3.0r.rar RAR: infected - 4 skipped
F:\movie's\WinAVI Video Converter 8.1.1 + serial+ working key\HelixSDK RM converter kit for WinAVI.exe/data0000.cab/wr-1-922.exe Infected: Trojan-Downloader.Win32.Small.fuq skipped
F:\movie's\WinAVI Video Converter 8.1.1 + serial+ working key\HelixSDK RM converter kit for WinAVI.exe/data0000.cab Infected: Trojan-Downloader.Win32.Small.fuq skipped
F:\movie's\WinAVI Video Converter 8.1.1 + serial+ working key\HelixSDK RM converter kit for WinAVI.exe Rsrc-Package: infected - 2 skipped
F:\movie's\WinAVI Video Converter 8.1.1 + serial+ working key\WinAVI_Video_Converter 8.0.exe/data0000.cab/wr-1-922.exe Infected: Trojan-Downloader.Win32.Small.fuq skipped
F:\movie's\WinAVI Video Converter 8.1.1 + serial+ working key\WinAVI_Video_Converter 8.0.exe/data0000.cab Infected: Trojan-Downloader.Win32.Small.fuq skipped
F:\movie's\WinAVI Video Converter 8.1.1 + serial+ working key\WinAVI_Video_Converter 8.0.exe Rsrc-Package: infected - 2 skipped
F:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
F:\System Volume Information\_restore{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP272\change.log Object is locked skipped
Scan process completed.
steamwiz
2007-11-10, 20:34
Hi
Please just use this thread from now ...
Download Superantispyware.
http://www.superantispyware.com/
Once downloaded and installed update the definitions
and then run a full system scan quarantine what it finds!
* Double-click SUPERAntiSypware.exe and use the default settings for installation.
* An icon will be created on your desktop. Double-click that icon to launch the program.
* If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here.)
http://www.superantispyware.com/definitions.html
* Under "Configuration and Preferences", click the Preferences button.
* Click the Scanning Control tab.
* Under Scanner Options make sure the following are checked (leave all others unchecked):
o Close browsers before scanning.
o Scan for tracking cookies.
o Terminate memory threats before quarantining.
* Click the "Close" button to leave the control center screen.
* Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
* On the left, make sure you check C:\Fixed Drive.
* On the right, under "Complete Scan", choose Perform Complete Scan.
* Click "Next" to start the scan. Please be patient while it scans your computer.
* After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
* Make sure everything has a checkmark next to it and click "Next".
* A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
* If asked if you want to reboot, click "Yes".
* To retrieve the removal information after reboot, launch SUPERAntispyware again.
o Click Preferences, then click the Statistics/Logs tab.
o Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
o If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
o Please copy and paste the Scan Log results in your next reply.
* Click Close to exit the program.
THEN ...
Please download Combofix: http://download.bleepingcomputer.com/sUBs/Beta/ComboFix.exe
and save to the desktop.
1. Double click on combo.exe & follow the prompts.
2. When finished, it will produce a logfile located at C:\ComboFix.txt.
3. Post the contents of that log in your next reply with a new hijackthis log.
Notes:
* Do not mouseclick combofix's window while it is running. That may cause your system to stall/hang.
* Disable script blocking if you have NAV installed so it will not interfere with the fix. Trojan Hunter has been reported to detect combofix as Worm.Qiv.100.
Please remember to post :-
1. SUPERAntiSpyware Scan Log
2. C:\ComboFix.txt
3. a new hijackthis log.( run after everything else)
steam
SUPERAntiSpyware Scan Log
http://www.superantispyware.com
Generated 11/10/2007 at 10:15 PM
Application Version : 3.9.1008
Core Rules Database Version : 3342
Trace Rules Database Version: 1343
Scan type : Complete Scan
Total Scan Time : 02:19:21
Memory items scanned : 583
Memory threats detected : 3
Registry items scanned : 6751
Registry threats detected : 36
File items scanned : 102056
File threats detected : 211
Adware.Vundo Variant
C:\WINDOWS\SYSTEM32\SSQPP.DLL
C:\WINDOWS\SYSTEM32\SSQPP.DLL
HKLM\Software\Classes\CLSID\{5B6E6CB8-01B1-48AD-8A19-62E9F61E21A3}
HKCR\CLSID\{5B6E6CB8-01B1-48AD-8A19-62E9F61E21A3}
HKCR\CLSID\{5B6E6CB8-01B1-48AD-8A19-62E9F61E21A3}\InprocServer32
HKCR\CLSID\{5B6E6CB8-01B1-48AD-8A19-62E9F61E21A3}\InprocServer32#ThreadingModel
HKLM\Software\Classes\CLSID\{89AD4D75-2429-462e-BD4E-443F233F6033}
HKCR\CLSID\{89AD4D75-2429-462E-BD4E-443F233F6033}
HKCR\CLSID\{89AD4D75-2429-462E-BD4E-443F233F6033}\InprocServer32
HKCR\CLSID\{89AD4D75-2429-462E-BD4E-443F233F6033}\InprocServer32#ThreadingModel
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5B6E6CB8-01B1-48AD-8A19-62E9F61E21A3}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{89AD4D75-2429-462e-BD4E-443F233F6033}
HKCR\CLSID\{89AD4D75-2429-462E-BD4E-443F233F6033}
Trojan.Downloader-NewJuan/VM
C:\WINDOWS\SYSTEM32\BGIOJDLW.DLL
C:\WINDOWS\SYSTEM32\BGIOJDLW.DLL
Adware.eZula
C:\WINDOWS\SYSTEM32\HKSJNOOW.EXE
C:\WINDOWS\SYSTEM32\HKSJNOOW.EXE
C:\WINDOWS\Prefetch\HKSJNOOW.EXE-04A73249.pf
Adware.AdSponsor/ISM
HKLM\Software\Classes\CLSID\{1ED6A320-8AF3-4f06-868A-9BA95585712E}
HKLM\Software\Classes\CLSID\{8ABA9A9C-8791-4d61-8D5B-BCC9448EA573}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8ABA9A9C-8791-4d61-8D5B-BCC9448EA573}
HKLM\Software\Microsoft\Internet Explorer\Explorer Bars\{1ED6A320-8AF3-4f06-868A-9BA95585712E}
HKCR\CLSID\{1ED6A320-8AF3-4F06-868A-9BA95585712E}
HKCR\CLSID\{1ED6A320-8AF3-4F06-868A-9BA95585712E}#AppID
HKCR\CLSID\{1ED6A320-8AF3-4F06-868A-9BA95585712E}\Implemented Categories
HKCR\CLSID\{1ED6A320-8AF3-4F06-868A-9BA95585712E}\Implemented Categories\{00021493-0000-0000-C000-000000000046}
HKCR\CLSID\{1ED6A320-8AF3-4F06-868A-9BA95585712E}\InprocServer32
HKCR\CLSID\{1ED6A320-8AF3-4F06-868A-9BA95585712E}\InprocServer32#ThreadingModel
HKCR\CLSID\{1ED6A320-8AF3-4F06-868A-9BA95585712E}\ProgID
HKCR\CLSID\{1ED6A320-8AF3-4F06-868A-9BA95585712E}\TypeLib
HKCR\CLSID\{1ED6A320-8AF3-4F06-868A-9BA95585712E}\VersionIndependentProgID
HKCR\CLSID\{8ABA9A9C-8791-4D61-8D5B-BCC9448EA573}
HKCR\CLSID\{8ABA9A9C-8791-4D61-8D5B-BCC9448EA573}#AppID
HKCR\CLSID\{8ABA9A9C-8791-4D61-8D5B-BCC9448EA573}\InprocServer32
HKCR\CLSID\{8ABA9A9C-8791-4D61-8D5B-BCC9448EA573}\InprocServer32#ThreadingModel
HKCR\CLSID\{8ABA9A9C-8791-4D61-8D5B-BCC9448EA573}\ProgID
HKCR\CLSID\{8ABA9A9C-8791-4D61-8D5B-BCC9448EA573}\TypeLib
HKCR\CLSID\{8ABA9A9C-8791-4D61-8D5B-BCC9448EA573}\VersionIndependentProgID
HKU\S-1-5-21-1060284298-1715567821-725345543-1003\Software\BndDrive
C:\SYSTEM VOLUME INFORMATION\_RESTORE{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP262\A0021614.EXE
C:\SYSTEM VOLUME INFORMATION\_RESTORE{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP262\A0021615.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP262\A0021617.EXE
Unclassified.Unknown Origin
HKLM\Software\Microsoft\Internet Explorer\Toolbar#{11A69AE4-FBED-4832-A2BF-45AF82825583}
HKU\S-1-5-21-1060284298-1715567821-725345543-1003\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser#{11A69AE4-FBED-4832-A2BF-45AF82825583}
Trojan.Downloader-Gen/DDC
HKLM\System\ControlSet001\Services\DomainService
HKLM\System\CurrentControlSet\Services\DomainService
C:\DOCUMENTS AND SETTINGS\HOME\LOCAL SETTINGS\TEMPORARY INTERNET FILES\CONTENT.IE5\LQAXRZLO\POCHKI20071106[1]
C:\WINDOWS\SYSTEM32\KWEOGEQP.EXE
C:\WINDOWS\SYSTEM32\QEOVMHPY.EXE
C:\WINDOWS\SYSTEM32\RUSYRXMM.EXE
C:\WINDOWS\Prefetch\KWEOGEQP.EXE-272F0207.pf
C:\WINDOWS\Prefetch\QEOVMHPY.EXE-31755B6E.pf
Adware.Tracking Cookie
C:\Documents and Settings\home\Cookies\home@atdmt[2].txt
C:\Documents and Settings\home\Cookies\home@smartweb.advertserve[1].txt
C:\Documents and Settings\home\Cookies\home@directtrack[1].txt
C:\Documents and Settings\home\Cookies\home@hitbox[95].txt
C:\Documents and Settings\home\Cookies\home@a[1].txt
C:\Documents and Settings\home\Cookies\home@doubleclick[1].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[4].txt
C:\Documents and Settings\home\Cookies\home@ad1.emediate[2].txt
C:\Documents and Settings\home\Cookies\home@angleinteractive.directtrack[2].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[10].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[11].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[12].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[13].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[14].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[15].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[16].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[17].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[18].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[19].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[1].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[20].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[21].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[22].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[23].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[24].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[25].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[26].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[27].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[28].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[29].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[2].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[30].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[31].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[32].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[33].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[34].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[35].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[36].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[37].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[38].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[39].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[3].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[40].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[41].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[42].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[43].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[44].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[45].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[46].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[47].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[48].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[49].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[50].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[51].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[52].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[53].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[54].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[55].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[56].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[57].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[58].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[59].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[5].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[60].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[61].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[62].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[63].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[64].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[65].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[66].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[67].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[68].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[69].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[6].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[70].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[71].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[72].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[73].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[74].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[75].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[76].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[77].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[78].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[79].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[7].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[80].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[81].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[82].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[83].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[84].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[85].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[8].txt
C:\Documents and Settings\home\Cookies\home@ehg-kasperskylab.hitbox[9].txt
C:\Documents and Settings\home\Cookies\home@hitbox[10].txt
C:\Documents and Settings\home\Cookies\home@hitbox[11].txt
C:\Documents and Settings\home\Cookies\home@hitbox[12].txt
C:\Documents and Settings\home\Cookies\home@hitbox[13].txt
C:\Documents and Settings\home\Cookies\home@hitbox[14].txt
C:\Documents and Settings\home\Cookies\home@hitbox[15].txt
C:\Documents and Settings\home\Cookies\home@hitbox[16].txt
C:\Documents and Settings\home\Cookies\home@hitbox[17].txt
C:\Documents and Settings\home\Cookies\home@hitbox[18].txt
C:\Documents and Settings\home\Cookies\home@hitbox[19].txt
C:\Documents and Settings\home\Cookies\home@hitbox[1].txt
C:\Documents and Settings\home\Cookies\home@hitbox[20].txt
C:\Documents and Settings\home\Cookies\home@hitbox[21].txt
C:\Documents and Settings\home\Cookies\home@hitbox[22].txt
C:\Documents and Settings\home\Cookies\home@hitbox[23].txt
C:\Documents and Settings\home\Cookies\home@hitbox[24].txt
C:\Documents and Settings\home\Cookies\home@hitbox[25].txt
C:\Documents and Settings\home\Cookies\home@hitbox[26].txt
C:\Documents and Settings\home\Cookies\home@hitbox[27].txt
C:\Documents and Settings\home\Cookies\home@hitbox[28].txt
C:\Documents and Settings\home\Cookies\home@hitbox[29].txt
C:\Documents and Settings\home\Cookies\home@hitbox[2].txt
C:\Documents and Settings\home\Cookies\home@hitbox[30].txt
C:\Documents and Settings\home\Cookies\home@hitbox[31].txt
C:\Documents and Settings\home\Cookies\home@hitbox[32].txt
C:\Documents and Settings\home\Cookies\home@hitbox[33].txt
C:\Documents and Settings\home\Cookies\home@hitbox[34].txt
C:\Documents and Settings\home\Cookies\home@hitbox[35].txt
C:\Documents and Settings\home\Cookies\home@hitbox[36].txt
C:\Documents and Settings\home\Cookies\home@hitbox[37].txt
C:\Documents and Settings\home\Cookies\home@hitbox[38].txt
C:\Documents and Settings\home\Cookies\home@hitbox[39].txt
C:\Documents and Settings\home\Cookies\home@hitbox[3].txt
C:\Documents and Settings\home\Cookies\home@hitbox[40].txt
C:\Documents and Settings\home\Cookies\home@hitbox[41].txt
C:\Documents and Settings\home\Cookies\home@hitbox[42].txt
C:\Documents and Settings\home\Cookies\home@hitbox[43].txt
C:\Documents and Settings\home\Cookies\home@hitbox[44].txt
C:\Documents and Settings\home\Cookies\home@hitbox[45].txt
C:\Documents and Settings\home\Cookies\home@hitbox[46].txt
C:\Documents and Settings\home\Cookies\home@hitbox[47].txt
C:\Documents and Settings\home\Cookies\home@hitbox[48].txt
C:\Documents and Settings\home\Cookies\home@hitbox[49].txt
C:\Documents and Settings\home\Cookies\home@hitbox[50].txt
C:\Documents and Settings\home\Cookies\home@hitbox[51].txt
C:\Documents and Settings\home\Cookies\home@hitbox[52].txt
C:\Documents and Settings\home\Cookies\home@hitbox[53].txt
C:\Documents and Settings\home\Cookies\home@hitbox[54].txt
C:\Documents and Settings\home\Cookies\home@hitbox[55].txt
C:\Documents and Settings\home\Cookies\home@hitbox[56].txt
C:\Documents and Settings\home\Cookies\home@hitbox[57].txt
C:\Documents and Settings\home\Cookies\home@hitbox[58].txt
C:\Documents and Settings\home\Cookies\home@hitbox[59].txt
C:\Documents and Settings\home\Cookies\home@hitbox[5].txt
C:\Documents and Settings\home\Cookies\home@hitbox[60].txt
C:\Documents and Settings\home\Cookies\home@hitbox[61].txt
C:\Documents and Settings\home\Cookies\home@hitbox[62].txt
C:\Documents and Settings\home\Cookies\home@hitbox[63].txt
C:\Documents and Settings\home\Cookies\home@hitbox[64].txt
C:\Documents and Settings\home\Cookies\home@hitbox[65].txt
C:\Documents and Settings\home\Cookies\home@hitbox[66].txt
C:\Documents and Settings\home\Cookies\home@hitbox[67].txt
C:\Documents and Settings\home\Cookies\home@hitbox[68].txt
C:\Documents and Settings\home\Cookies\home@hitbox[69].txt
C:\Documents and Settings\home\Cookies\home@hitbox[6].txt
C:\Documents and Settings\home\Cookies\home@hitbox[70].txt
C:\Documents and Settings\home\Cookies\home@hitbox[71].txt
C:\Documents and Settings\home\Cookies\home@hitbox[72].txt
C:\Documents and Settings\home\Cookies\home@hitbox[73].txt
C:\Documents and Settings\home\Cookies\home@hitbox[74].txt
C:\Documents and Settings\home\Cookies\home@hitbox[75].txt
C:\Documents and Settings\home\Cookies\home@hitbox[76].txt
C:\Documents and Settings\home\Cookies\home@hitbox[77].txt
C:\Documents and Settings\home\Cookies\home@hitbox[78].txt
C:\Documents and Settings\home\Cookies\home@hitbox[79].txt
C:\Documents and Settings\home\Cookies\home@hitbox[7].txt
C:\Documents and Settings\home\Cookies\home@hitbox[80].txt
C:\Documents and Settings\home\Cookies\home@hitbox[81].txt
C:\Documents and Settings\home\Cookies\home@hitbox[82].txt
C:\Documents and Settings\home\Cookies\home@hitbox[83].txt
C:\Documents and Settings\home\Cookies\home@hitbox[84].txt
C:\Documents and Settings\home\Cookies\home@hitbox[85].txt
C:\Documents and Settings\home\Cookies\home@hitbox[86].txt
C:\Documents and Settings\home\Cookies\home@hitbox[87].txt
C:\Documents and Settings\home\Cookies\home@hitbox[88].txt
C:\Documents and Settings\home\Cookies\home@hitbox[89].txt
C:\Documents and Settings\home\Cookies\home@hitbox[8].txt
C:\Documents and Settings\home\Cookies\home@hitbox[90].txt
C:\Documents and Settings\home\Cookies\home@hitbox[91].txt
C:\Documents and Settings\home\Cookies\home@hitbox[92].txt
C:\Documents and Settings\home\Cookies\home@hitbox[93].txt
C:\Documents and Settings\home\Cookies\home@hitbox[94].txt
C:\Documents and Settings\home\Cookies\home@hitbox[9].txt
Trojan.Downloader-Gen/Installer
C:\SYSTEM VOLUME INFORMATION\_RESTORE{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP259\A0021126.EXE
Trojan.Downloader-Gen/Hammer
C:\SYSTEM VOLUME INFORMATION\_RESTORE{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP259\A0021132.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP262\A0021544.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP263\A0021736.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP268\A0022892.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP268\A0022893.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP268\A0022894.DLL
Adware.Vundo-Variant
C:\SYSTEM VOLUME INFORMATION\_RESTORE{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP268\A0022896.DLL
C:\SYSTEM VOLUME INFORMATION\_RESTORE{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP268\A0022900.DLL
C:\WINDOWS\SYSTEM32\LFBLMMER.DLL
Adware.Vundo-Variant/Small
C:\WINDOWS\SYSTEM32\URQNMLJ.DLL
C:\WINDOWS\SYSTEM32\WVUVSPM.DLL
ComboFix 07-11-08.3 - home 2007-11-10 23:29:14.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.488 [GMT 0:00]
Running from: C:\download\ComboFix.exe
* Created a new restore point
.
Unable to gain System Privileges
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\All Users\Start Menu\Live Safety Center.lnk
C:\Documents and Settings\All Users\Start Menu\Online Security Guide.lnk
C:\Documents and Settings\home\Application Data\macromedia\Flash Player\#SharedObjects\P4KEADQX\www.broadcaster.com
C:\Documents and Settings\home\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com
C:\Documents and Settings\home\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#www.broadcaster.com\settings.sol
C:\Documents and Settings\home\Favorites\Online Security Guide.lnk
C:\Program Files\Temporary
C:\WINDOWS\cookies.ini
C:\WINDOWS\system32\__c00135F4.dat
C:\WINDOWS\system32\__c0048F84.dat
C:\WINDOWS\system32\__c004B90E.dat
C:\WINDOWS\system32\__c005FB00.dat
C:\WINDOWS\system32\__c0085324.dat
C:\WINDOWS\system32\__c0086E10.dat
C:\WINDOWS\system32\__c0097E71.dat
C:\WINDOWS\system32\__c009C4DC.dat
C:\WINDOWS\system32\__c00D1510.dat
C:\WINDOWS\system32\__c00EDEEC.dat
C:\WINDOWS\system32\aqkpvsox.dll
C:\WINDOWS\system32\axjffnpm.dll
C:\WINDOWS\system32\dihijibt.dll
C:\WINDOWS\system32\drivers\npf.sys
C:\WINDOWS\system32\iiygaxre.dll
C:\WINDOWS\system32\jcohfjca.dll
C:\WINDOWS\system32\jrckcbmf.dll
C:\WINDOWS\system32\kggkxqmw.dll
C:\WINDOWS\system32\kmhavjhl.dll
C:\WINDOWS\system32\lsopnhco.dll
C:\WINDOWS\system32\mvonqjqg.dll
C:\WINDOWS\system32\obshglim.dllbox
C:\WINDOWS\system32\packet.dll
C:\WINDOWS\system32\ppqss.bak1
C:\WINDOWS\system32\ppqss.bak2
C:\WINDOWS\system32\ppqss.ini
C:\WINDOWS\system32\sdyghndc.dll
C:\WINDOWS\system32\sedqqcgs.dll
C:\WINDOWS\system32\tatwbdam.dll
C:\WINDOWS\system32\wpcap.dll
C:\WINDOWS\system32\wpdprwfm.dll
C:\WINDOWS\system32\xiljjxco.dllbox
C:\WINDOWS\system32\zfzdfjqj.dllbox
.
((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
.
-------\LEGACY_DOMAINSERVICE
-------\NPF
((((((((((((((((((((((((( Files Created from 2007-10-10 to 2007-11-10 )))))))))))))))))))))))))))))))
.
2007-11-10 23:28 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-10 19:50 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-11-10 19:49 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2007-11-10 19:49 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-11-10 19:49 <DIR> d-------- C:\Documents and Settings\home\Application Data\SUPERAntiSpyware.com
2007-11-10 14:33 85,056 --a------ C:\WINDOWS\system32\iphckagb.dll
2007-11-08 18:17 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Sony Ericsson
2007-11-08 17:43 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-11-08 17:43 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-11-08 16:41 <DIR> d-------- C:\Program Files\Sun
2007-11-07 23:00 <DIR> d-------- C:\WINDOWS\system32\XPToolsLicenseComponent
2007-11-07 18:43 19,780 --a------ C:\idsuite_run.bat
2007-11-07 17:37 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-02 02:00 0 --a------ C:\WINDOWS\system32\SBRC.dat
2007-11-02 02:00 0 --a------ C:\WINDOWS\system32\SBFC.dat
2007-10-23 18:01 <DIR> d-------- C:\Program Files\Index.dat Suite
2007-10-22 06:16 <DIR> d-------- C:\Program Files\MagicISO
2007-10-22 02:02 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-10-21 12:45 <DIR> d-------- C:\Program Files\Alcohol Soft
2007-10-21 12:44 639,224 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2007-10-21 11:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\logs
2007-10-21 08:52 <DIR> d-------- C:\Documents and Settings\home\Application Data\Sunbelt Software
2007-10-21 08:27 <DIR> d-------- C:\Program Files\SpyNoMore
2007-10-21 08:27 <DIR> d-------- C:\Program Files\Common Files\Download Manager
2007-10-21 04:16 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2007-10-20 13:08 592 --a------ C:\WINDOWS\chgkey.vbs
2007-10-14 10:20 <DIR> d-------- C:\Program Files\myiHome
2007-10-10 15:20 <DIR> d-------- C:\Program Files\Armadillo Run
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-10 23:33 --------- d-----w C:\Program Files\lx_cats
2007-11-10 23:33 --------- d-----w C:\Documents and Settings\home\Application Data\uTorrent
2007-11-09 22:55 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2007-11-08 10:38 --------- d-----w C:\Program Files\Java
2007-11-07 23:00 --------- d-----w C:\Program Files\XP Registry Cleaner
2007-11-05 07:13 --------- d-----w C:\Program Files\Bit Che
2007-10-23 17:24 --------- d-----w C:\Documents and Settings\home\Application Data\Skype
2007-10-21 11:41 3,888 ----a-w C:\WINDOWS\system32\drivers\NTHANDLE.SYS
2007-10-20 18:19 --------- d-----w C:\Program Files\WinZix
2007-10-11 12:34 --------- d-----w C:\Program Files\Google
2007-10-09 19:11 --------- d-----w C:\Program Files\Common Files\LightScribe
2007-10-09 19:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\LightScribe
2007-10-09 19:07 --------- d-----w C:\Program Files\LightScribeTemplateLabeler
2007-10-03 17:57 --------- d-----w C:\Documents and Settings\home\Application Data\TeamViewer
2007-10-03 17:56 --------- d-----w C:\Program Files\TeamViewer3
2007-10-02 11:23 --------- d-----w C:\Documents and Settings\home\Application Data\Teleca
2007-10-02 11:22 --------- d-----w C:\Program Files\Common Files\Teleca Shared
2007-10-02 11:22 --------- d-----w C:\Program Files\Common Files\Sony Ericsson Shared
2007-10-02 11:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Teleca
2007-10-02 11:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sony Ericsson
2007-10-01 11:57 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-01 11:56 --------- d-----w C:\Program Files\NVIDIA Corporation
2007-09-30 10:28 --------- d-----w C:\Program Files\UltraVNC
2007-09-28 09:26 --------- d-----w C:\Program Files\RegCure
2007-09-26 21:29 --------- d-----w C:\Program Files\Sony Ericsson
2007-09-26 16:49 --------- d-----w C:\Program Files\WinAVI Video Converter
2007-09-25 17:08 --------- d-----w C:\Program Files\DynGate
2007-09-24 18:02 4,016 ----a-w C:\WINDOWS\zlportio.sys
2007-09-24 11:37 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2007-09-24 11:37 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_ggsemc_01005.Wdf
2007-09-24 11:34 19,424 ----a-w C:\WINDOWS\system32\drivers\ggsemc.sys
2007-09-24 11:34 1,419,232 ----a-w C:\WINDOWS\system32\wdfcoinstaller01005.dll
2007-09-24 11:24 --------- d-----w C:\Documents and Settings\home\Application Data\Sony Ericsson
2007-09-22 11:09 --------- d-----w C:\Documents and Settings\home\Application Data\dvdcss
2007-09-16 16:27 --------- d-----w C:\Program Files\WinUtilities
2007-09-16 11:03 --------- d-----w C:\Documents and Settings\home\Application Data\Nero
2007-09-16 11:02 --------- d-----w C:\Program Files\Common Files\Nero
2007-09-16 11:01 --------- d-----w C:\Program Files\Nero
2007-09-16 11:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2007-09-16 09:40 --------- d-----w C:\Program Files\Common Files\Ahead
2007-09-16 09:34 --------- d-----w C:\Program Files\Max Registry Cleaner
2007-09-15 13:06 --------- d-----w C:\Program Files\Sure Delete
2007-09-15 12:42 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2007-09-15 11:41 --------- d-----w C:\Program Files\Uniblue
2007-09-15 11:41 --------- d-----w C:\Documents and Settings\home\Application Data\Uniblue
2007-09-15 11:27 --------- d-----w C:\Program Files\AskTBar
2007-09-15 11:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero(2)
2007-09-11 21:13 --------- d-----w C:\Program Files\DivX
2007-09-10 16:40 --------- d-----w C:\Program Files\Skype
2007-09-10 16:40 --------- d-----w C:\Program Files\Common Files\Skype
2007-09-10 16:40 --------- d-----w C:\Documents and Settings\All Users\Application Data\Skype
2007-09-10 06:03 --------- d-----w C:\Program Files\Combined Community Codec Pack
2007-09-06 10:09 801,144 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-09-06 10:00 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2007-08-21 06:15 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-08-21 00:26 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2007-08-21 00:26 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2007-08-15 22:33 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2007-08-15 22:33 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2007-08-15 22:33 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-08-15 22:33 144,704 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-08-15 22:33 129,784 ------w C:\WINDOWS\system32\pxafs.dll
2007-08-15 22:33 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe
2007-08-15 22:33 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe
2007-08-15 22:33 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-08-15 22:31 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2007-08-15 22:31 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2007-08-15 22:31 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2007-08-15 22:31 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2007-08-15 22:31 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2007-08-15 22:31 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2007-08-15 22:30 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2007-08-15 22:30 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2007-08-15 22:30 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2007-08-15 22:30 740,442 ----a-w C:\WINDOWS\system32\DivX.dll
2007-08-15 22:30 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5B6E6CB8-01B1-48AD-8A19-62E9F61E21A3}]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DU Meter"="C:\Program Files\DU Meter\DUMeter.exe" [2006-11-27 14:18]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 10:06]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 11:22]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 11:22]
"lxcqmon.exe"="C:\Program Files\Lexmark 9300 Series\lxcqmon.exe" [2007-01-11 12:57]
"Lexmark 9300 Series Fax Server"="C:\Program Files\Lexmark 9300 Series\fm3032.exe" [2006-10-26 06:33]
"EzPrint"="C:\Program Files\Lexmark 9300 Series\ezprint.exe" [2006-12-05 08:35]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 02:06]
"LXCQCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCQtime.dll" [2006-11-21 11:27]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-06-13 07:16]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 04:56 C:\WINDOWS\system32\bthprops.cpl]
"743fae18"="C:\WINDOWS\system32\iphckagb.dll" [2007-11-10 14:33]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 11:54]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-06-26 15:13]
"µTorrent"="C:\Program Files\uTorrent\utorrent.exe" [2007-10-02 11:03]
"uTorrent"="C:\Program Files\uTorrent\utorrent.exe" [2007-10-02 11:03]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 16:24]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]
"HijackThis startup scan"="C:\download\HijackThis.exe" []
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 14:06]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
myiHome Server.lnk - C:\Program Files\myiHome\app\myiHome-server.exe [2007-10-14 10:20:58]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\obshglim]
obshglim.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\xiljjxco]
xiljjxco.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\zfzdfjqj]
zfzdfjqj.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
"C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
"C:\Program Files\iTunes\iTunesHelper.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM]
C:\Program Files\PowerISO\PWRISOVM.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
C:\Program Files\PowerISO\PWRISOVM.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
"C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
"C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
R0 nvcchflt;NVIDIA Disk Cache Filter Driver;C:\WINDOWS\system32\DRIVERS\nvcchflt.sys
R2 lxcq_device;lxcq_device;C:\WINDOWS\system32\lxcqcoms.exe -service
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3;C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
R2 SocketLock;Raw Socket Lock Driver;\??\C:\WINDOWS\system32\socketlock.sys
R2 vnccom;vnccom;C:\WINDOWS\system32\Drivers\vnccom.SYS
R3 vncdrv;vncdrv;C:\WINDOWS\system32\DRIVERS\vncdrv.sys
S3 FTD2XX;Universal Box Device Driver;C:\WINDOWS\system32\Drivers\FTD2XX.sys
S3 s116bus;Sony Ericsson Device 116 driver (WDM);C:\WINDOWS\system32\DRIVERS\s116bus.sys
S3 s116mdfl;Sony Ericsson Device 116 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\s116mdfl.sys
S3 s116mdm;Sony Ericsson Device 116 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\s116mdm.sys
S3 s116mgmt;Sony Ericsson Device 116 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\s116mgmt.sys
S3 s116nd5;Sony Ericsson Device 116 USB Ethernet Emulation SEMC116 (NDIS);C:\WINDOWS\system32\DRIVERS\s116nd5.sys
S3 s116obex;Sony Ericsson Device 116 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\s116obex.sys
S3 s116unic;Sony Ericsson Device 116 USB Ethernet Emulation SEMC116 (WDM);C:\WINDOWS\system32\DRIVERS\s116unic.sys
S3 tusbdbuslt;Incentive Pro USB Bus Lite Driver;C:\WINDOWS\system32\DRIVERS\tusbdbuslt.sys
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder
"2007-11-10 23:33:04 C:\WINDOWS\Tasks\RegCure Program Check.job"
"2007-11-08 07:10:47 C:\WINDOWS\Tasks\RegCure.job"
- C:\Program Files\RegCure\RegCure.exe
.
**************************************************************************
catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-10 23:33:08
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-11-10 23:34:34 - machine was rebooted
.
--- E O F ---
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:36:43, on 10/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\DU Meter\DUMeter.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Lexmark 9300 Series\ezprint.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\uTorrent\utorrent.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\PROGRA~1\MICROS~2\rapimgr.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\lxcqcoms.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\download\scanner.exe.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: (no name) - {5B6E6CB8-01B1-48AD-8A19-62E9F61E21A3} - (no file)
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [lxcqmon.exe] "C:\Program Files\Lexmark 9300 Series\lxcqmon.exe"
O4 - HKLM\..\Run: [Lexmark 9300 Series Fax Server] "C:\Program Files\Lexmark 9300 Series\fm3032.exe" /s
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 9300 Series\ezprint.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [LXCQCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCQtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [743fae18] rundll32.exe "C:\WINDOWS\system32\iphckagb.dll",b
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [µTorrent] "C:\Program Files\uTorrent\utorrent.exe"
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\utorrent.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [HijackThis startup scan] C:\download\HijackThis.exe /startupscan
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: myiHome Server.lnk = C:\Program Files\myiHome\app\myiHome-server.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1192886171859
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: obshglim - obshglim.dll (file missing)
O20 - Winlogon Notify: xiljjxco - xiljjxco.dll (file missing)
O20 - Winlogon Notify: zfzdfjqj - zfzdfjqj.dll (file missing)
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: lxcq_device - - C:\WINDOWS\system32\lxcqcoms.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
--
End of file - 8470 bytes
steamwiz
2007-11-11, 21:46
Hi
Is this a dual boot machine ? do you have another XP O\S in your E:\ drive ?
Open notepad and copy/paste the text in the code box below into it:
NOTE* make sure to only highlight and copy what is inside the code box nothing out side of it.
Also ..
Pay particular attention to this :-
Make sure the word Registry:: is on the first line of the text file you save (no blank line above it, & no space in front of it)
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5B6E6CB8-01B1-48AD-8A19-62E9F61E21A3}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\obshglim]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\xiljjxco]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\zfzdfjqj]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"743fae18"=-
Save this as "CFScript.txt"
Then drag the CFScript.txt into ComboFix.exe as you see in the screenshot below.
http://img.photobucket.com/albums/v666/sUBs/CFScript.gif
This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.
-
Please Download CCleaner from :-
http://www.filehippo.com/download_ccleaner/ (click the download tab)
During the installation be sure to UN-check the box for "Ccleaner Yahoo Toolbar" unless you want it.
doubleclick the ccsetup.exe file and install the program...
After installing, go to Start > programs > CCleaner > Options > Advanced > UNCHECK "Only delete files in Windows Temp folder older than 48 hours"
Make sure the "windows" tab is selected
Under "internet explorer" tick...
Temporary internet files
Cookies* > see Note below
History
Recently typed URL's (leave this unticked if you DON'T want to clear the drop down list in the address window of IE)
Delete index.dat files
Last download location
Autocomplete form history
under "Windows explorer" these are optional, but you can safely tick them all if you wish, they are only "most recently used lists"
Other explorer MRU's (leave this unticked if you DON'T want to clear lists such as the start\run list)
under "System"
Tick ALL these ...
under "Advanced"
no need to tick any of these (but you can if you want, and realise what they do)
Applications tab...
These will mostly clean out old log files for these applications...
Clean:- (if you use them)
Firefox/Mozilla (optional - leave the cookies - see note)
Opera
Sun Java
ZoneAlarm
...
Personally I clean everything in the applications tab... but you tick what you want...
Note: *If there are any cookies you want to keep (if you remove the cookie for a site you require a password for, you will need to re-enter your password when you next visit that site) ... click options > cookies > then keep the cookies you want.
click "analyse" if you want to see a list of what is going to be removed, before it is removed.
Or
click "run cleaner" to let it get on with it's work... clicking this will result in the following pop-up
"This process will permanently delete files from your system. Are you sure you wish to proceed?"
click OK.
cheers
steam
ComboFix 07-11-08.3 - home 2007-11-13 7:34:22.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.520 [GMT 0:00]
Running from: C:\download\ComboFix.exe
Command switches used :: C:\Documents and Settings\home\Desktop\CFScript.txt
* Created a new restore point
.
((((((((((((((((((((((((( Files Created from 2007-10-13 to 2007-11-13 )))))))))))))))))))))))))))))))
.
2007-11-11 13:18 <DIR> d-------- C:\VundoFix Backups
2007-11-11 11:56 <DIR> d-------- C:\Documents and Settings\home\Application Data\SystemRequirementsLab
2007-11-11 10:21 <DIR> d-------- C:\Program Files\SpywareBlaster
2007-11-10 23:28 51,200 --a------ C:\WINDOWS\NirCmd.exe
2007-11-10 19:50 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2007-11-10 19:49 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2007-11-10 19:49 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2007-11-10 19:49 <DIR> d-------- C:\Documents and Settings\home\Application Data\SUPERAntiSpyware.com
2007-11-10 14:33 85,056 --a------ C:\WINDOWS\system32\iphckagb.dll
2007-11-08 18:17 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\Sony Ericsson
2007-11-08 17:43 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2007-11-08 17:43 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2007-11-08 16:41 <DIR> d-------- C:\Program Files\Sun
2007-11-07 23:00 <DIR> d-------- C:\WINDOWS\system32\XPToolsLicenseComponent
2007-11-07 18:43 11,448 --a------ C:\idsuite_run.bat
2007-11-07 17:37 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2007-11-02 02:00 0 --a------ C:\WINDOWS\system32\SBRC.dat
2007-11-02 02:00 0 --a------ C:\WINDOWS\system32\SBFC.dat
2007-10-23 18:01 <DIR> d-------- C:\Program Files\Index.dat Suite
2007-10-22 06:16 <DIR> d-------- C:\Program Files\MagicISO
2007-10-22 02:02 <DIR> d-------- C:\Program Files\Microsoft CAPICOM 2.1.0.2
2007-10-21 12:45 <DIR> d-------- C:\Program Files\Alcohol Soft
2007-10-21 12:44 639,224 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2007-10-21 11:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\logs
2007-10-21 08:52 <DIR> d-------- C:\Documents and Settings\home\Application Data\Sunbelt Software
2007-10-21 08:27 <DIR> d-------- C:\Program Files\SpyNoMore
2007-10-21 08:27 <DIR> d-------- C:\Program Files\Common Files\Download Manager
2007-10-21 04:16 271,224 --a------ C:\WINDOWS\system32\mucltui.dll
2007-10-20 13:08 592 --a------ C:\WINDOWS\chgkey.vbs
2007-10-14 10:20 <DIR> d-------- C:\Program Files\myiHome
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2007-11-13 07:34 --------- d-----w C:\Documents and Settings\home\Application Data\uTorrent
2007-11-13 01:56 --------- d-----w C:\Documents and Settings\All Users\Application Data\Google Updater
2007-11-12 17:35 --------- d-----w C:\Program Files\lx_cats
2007-11-11 13:00 --------- d-----w C:\Program Files\Bit Che
2007-11-08 10:38 --------- d-----w C:\Program Files\Java
2007-10-23 17:24 --------- d-----w C:\Documents and Settings\home\Application Data\Skype
2007-10-21 11:41 3,888 ----a-w C:\WINDOWS\system32\drivers\NTHANDLE.SYS
2007-10-20 18:19 --------- d-----w C:\Program Files\WinZix
2007-10-11 12:34 --------- d-----w C:\Program Files\Google
2007-10-10 15:45 --------- d-----w C:\Program Files\Armadillo Run
2007-10-09 19:11 --------- d-----w C:\Program Files\Common Files\LightScribe
2007-10-09 19:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\LightScribe
2007-10-09 19:07 --------- d-----w C:\Program Files\LightScribeTemplateLabeler
2007-10-03 17:57 --------- d-----w C:\Documents and Settings\home\Application Data\TeamViewer
2007-10-03 17:56 --------- d-----w C:\Program Files\TeamViewer3
2007-10-02 11:23 --------- d-----w C:\Documents and Settings\home\Application Data\Teleca
2007-10-02 11:22 --------- d-----w C:\Program Files\Common Files\Teleca Shared
2007-10-02 11:22 --------- d-----w C:\Program Files\Common Files\Sony Ericsson Shared
2007-10-02 11:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Teleca
2007-10-02 11:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Sony Ericsson
2007-10-01 11:57 --------- d--h--w C:\Program Files\InstallShield Installation Information
2007-10-01 11:56 --------- d-----w C:\Program Files\NVIDIA Corporation
2007-09-30 10:28 --------- d-----w C:\Program Files\UltraVNC
2007-09-28 09:26 --------- d-----w C:\Program Files\RegCure
2007-09-26 21:29 --------- d-----w C:\Program Files\Sony Ericsson
2007-09-26 16:49 --------- d-----w C:\Program Files\WinAVI Video Converter
2007-09-25 17:08 --------- d-----w C:\Program Files\DynGate
2007-09-24 18:02 4,016 ----a-w C:\WINDOWS\zlportio.sys
2007-09-24 11:37 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
2007-09-24 11:37 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_ggsemc_01005.Wdf
2007-09-24 11:34 19,424 ----a-w C:\WINDOWS\system32\drivers\ggsemc.sys
2007-09-24 11:34 1,419,232 ----a-w C:\WINDOWS\system32\wdfcoinstaller01005.dll
2007-09-24 11:24 --------- d-----w C:\Documents and Settings\home\Application Data\Sony Ericsson
2007-09-22 11:09 --------- d-----w C:\Documents and Settings\home\Application Data\dvdcss
2007-09-16 11:03 --------- d-----w C:\Documents and Settings\home\Application Data\Nero
2007-09-16 11:02 --------- d-----w C:\Program Files\Common Files\Nero
2007-09-16 11:01 --------- d-----w C:\Program Files\Nero
2007-09-16 11:01 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero
2007-09-16 09:40 --------- d-----w C:\Program Files\Common Files\Ahead
2007-09-16 09:34 --------- d-----w C:\Program Files\Max Registry Cleaner
2007-09-15 13:06 --------- d-----w C:\Program Files\Sure Delete
2007-09-15 12:42 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2007-09-15 11:41 --------- d-----w C:\Program Files\Uniblue
2007-09-15 11:41 --------- d-----w C:\Documents and Settings\home\Application Data\Uniblue
2007-09-15 11:27 --------- d-----w C:\Program Files\AskTBar
2007-09-15 11:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\Nero(2)
2007-09-06 10:09 801,144 ----a-w C:\WINDOWS\system32\aswBoot.exe
2007-09-06 10:00 95,608 ----a-w C:\WINDOWS\system32\AVASTSS.scr
2007-08-21 06:15 683,520 ----a-w C:\WINDOWS\system32\inetcomm.dll
2007-08-21 00:26 81,920 ----a-w C:\WINDOWS\system32\dpl100.dll
2007-08-21 00:26 196,608 ----a-w C:\WINDOWS\system32\dtu100.dll
2007-08-15 22:33 524,288 ----a-w C:\WINDOWS\system32\DivXsm.exe
2007-08-15 22:33 3,596,288 ----a-w C:\WINDOWS\system32\qt-dx331.dll
2007-08-15 22:33 200,704 ----a-w C:\WINDOWS\system32\ssldivx.dll
2007-08-15 22:33 144,704 ----a-w C:\WINDOWS\system32\DivXCodecVersionChecker.exe
2007-08-15 22:33 129,784 ------w C:\WINDOWS\system32\pxafs.dll
2007-08-15 22:33 120,056 ------w C:\WINDOWS\system32\pxcpyi64.exe
2007-08-15 22:33 118,520 ------w C:\WINDOWS\system32\pxinsi64.exe
2007-08-15 22:33 1,044,480 ----a-w C:\WINDOWS\system32\libdivx.dll
2007-08-15 22:31 593,920 ----a-w C:\WINDOWS\system32\dpuGUI11.dll
2007-08-15 22:31 57,344 ----a-w C:\WINDOWS\system32\dpv11.dll
2007-08-15 22:31 53,248 ----a-w C:\WINDOWS\system32\dpuGUI10.dll
2007-08-15 22:31 344,064 ----a-w C:\WINDOWS\system32\dpus11.dll
2007-08-15 22:31 294,912 ----a-w C:\WINDOWS\system32\dpu11.dll
2007-08-15 22:31 294,912 ----a-w C:\WINDOWS\system32\dpu10.dll
2007-08-15 22:30 823,296 ----a-w C:\WINDOWS\system32\divx_xx0c.dll
2007-08-15 22:30 823,296 ----a-w C:\WINDOWS\system32\divx_xx07.dll
2007-08-15 22:30 802,816 ----a-w C:\WINDOWS\system32\divx_xx11.dll
2007-08-15 22:30 740,442 ----a-w C:\WINDOWS\system32\DivX.dll
2007-08-15 22:30 12,288 ----a-w C:\WINDOWS\system32\DivXWMPExtType.dll
.
((((((((((((((((((((((((((((( snapshot@2007-11-10_23.34.15.85 )))))))))))))))))))))))))))))))))))))))))
.
- 2007-11-10 23:33:01 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_630.dat
+ 2007-11-12 17:35:36 16,384 ----atw C:\WINDOWS\Temp\Perflib_Perfdata_630.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"DU Meter"="C:\Program Files\DU Meter\DUMeter.exe" [2006-11-27 14:18]
"avast!"="C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe" [2007-09-06 10:06]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-10-22 11:22]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2006-10-22 11:22]
"lxcqmon.exe"="C:\Program Files\Lexmark 9300 Series\lxcqmon.exe" [2007-01-11 12:57]
"Lexmark 9300 Series Fax Server"="C:\Program Files\Lexmark 9300 Series\fm3032.exe" [2006-10-26 06:33]
"EzPrint"="C:\Program Files\Lexmark 9300 Series\ezprint.exe" [2006-12-05 08:35]
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe" [2007-09-25 00:11]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-05-11 02:06]
"LXCQCATS"="C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCQtime.dll" [2006-11-21 11:27]
"Sony Ericsson PC Suite"="C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" [2007-06-13 07:16]
"BluetoothAuthenticationAgent"="bthprops.cpl" [2004-08-04 04:56 C:\WINDOWS\system32\bthprops.cpl]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"MsnMsgr"="C:\Program Files\MSN Messenger\MsnMsgr.exe" [2007-01-19 11:54]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-06-26 15:13]
"µTorrent"="C:\Program Files\uTorrent\utorrent.exe" [2007-10-02 11:03]
"uTorrent"="C:\Program Files\uTorrent\utorrent.exe" [2007-10-02 11:03]
"MSMSGS"="C:\Program Files\Messenger\msmsgs.exe" [2004-10-13 16:24]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2007-08-31 16:46]
"HijackThis startup scan"="C:\download\HijackThis.exe" []
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 14:06]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
myiHome Server.lnk - C:\Program Files\myiHome\app\myiHome-server.exe [2007-10-14 10:20:58]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
"C:\Program Files\Common Files\Nero\Lib\NMBgMonitor.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
"C:\Program Files\iTunes\iTunesHelper.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBKeyScan]
"C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroCheck]
"C:\Program Files\iTunes\iTunesHelper.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
C:\Program Files\Common Files\Nero\Lib\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM]
C:\Program Files\PowerISO\PWRISOVM.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PWRISOVM.EXE]
C:\Program Files\PowerISO\PWRISOVM.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
"C:\Program Files\QuickTime\qttask.exe" -atboottime
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
"C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite]
"C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
R0 nvcchflt;NVIDIA Disk Cache Filter Driver;C:\WINDOWS\system32\DRIVERS\nvcchflt.sys
R2 lxcq_device;lxcq_device;C:\WINDOWS\system32\lxcqcoms.exe -service
R2 Nero BackItUp Scheduler 3;Nero BackItUp Scheduler 3;C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
R2 SocketLock;Raw Socket Lock Driver;\??\C:\WINDOWS\system32\socketlock.sys
R2 vnccom;vnccom;C:\WINDOWS\system32\Drivers\vnccom.SYS
R3 vncdrv;vncdrv;C:\WINDOWS\system32\DRIVERS\vncdrv.sys
S3 FTD2XX;Universal Box Device Driver;C:\WINDOWS\system32\Drivers\FTD2XX.sys
S3 s116bus;Sony Ericsson Device 116 driver (WDM);C:\WINDOWS\system32\DRIVERS\s116bus.sys
S3 s116mdfl;Sony Ericsson Device 116 USB WMC Modem Filter;C:\WINDOWS\system32\DRIVERS\s116mdfl.sys
S3 s116mdm;Sony Ericsson Device 116 USB WMC Modem Driver;C:\WINDOWS\system32\DRIVERS\s116mdm.sys
S3 s116mgmt;Sony Ericsson Device 116 USB WMC Device Management Drivers (WDM);C:\WINDOWS\system32\DRIVERS\s116mgmt.sys
S3 s116nd5;Sony Ericsson Device 116 USB Ethernet Emulation SEMC116 (NDIS);C:\WINDOWS\system32\DRIVERS\s116nd5.sys
S3 s116obex;Sony Ericsson Device 116 USB WMC OBEX Interface;C:\WINDOWS\system32\DRIVERS\s116obex.sys
S3 s116unic;Sony Ericsson Device 116 USB Ethernet Emulation SEMC116 (WDM);C:\WINDOWS\system32\DRIVERS\s116unic.sys
S3 tusbdbuslt;Incentive Pro USB Bus Lite Driver;C:\WINDOWS\system32\DRIVERS\tusbdbuslt.sys
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
"C:\Program Files\Common Files\LightScribe\LSRunOnce.exe"
.
Contents of the 'Scheduled Tasks' folder
"2007-11-12 17:35:39 C:\WINDOWS\Tasks\RegCure Program Check.job"
- C:\Program Files\RegCure\RegCure.exe
"2007-11-08 07:10:47 C:\WINDOWS\Tasks\RegCure.job"
- C:\Program Files\RegCure\RegCure.exe
.
**************************************************************************
catchme 0.3.1262 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2007-11-13 07:35:18
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2007-11-13 7:35:41
C:\ComboFix2.txt ... 2007-11-10 23:34
.
--- E O F ---
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 07:36:30, on 13/11/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
C:\Program Files\Alwil Software\Avast4\ashServ.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\DU Meter\DUMeter.exe
C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
C:\Program Files\Lexmark 9300 Series\ezprint.exe
C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\MSN Messenger\MsnMsgr.Exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\PROGRA~1\MICROS~2\rapimgr.exe
C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
C:\Program Files\Common Files\LightScribe\LSSrvc.exe
C:\WINDOWS\system32\lxcqcoms.exe
C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
C:\Program Files\MSN Messenger\usnsvc.exe
C:\Program Files\uTorrent\utorrent.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\WINDOWS\explorer.exe
C:\download\scanner.exe.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page =
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
O3 - Toolbar: Lexmark Toolbar - {1017A80C-6F09-4548-A84D-EDD6AC9525F0} - C:\Program Files\Lexmark Toolbar\toolband.dll
O4 - HKLM\..\Run: [DU Meter] C:\Program Files\DU Meter\DUMeter.exe
O4 - HKLM\..\Run: [avast!] C:\PROGRA~1\ALWILS~1\Avast4\ashDisp.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [lxcqmon.exe] "C:\Program Files\Lexmark 9300 Series\lxcqmon.exe"
O4 - HKLM\..\Run: [Lexmark 9300 Series Fax Server] "C:\Program Files\Lexmark 9300 Series\fm3032.exe" /s
O4 - HKLM\..\Run: [EzPrint] "C:\Program Files\Lexmark 9300 Series\ezprint.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe"
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [LXCQCATS] rundll32 C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\LXCQtime.dll,_RunDLLEntry@16
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Program Files\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\MSN Messenger\MsnMsgr.Exe" /background
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [µTorrent] "C:\Program Files\uTorrent\utorrent.exe"
O4 - HKCU\..\Run: [uTorrent] "C:\Program Files\uTorrent\utorrent.exe"
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [HijackThis startup scan] C:\download\HijackThis.exe /startupscan
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: myiHome Server.lnk = C:\Program Files\myiHome\app\myiHome-server.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\OFFICE11\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MICROS~2\INetRepl.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\OFFICE11\REFIEBAR.DLL
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1192886171859
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
O23 - Service: lxcq_device - - C:\WINDOWS\system32\lxcqcoms.exe
O23 - Service: Nero BackItUp Scheduler 3 - Nero AG - C:\Program Files\Nero\Nero8\Nero BackItUp\NBService.exe
O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Nero\Lib\NMIndexingService.exe
O23 - Service: nTune Service (nTuneService) - NVIDIA - C:\Program Files\NVIDIA Corporation\nTune\nTuneService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: StarWind iSCSI Service (StarWindService) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindService.exe
--
End of file - 8038 bytes
steamwiz
2007-11-13, 21:34
HI
Is this a dual boot machine ? do you have another XP O\S in your E:\ drive ?
Find & delete this file :-
C:\WINDOWS\system32\iphckagb.dll
Then please run a new KASPERSKY ON-LINE scan & post the new log ...
steam
no its not a dual boot machine
------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Saturday, November 17, 2007 5:16:15 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 17/11/2007
Kaspersky Anti-Virus database records: 460858
-------------------------------------------------------------------------------
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - My Computer:
A:\
C:\
D:\
E:\
F:\
G:\
H:\
Scan Statistics:
Total number of scanned objects: 89936
Number of viruses found: 11
Number of infected objects: 66
Number of suspicious objects: 0
Duration of the scan process: 02:53:08
Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Nero\Nero8\Nero BackItUp\Cache\NeroBackItUpScheduler3.log Object is locked skipped
C:\Documents and Settings\home\Application Data\$_hpcst$.hpc Object is locked skipped
C:\Documents and Settings\home\Application Data\Mozilla\Firefox\Profiles\6dwgxii1.default\cert8.db Object is locked skipped
C:\Documents and Settings\home\Application Data\Mozilla\Firefox\Profiles\6dwgxii1.default\history.dat Object is locked skipped
C:\Documents and Settings\home\Application Data\Mozilla\Firefox\Profiles\6dwgxii1.default\key3.db Object is locked skipped
C:\Documents and Settings\home\Application Data\Mozilla\Firefox\Profiles\6dwgxii1.default\parent.lock Object is locked skipped
C:\Documents and Settings\home\Application Data\Mozilla\Firefox\Profiles\6dwgxii1.default\search.sqlite Object is locked skipped
C:\Documents and Settings\home\Application Data\Mozilla\Firefox\Profiles\6dwgxii1.default\urlclassifier2.sqlite Object is locked skipped
C:\Documents and Settings\home\Application Data\Sony Ericsson\Teleca\Telecalib\Logging\Application logs\FM_log.txt Object is locked skipped
C:\Documents and Settings\home\Application Data\SUPERAntiSpyware.com\SUPERAntiSpyware\SUPERANTISPYWARE.LOG Object is locked skipped
C:\Documents and Settings\home\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\home\Local Settings\Application Data\Microsoft\Messenger\stuarthend@hotmail.com\SharingMetadata\Logs\Dfsr00005.log Object is locked skipped
C:\Documents and Settings\home\Local Settings\Application Data\Microsoft\Messenger\stuarthend@hotmail.com\SharingMetadata\pending.dat Object is locked skipped
C:\Documents and Settings\home\Local Settings\Application Data\Microsoft\Messenger\stuarthend@hotmail.com\SharingMetadata\Working\database_8A74_3FC1_743F_AEB7\dfsr.db Object is locked skipped
C:\Documents and Settings\home\Local Settings\Application Data\Microsoft\Messenger\stuarthend@hotmail.com\SharingMetadata\Working\database_8A74_3FC1_743F_AEB7\fsr.log Object is locked skipped
C:\Documents and Settings\home\Local Settings\Application Data\Microsoft\Messenger\stuarthend@hotmail.com\SharingMetadata\Working\database_8A74_3FC1_743F_AEB7\fsrtmp.log Object is locked skipped
C:\Documents and Settings\home\Local Settings\Application Data\Microsoft\Messenger\stuarthend@hotmail.com\SharingMetadata\Working\database_8A74_3FC1_743F_AEB7\tmp.edb Object is locked skipped
C:\Documents and Settings\home\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\home\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\home\Local Settings\Application Data\Microsoft\Windows Live Contacts\stuarthend@hotmail.com\real\members.stg Object is locked skipped
C:\Documents and Settings\home\Local Settings\Application Data\Mozilla\Firefox\Profiles\6dwgxii1.default\Cache\_CACHE_001_ Object is locked skipped
C:\Documents and Settings\home\Local Settings\Application Data\Mozilla\Firefox\Profiles\6dwgxii1.default\Cache\_CACHE_002_ Object is locked skipped
C:\Documents and Settings\home\Local Settings\Application Data\Mozilla\Firefox\Profiles\6dwgxii1.default\Cache\_CACHE_003_ Object is locked skipped
C:\Documents and Settings\home\Local Settings\Application Data\Mozilla\Firefox\Profiles\6dwgxii1.default\Cache\_CACHE_MAP_ Object is locked skipped
C:\Documents and Settings\home\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\home\Local Settings\History\History.IE5\MSHist012007111720071118\index.dat Object is locked skipped
C:\Documents and Settings\home\Local Settings\Temp\fla13BE.tmp Object is locked skipped
C:\Documents and Settings\home\Local Settings\Temp\hsperfdata_home\1980 Object is locked skipped
C:\Documents and Settings\home\Local Settings\Temp\WCESLog.log Object is locked skipped
C:\Documents and Settings\home\Local Settings\Temp\~DF9261.tmp Object is locked skipped
C:\Documents and Settings\home\Local Settings\Temp\~DF926D.tmp Object is locked skipped
C:\Documents and Settings\home\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\home\My Documents\kiss now\app.log Object is locked skipped
C:\Documents and Settings\home\My Documents\kiss now\eventbroker.log Object is locked skipped
C:\Documents and Settings\home\My Documents\kiss now\kissnow.log Object is locked skipped
C:\Documents and Settings\home\My Documents\kiss now\net.log Object is locked skipped
C:\Documents and Settings\home\My Documents\kiss now\runtime.log Object is locked skipped
C:\Documents and Settings\home\ntuser.dat Object is locked skipped
C:\Documents and Settings\home\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
C:\download\300.2006.1080p.BluRay.x264-hV\300.2006.1080p.bluray.x264-hv.part104.rar Object is locked skipped
C:\download\DivoCodec-1.3.0.0-setup-0712.exe.part/file4 Infected: Trojan.Win32.Obfuscated.en skipped
C:\download\DivoCodec-1.3.0.0-setup-0712.exe.part Inno: infected - 1 skipped
C:\download\UltraVNC-102-Setup.exe/file04 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c skipped
C:\download\UltraVNC-102-Setup.exe/file05 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c skipped
C:\download\UltraVNC-102-Setup.exe/file34 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.1102 skipped
C:\download\UltraVNC-102-Setup.exe Inno: infected - 3 skipped
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\logs\starwind.2007-11-15.17-57-49.log Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\aswResp.dat Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\Avast4.db Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\integ\avast.int Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\AshWebSv.ws Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\aswMaiSv.log Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\log\nshield.log Object is locked skipped
C:\Program Files\Alwil Software\Avast4\DATA\report\Resident protection.txt Object is locked skipped
C:\Program Files\AskTBar\bar\1.bin\A5POPSWT.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.az skipped
C:\Program Files\AskTBar\bar\1.bin\ASKTBAR.DLL Infected: not-a-virus:AdTool.Win32.MyWebSearch.az skipped
C:\Program Files\Nero\Nero8\Nero BackItUp\BIU1.txt Object is locked skipped
C:\Program Files\UltraVNC\vnchooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c skipped
C:\Program Files\UltraVNC\vncviewer.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.1102 skipped
C:\Program Files\UltraVNC\winvnc.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\aqkpvsox.dll.vir Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\axjffnpm.dll.vir Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\dihijibt.dll.vir Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\iiygaxre.dll.vir Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\jcohfjca.dll.vir Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\jrckcbmf.dll.vir Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\kggkxqmw.dll.vir Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\kmhavjhl.dll.vir Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\lsopnhco.dll.vir Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\mvonqjqg.dll.vir Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\sdyghndc.dll.vir Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\sedqqcgs.dll.vir Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\tatwbdam.dll.vir Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\wpdprwfm.dll.vir Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\__c00135F4.dat.vir Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\__c0048F84.dat.vir Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\__c004B90E.dat.vir Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\__c005FB00.dat.vir Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\__c0085324.dat.vir Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\__c0086E10.dat.vir Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\__c0097E71.dat.vir Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\__c009C4DC.dat.vir Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\__c00D1510.dat.vir Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\qoobox\Quarantine\C\WINDOWS\system32\__c00EDEEC.dat.vir Infected: Trojan-Downloader.Win32.ConHook.hl skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP285\change.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\Sti_Trace.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\Antivirus.Evt Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\system32\drivers\sptd.sys Object is locked skipped
C:\WINDOWS\system32\h323log.txt Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_598.dat Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_654.dat Object is locked skipped
C:\WINDOWS\Temp\_avast4_\Webshlock.txt Object is locked skipped
C:\WINDOWS\wiadebug.log Object is locked skipped
C:\WINDOWS\wiaservc.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
D:\downloads\DivoCodec-1.3.0.0-setup-0712.exe.part/file4 Infected: Trojan.Win32.Obfuscated.en skipped
D:\downloads\DivoCodec-1.3.0.0-setup-0712.exe.part Inno: infected - 1 skipped
D:\downloads\UltraVNC-102-Setup.exe/file04 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c skipped
D:\downloads\UltraVNC-102-Setup.exe/file05 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c skipped
D:\downloads\UltraVNC-102-Setup.exe/file34 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.1102 skipped
D:\downloads\UltraVNC-102-Setup.exe Inno: infected - 3 skipped
D:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
E:\download\Nero.Ultra.Edition.v8.0.3.0.Retail-ZWTiSO\nue8.0.3.0r.iso/Nero PhotoShow Express/nero_photoshow_express_5_setup.exe/data0017 Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped
E:\download\Nero.Ultra.Edition.v8.0.3.0.Retail-ZWTiSO\nue8.0.3.0r.iso/Nero PhotoShow Express/nero_photoshow_express_5_setup.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped
E:\download\Nero.Ultra.Edition.v8.0.3.0.Retail-ZWTiSO\nue8.0.3.0r.iso/Toolbar.exe Infected: not-a-virus:AdTool.Win32.MyWebSearch.bm skipped
E:\download\Nero.Ultra.Edition.v8.0.3.0.Retail-ZWTiSO\nue8.0.3.0r.iso ISO image: infected - 3 skipped
E:\download\Office 2007 Key Gen.rar/Office 2007 Key Gen/MicrosoftOfficeKeyGen.exe Infected: Backdoor.Win32.VB.bce skipped
E:\download\Office 2007 Key Gen.rar RAR: infected - 1 skipped
E:\download\PC.Tools.Registry.Mechanic.v7.1.0.1010.Incl.Crack-CFF\rminstall.exe Infected: Backdoor.Win32.IRCBot.aok skipped
E:\old h drive\download\keyfinder.exe/data.rar/xpkey.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
E:\old h drive\download\keyfinder.exe/data.rar/officekey.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
E:\old h drive\download\keyfinder.exe/data.rar Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
E:\old h drive\download\keyfinder.exe RarSFX: infected - 3 skipped
E:\old h drive\download\kf141.zip/keyfinder.exe/data.rar/xpkey.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
E:\old h drive\download\kf141.zip/keyfinder.exe/data.rar/officekey.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
E:\old h drive\download\kf141.zip/keyfinder.exe/data.rar Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
E:\old h drive\download\kf141.zip/keyfinder.exe Infected: not-a-virus:PSWTool.Win32.RAS.a skipped
E:\old h drive\download\kf141.zip ZIP: infected - 4 skipped
E:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
E:\System Volume Information\_restore{893CE42B-E29C-403D-B83B-741AF67E01BD}\RP240\A0033982.exe/data0000.cab/Server.exe Infected: Backdoor.Win32.Dragonbot.k skipped
E:\System Volume Information\_restore{893CE42B-E29C-403D-B83B-741AF67E01BD}\RP240\A0033982.exe/data0000.cab Infected: Backdoor.Win32.Dragonbot.k skipped
E:\System Volume Information\_restore{893CE42B-E29C-403D-B83B-741AF67E01BD}\RP240\A0033982.exe Rsrc-Package: infected - 2 skipped
F:\movie's\WinAVI Video Converter 8.1.1 + serial+ working key\HelixSDK RM converter kit for WinAVI.exe/data0000.cab/HELIXS~1.EXE Infected: Trojan-Downloader.Win32.Small.fuq skipped
F:\movie's\WinAVI Video Converter 8.1.1 + serial+ working key\HelixSDK RM converter kit for WinAVI.exe/data0000.cab Infected: Trojan-Downloader.Win32.Small.fuq skipped
F:\movie's\WinAVI Video Converter 8.1.1 + serial+ working key\HelixSDK RM converter kit for WinAVI.exe Rsrc-Package: infected - 2 skipped
F:\movie's\WinAVI Video Converter 8.1.1 + serial+ working key\WinAVI_Video_Converter 8.0.exe/data0000.cab/WINAVI~1.EXE Infected: Trojan-Downloader.Win32.Small.fuq skipped
F:\movie's\WinAVI Video Converter 8.1.1 + serial+ working key\WinAVI_Video_Converter 8.0.exe/data0000.cab Infected: Trojan-Downloader.Win32.Small.fuq skipped
F:\movie's\WinAVI Video Converter 8.1.1 + serial+ working key\WinAVI_Video_Converter 8.0.exe Rsrc-Package: infected - 2 skipped
F:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
F:\System Volume Information\_restore{E868635C-B618-4A88-B86D-424CBDCB2E66}\RP285\change.log Object is locked skipped
Scan process completed.
steamwiz
2007-11-17, 21:22
Hi
As you can see from the KASPERSKY ONLINE SCANNER REPORT
Your drives are full of illegally cracked programs, key gens, serial gens etc, if you look through the log you can see that they all come with Trojans/virus ... if you are serious about keeping your computer clean, then you will look closely at the log and delete all those illegal programs ...
steam
This topic has been moved to archives.
If you need the thread re-opened, please send me a private message (pm) and provide a link to the closed topic.
Applies only to the original poster, anyone else with similar problems please start your own topic.
Thank you steamwiz.