View Full Version : Virtumonde!
PirateMan.EXE
2007-11-18, 13:55
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:32:36 PM, on 11/17/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Documents and Settings\Kevin\Desktop\Unused Desktop Shortcuts\Iomega\AutoDisk\ADUserMon.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\SxgTkBar.exe
C:\Program Files\Roland\VSC32\vsc32cnf.exe
C:\Program Files\Roland\VSC32\vscvol.exe
C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\winshow.exe
C:\Program Files\SecCenter\scprot4.exe
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\ByteGems.com\I Hate This Key\IHateThisKey.exe
C:\Program Files\Logitech\Profiler\lwemon.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Cool\X_cool.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Windows Internet Explorer provided by Yahoo!
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 165.228.131.12:80
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Mario Forever Toolbar - {71B6ACF7-4F0F-4FD8-BB69-6D1A4D271CB7} - C:\Program Files\Mario Forever Toolbar\v3.2.0.0\MarioForever_Toolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [ADUserMon] C:\Documents and Settings\Kevin\Desktop\Unused Desktop Shortcuts\Iomega\AutoDisk\ADUserMon.exe
O4 - HKLM\..\Run: [Deskup] C:\Documents and Settings\Kevin\Desktop\Unused Desktop Shortcuts\Iomega\DriveIcons\deskup.exe /IMGSTART
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SxgTkBar] SxgTkBar.exe
O4 - HKLM\..\Run: [vsc32cnf.exe] C:\Program Files\Roland\VSC32\vsc32cnf.exe
O4 - HKLM\..\Run: [vscvol.exe] C:\Program Files\Roland\VSC32\vscvol.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [winshow] "C:\WINDOWS\winshow.exe"
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu77.exe 61A847B5BBF72815358B2B27128065E9C084320161C4661227A755E9C2933154389A28452DA545E9B1894E754BE54C29159A7DBE80DC744B6CDE3F516CAC59B6
O4 - HKLM\..\Run: [avp] C:\WINDOWS\avp.exe
O4 - HKLM\..\Run: [SC2] C:\Program Files\SecCenter\scprot4.exe
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [IHateThisKey] C:\Program Files\ByteGems.com\I Hate This Key\IHateThisKey.exe
O4 - HKCU\..\Run: [Start WingMan Profiler] "C:\Program Files\Logitech\Profiler\lwemon.exe" /noui
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Startup: Cool - Auto Update.lnk = C:\Program Files\Cool\cool.exe
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.yahoo.com
O15 - Trusted Zone: http://www.ocremix.org
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15026/CTSUEng.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15029/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E32EEA62-5D2E-4407-8932-B9DE13E23F9A}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Unknown owner - C:\WINDOWS\System32\CTsvcCDA.exe (file missing)
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Iomega App Services - Unknown owner - C:\PROGRA~1\Iomega\System32\AppServices.exe (file missing)
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - Unknown owner - C:\WINDOWS\system32\vmnetdhcp.exe (file missing)
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Unknown owner - C:\Program Files\Iomega\AutoDisk\ADService.exe (file missing)
--
End of file - 14028 bytes
PirateMan.EXE
2007-11-18, 13:56
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Sunday, November 18, 2007 12:45:12 AM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 18/11/2007
Kaspersky Anti-Virus database records: 461157
-------------------------------------------------------------------------------
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - Critical Areas:
C:\WINDOWS
C:\DOCUME~1\Kevin\LOCALS~1\Temp\
Scan Statistics:
Total number of scanned objects: 22103
Number of viruses found: 7
Number of infected objects: 17
Number of suspicious objects: 0
Duration of the scan process: 00:21:39
Infected Object Name / Virus Name / Last Action
C:\WINDOWS\$NtUninstallKB824141$\user32.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB824141$\win32k.sys Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\accwiz.exe Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\crypt32.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\cryptsvc.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\hhsetup.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\html32.cnv Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\locator.exe Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\magnify.exe Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\migwiz.exe Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\mrxsmb.sys Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\msconv97.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\narrator.exe Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\newdev.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\ntdll.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\ntkrnlpa.exe Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\ntoskrnl.exe Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\pchshell.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\raspptp.sys Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\srrstr.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\srv.sys Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\sysmain.sdb Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\user32.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\win32k.sys Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\winsrv.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828035$\msgsvc.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828035$\wkssvc.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\catsrv.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\catsrvut.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\clbcatex.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\clbcatq.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\colbact.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\comadmin.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\comrepl.exe Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\comsvcs.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\comuid.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\es.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\migregdb.exe Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\msdtcprx.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\msdtctm.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\msdtcuiu.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\mtxclu.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\mtxoci.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\ole32.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\rpcrt4.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\rpcrt4.dll.000 Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\rpcss.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\txflog.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\callcont.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\gdi32.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\h323.tsp Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\h323msp.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\ipnathlp.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\lsasrv.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\mf3216.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\msasn1.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\msgina.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\mst120.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\nmcom.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\rtcdll.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\schannel.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\dao360.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\expsrv.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msexch40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msexcl40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msjet40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msjetol1.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msjetoledb40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msjint40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msjter40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msjtes40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msltus40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\mspbde40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msrd2x40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msrd3x40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msrepl40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\mstext40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\mswdat10.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\mswstr10.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msxbde40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\vbajet32.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB839645$\fldrclnr.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB839645$\shell32.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB839645$\shlwapi.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB839645$\sxs.dll Object is locked skipped
C:\WINDOWS\$NtUninstallQ828026$\msdxm.ocx Object is locked skipped
C:\WINDOWS\$NtUninstallQ828026$\wmpcore.dll Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\SYSTEM32\agygkess.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\WINDOWS\SYSTEM32\awtsrst.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.app skipped
C:\WINDOWS\SYSTEM32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\SYSTEM32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\SYSTEM32\cgnyaggx.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\Internet.evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\ETKVBCPB.0LL Infected: Trojan.Win32.Golid.g skipped
C:\WINDOWS\SYSTEM32\fibagbia\fibagbia2.exe Infected: not-a-virus:FraudTool.Win32.UltimateDefender.v skipped
C:\WINDOWS\SYSTEM32\fibagbia\fibagbia3.exe Infected: not-a-virus:Downloader.Win32.UltimateFix.d skipped
C:\WINDOWS\SYSTEM32\fqiurfun.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped
C:\WINDOWS\SYSTEM32\mcjhcsma.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\WINDOWS\SYSTEM32\neyuxitq.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\WINDOWS\SYSTEM32\ondqpsxx.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\WINDOWS\SYSTEM32\qbafjvfa.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\WINDOWS\SYSTEM32\SPOOL\PRINTERS\FP00000.SPL Object is locked skipped
C:\WINDOWS\SYSTEM32\svticxon.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\WINDOWS\SYSTEM32\ucnynknk.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\WINDOWS\SYSTEM32\vqrqrfst.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\Win\csrss.exe Infected: Trojan.Win32.Agent.cbk skipped
C:\WINDOWS\SYSTEM32\xumqadxs.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\WINDOWS\SYSTEM32\yayawww.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.apx skipped
C:\WINDOWS\Temp\vmware-vmount.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
Scan process completed.
steamwiz
2007-11-18, 18:17
Hi
Please download VundoFix.exe (http://www.atribune.org/ccount/click.php?id=4) to your desktop.
1. Double-click VundoFix.exe to run it.
2. When VundoFix re-opens, click the Scan for Vundo button.
3. Once it's done scanning, click the Remove Vundo button.
4. You will receive a prompt asking if you want to remove the files, click "YES".
5. Once you click yes, your desktop will go blank as it starts removing Vundo.
6. When completed, it will prompt that it will reboot your computer, click "OK".
7. Please post the contents of C:\vundofix.txt
If vundofix cannot delete a file, it will try to delete it during a reboot, after the reboot vundofix will open again, you must run vundofix again, from "Click the Scan for Vundo button" ... and you must keep running vundofix until it does delete the file... I've known a stubborn vundo file take 5 or 6 reboots before it is deleted...
Keep running vundofix untill it gives you the message "no infected files were found"
THEN ...
Download Superantispyware.
http://www.superantispyware.com/
Once downloaded and installed update the definitions
and then run a full system scan quarantine what it finds!
* Double-click SUPERAntiSypware.exe and use the default settings for installation.
* An icon will be created on your desktop. Double-click that icon to launch the program.
* If asked to update the program definitions, click "Yes". If not, update the definitions before scanning by selecting "Check for Updates". (If you encounter any problems while downloading the updates, manually download and unzip them from here.)
http://www.superantispyware.com/definitions.html
* Under "Configuration and Preferences", click the Preferences button.
* Click the Scanning Control tab.
* Under Scanner Options make sure the following are checked (leave all others unchecked):
o Close browsers before scanning.
o Scan for tracking cookies.
o Terminate memory threats before quarantining.
* Click the "Close" button to leave the control center screen.
* Back on the main screen, under "Scan for Harmful Software" click Scan your computer.
* On the left, make sure you check C:\Fixed Drive.
* On the right, under "Complete Scan", choose Perform Complete Scan.
* Click "Next" to start the scan. Please be patient while it scans your computer.
* After the scan is complete, a Scan Summary box will appear with potentially harmful items that were detected. Click "OK".
* Make sure everything has a checkmark next to it and click "Next".
* A notification will appear that "Quarantine and Removal is Complete". Click "OK" and then click the "Finish" button to return to the main menu.
* If asked if you want to reboot, click "Yes".
* To retrieve the removal information after reboot, launch SUPERAntispyware again.
o Click Preferences, then click the Statistics/Logs tab.
o Under Scanner Logs, double-click SUPERAntiSpyware Scan Log.
o If there are several logs, click the current dated log and press View log. A text file will open in your default text editor.
o Please copy and paste the Scan Log results in your next reply.
* Click Close to exit the program.
THEN ...
Please download Combofix: http://download.bleepingcomputer.com/sUBs/Beta/ComboFix.exe
and save to the desktop.
1. Double click on combo.exe & follow the prompts.
2. When finished, it will produce a logfile located at C:\ComboFix.txt.
3. Post the contents of that log in your next reply with a new hijackthis log.
Notes:
* Do not mouseclick combofix's window while it is running. That may cause your system to stall/hang.
* Disable script blocking if you have NAV installed so it will not interfere with the fix. Trojan Hunter has been reported to detect combofix as Worm.Qiv.100.
Please remember to post :-
1. C:\vundofix.txt
2. SUPERAntiSpyware Scan Log
3. C:\ComboFix.txt
4. a new hijackthis log.( run after everything else)
steam
PirateMan.EXE
2007-11-19, 08:35
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Sunday, November 18, 2007 12:45:12 AM
Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 18/11/2007
Kaspersky Anti-Virus database records: 461157
-------------------------------------------------------------------------------
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - Critical Areas:
C:\WINDOWS
C:\DOCUME~1\Kevin\LOCALS~1\Temp\
Scan Statistics:
Total number of scanned objects: 22103
Number of viruses found: 7
Number of infected objects: 17
Number of suspicious objects: 0
Duration of the scan process: 00:21:39
Infected Object Name / Virus Name / Last Action
C:\WINDOWS\$NtUninstallKB824141$\user32.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB824141$\win32k.sys Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\accwiz.exe Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\crypt32.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\cryptsvc.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\hhsetup.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\html32.cnv Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\locator.exe Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\magnify.exe Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\migwiz.exe Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\mrxsmb.sys Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\msconv97.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\narrator.exe Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\newdev.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\ntdll.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\ntkrnlpa.exe Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\ntoskrnl.exe Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\pchshell.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\raspptp.sys Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\srrstr.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\srv.sys Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\sysmain.sdb Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\user32.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\win32k.sys Object is locked skipped
C:\WINDOWS\$NtUninstallKB826939$\winsrv.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828035$\msgsvc.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828035$\wkssvc.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\catsrv.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\catsrvut.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\clbcatex.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\clbcatq.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\colbact.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\comadmin.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\comrepl.exe Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\comsvcs.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\comuid.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\es.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\migregdb.exe Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\msdtcprx.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\msdtctm.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\msdtcuiu.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\mtxclu.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\mtxoci.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\ole32.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\rpcrt4.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\rpcrt4.dll.000 Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\rpcss.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB828741$\txflog.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\callcont.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\gdi32.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\h323.tsp Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\h323msp.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\ipnathlp.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\lsasrv.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\mf3216.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\msasn1.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\msgina.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\mst120.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\nmcom.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\rtcdll.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB835732$\schannel.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\dao360.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\expsrv.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msexch40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msexcl40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msjet40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msjetol1.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msjetoledb40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msjint40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msjter40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msjtes40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msltus40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\mspbde40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msrd2x40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msrd3x40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msrepl40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\mstext40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\mswdat10.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\mswstr10.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\msxbde40.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB837001$\vbajet32.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB839645$\fldrclnr.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB839645$\shell32.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB839645$\shlwapi.dll Object is locked skipped
C:\WINDOWS\$NtUninstallKB839645$\sxs.dll Object is locked skipped
C:\WINDOWS\$NtUninstallQ828026$\msdxm.ocx Object is locked skipped
C:\WINDOWS\$NtUninstallQ828026$\wmpcore.dll Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
C:\WINDOWS\SYSTEM32\agygkess.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\WINDOWS\SYSTEM32\awtsrst.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.app skipped
C:\WINDOWS\SYSTEM32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\SYSTEM32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\SYSTEM32\cgnyaggx.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\WINDOWS\SYSTEM32\CONFIG\AppEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\DEFAULT.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\Internet.evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SAM Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SAM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SecEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SECURITY.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SOFTWARE.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SysEvent.Evt Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM Object is locked skipped
C:\WINDOWS\SYSTEM32\CONFIG\SYSTEM.LOG Object is locked skipped
C:\WINDOWS\SYSTEM32\ETKVBCPB.0LL Infected: Trojan.Win32.Golid.g skipped
C:\WINDOWS\SYSTEM32\fibagbia\fibagbia2.exe Infected: not-a-virus:FraudTool.Win32.UltimateDefender.v skipped
C:\WINDOWS\SYSTEM32\fibagbia\fibagbia3.exe Infected: not-a-virus:Downloader.Win32.UltimateFix.d skipped
C:\WINDOWS\SYSTEM32\fqiurfun.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\WINDOWS\SYSTEM32\H323LOG.TXT Object is locked skipped
C:\WINDOWS\SYSTEM32\mcjhcsma.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\WINDOWS\SYSTEM32\neyuxitq.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\WINDOWS\SYSTEM32\ondqpsxx.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\WINDOWS\SYSTEM32\qbafjvfa.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\WINDOWS\SYSTEM32\SPOOL\PRINTERS\FP00000.SPL Object is locked skipped
C:\WINDOWS\SYSTEM32\svticxon.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\WINDOWS\SYSTEM32\ucnynknk.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\WINDOWS\SYSTEM32\vqrqrfst.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.BTR Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\INDEX.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING.VER Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING1.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\MAPPING2.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.DATA Object is locked skipped
C:\WINDOWS\SYSTEM32\WBEM\Repository\FS\OBJECTS.MAP Object is locked skipped
C:\WINDOWS\SYSTEM32\Win\csrss.exe Infected: Trojan.Win32.Agent.cbk skipped
C:\WINDOWS\SYSTEM32\xumqadxs.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.aps skipped
C:\WINDOWS\SYSTEM32\yayawww.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.apx skipped
C:\WINDOWS\Temp\vmware-vmount.log Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped
Scan process completed.
PirateMan.EXE
2007-11-19, 08:36
VundoFix V6.5.6
Checking Java version...
Scan started at 12:10:39 AM 7/20/2007
Listing files found while scanning....
C:\windows\system32\bxrammdu.dll
C:\windows\system32\cgdxrpob.dll
C:\windows\system32\ckxosrpj.dll
C:\windows\system32\ditixogk.dll
C:\windows\system32\fewvcbdp.dll
C:\WINDOWS\system32\gebcbxx.dll
C:\windows\system32\hmtgxvbv.ini
C:\windows\system32\hvlpjabv.dll
C:\windows\system32\iiexrxlh.dll
C:\windows\system32\ixjvnkkl.dll
C:\windows\system32\jprsoxkc.ini
C:\windows\system32\jticflsb.dll
C:\windows\system32\jvkfppus.dll
C:\windows\system32\myvnqnah.dll
C:\WINDOWS\system32\nqtss.bak1
C:\WINDOWS\system32\nqtss.bak2
C:\WINDOWS\system32\nqtss.ini
C:\WINDOWS\system32\nqtss.ini2
C:\WINDOWS\system32\nqtss.tmp
C:\windows\system32\qblqxjcr.dll
C:\windows\system32\qxuaqwkc.dll
C:\windows\system32\rhfjnamh.dll
C:\WINDOWS\system32\sstqn.dll
C:\WINDOWS\system32\tcucxhns.dll
C:\windows\system32\tjwiqbdw.dll
C:\windows\system32\tuxlktdj.dll
C:\windows\system32\txqhywel.dll
C:\windows\system32\vatfqybn.dll
C:\windows\system32\vbvxgtmh.dll
C:\windows\system32\vferyolx.dll
C:\windows\system32\wdbqiwjt.ini
C:\windows\system32\wdbqiwjt.ini2
C:\windows\system32\wdbqiwjt.tmp
C:\windows\system32\wswmwbds.dll
C:\windows\system32\xpvjlxtn.dll
C:\windows\system32\yboawrgb.dll
C:\windows\system32\ygshldbx.dll
C:\windows\system32\ysxucjut.dll
Beginning removal...
Attempting to delete C:\windows\system32\bxrammdu.dll
C:\windows\system32\bxrammdu.dll Has been deleted!
Attempting to delete C:\windows\system32\cgdxrpob.dll
C:\windows\system32\cgdxrpob.dll Has been deleted!
Attempting to delete C:\windows\system32\ckxosrpj.dll
C:\windows\system32\ckxosrpj.dll Has been deleted!
Attempting to delete C:\windows\system32\ditixogk.dll
C:\windows\system32\ditixogk.dll Has been deleted!
Attempting to delete C:\windows\system32\fewvcbdp.dll
C:\windows\system32\fewvcbdp.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\gebcbxx.dll
C:\WINDOWS\system32\gebcbxx.dll Has been deleted!
Attempting to delete C:\windows\system32\hmtgxvbv.ini
C:\windows\system32\hmtgxvbv.ini Has been deleted!
Attempting to delete C:\windows\system32\hvlpjabv.dll
C:\windows\system32\hvlpjabv.dll Has been deleted!
Attempting to delete C:\windows\system32\iiexrxlh.dll
C:\windows\system32\iiexrxlh.dll Has been deleted!
Attempting to delete C:\windows\system32\ixjvnkkl.dll
C:\windows\system32\ixjvnkkl.dll Has been deleted!
Attempting to delete C:\windows\system32\jprsoxkc.ini
C:\windows\system32\jprsoxkc.ini Has been deleted!
Attempting to delete C:\windows\system32\jticflsb.dll
C:\windows\system32\jticflsb.dll Has been deleted!
Attempting to delete C:\windows\system32\jvkfppus.dll
C:\windows\system32\jvkfppus.dll Has been deleted!
Attempting to delete C:\windows\system32\myvnqnah.dll
C:\windows\system32\myvnqnah.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\nqtss.bak1
C:\WINDOWS\system32\nqtss.bak1 Has been deleted!
Attempting to delete C:\WINDOWS\system32\nqtss.bak2
C:\WINDOWS\system32\nqtss.bak2 Has been deleted!
Attempting to delete C:\WINDOWS\system32\nqtss.ini
C:\WINDOWS\system32\nqtss.ini Has been deleted!
Attempting to delete C:\WINDOWS\system32\nqtss.ini2
C:\WINDOWS\system32\nqtss.ini2 Has been deleted!
Attempting to delete C:\WINDOWS\system32\nqtss.tmp
C:\WINDOWS\system32\nqtss.tmp Has been deleted!
Attempting to delete C:\windows\system32\qblqxjcr.dll
C:\windows\system32\qblqxjcr.dll Has been deleted!
Attempting to delete C:\windows\system32\qxuaqwkc.dll
C:\windows\system32\qxuaqwkc.dll Has been deleted!
Attempting to delete C:\windows\system32\rhfjnamh.dll
C:\windows\system32\rhfjnamh.dll Has been deleted!
Attempting to delete C:\WINDOWS\system32\sstqn.dll
C:\WINDOWS\system32\sstqn.dll Has been deleted!
Attempting to delete C:\windows\system32\tjwiqbdw.dll
C:\windows\system32\tjwiqbdw.dll Has been deleted!
Attempting to delete C:\windows\system32\tuxlktdj.dll
C:\windows\system32\tuxlktdj.dll Has been deleted!
Attempting to delete C:\windows\system32\txqhywel.dll
C:\windows\system32\txqhywel.dll Has been deleted!
Attempting to delete C:\windows\system32\vatfqybn.dll
C:\windows\system32\vatfqybn.dll Has been deleted!
Attempting to delete C:\windows\system32\vbvxgtmh.dll
C:\windows\system32\vbvxgtmh.dll Has been deleted!
Attempting to delete C:\windows\system32\vferyolx.dll
C:\windows\system32\vferyolx.dll Has been deleted!
Attempting to delete C:\windows\system32\wdbqiwjt.ini
C:\windows\system32\wdbqiwjt.ini Has been deleted!
Attempting to delete C:\windows\system32\wdbqiwjt.ini2
C:\windows\system32\wdbqiwjt.ini2 Has been deleted!
Attempting to delete C:\windows\system32\wdbqiwjt.tmp
C:\windows\system32\wdbqiwjt.tmp Has been deleted!
Attempting to delete C:\windows\system32\wswmwbds.dll
C:\windows\system32\wswmwbds.dll Has been deleted!
Attempting to delete C:\windows\system32\xpvjlxtn.dll
C:\windows\system32\xpvjlxtn.dll Has been deleted!
Attempting to delete C:\windows\system32\yboawrgb.dll
C:\windows\system32\yboawrgb.dll Has been deleted!
Attempting to delete C:\windows\system32\ygshldbx.dll
C:\windows\system32\ygshldbx.dll Has been deleted!
Attempting to delete C:\windows\system32\ysxucjut.dll
C:\windows\system32\ysxucjut.dll Has been deleted!
Performing Repairs to the registry.
Done!
VundoFix V6.5.6
Checking Java version...
Scan started at 3:04:54 AM 7/31/2007
Listing files found while scanning....
No infected files were found.
Beginning removal...
VundoFix V6.5.6
Checking Java version...
Scan started at 1:20:18 PM 8/13/2007
Listing files found while scanning....
No infected files were found.
VundoFix V6.5.6
Checking Java version...
Scan started at 10:11:52 PM 8/13/2007
Listing files found while scanning....
C:\WINDOWS\system32\gebyw.dll
C:\WINDOWS\system32\wybeg.bak1
C:\WINDOWS\system32\wybeg.ini
Beginning removal...
Attempting to delete C:\WINDOWS\system32\gebyw.dll
C:\WINDOWS\system32\gebyw.dll Could not be deleted.
Attempting to delete C:\WINDOWS\system32\wybeg.bak1
C:\WINDOWS\system32\wybeg.bak1 Has been deleted!
Attempting to delete C:\WINDOWS\system32\wybeg.ini
C:\WINDOWS\system32\wybeg.ini Has been deleted!
Performing Repairs to the registry.
Done!
Beginning removal...
Attempting to delete C:\WINDOWS\system32\gebyw.dll
C:\WINDOWS\system32\gebyw.dll Has been deleted!
Performing Repairs to the registry.
Done!
VundoFix V6.5.6
Checking Java version...
Scan started at 10:27:28 PM 8/13/2007
Listing files found while scanning....
C:\WINDOWS\system32\ayadd.bak1
C:\WINDOWS\system32\ayadd.ini
C:\WINDOWS\system32\ddaya.dll
Beginning removal...
Attempting to delete C:\WINDOWS\system32\ayadd.bak1
C:\WINDOWS\system32\ayadd.bak1 Has been deleted!
Attempting to delete C:\WINDOWS\system32\ayadd.ini
C:\WINDOWS\system32\ayadd.ini Has been deleted!
Attempting to delete C:\WINDOWS\system32\ddaya.dll
C:\WINDOWS\system32\ddaya.dll Could not be deleted.
Performing Repairs to the registry.
Done!
VundoFix V6.5.6
Checking Java version...
Scan started at 10:38:21 PM 8/13/2007
Listing files found while scanning....
No infected files were found.
Beginning removal...
VundoFix V6.5.6
Checking Java version...
Scan started at 2:12:30 AM 9/1/2007
Listing files found while scanning....
No infected files were found.
Beginning removal...
VundoFix V6.5.6
Checking Java version...
Scan started at 2:15:43 AM 9/1/2007
Listing files found while scanning....
No infected files were found.
Beginning removal...
VundoFix V6.5.6
Checking Java version...
Scan started at 2:24:04 AM 9/1/2007
Listing files found while scanning....
No infected files were found.
Beginning removal...
VundoFix V6.5.6
Checking Java version...
Scan started at 3:14:15 AM 9/1/2007
Listing files found while scanning....
No infected files were found.
Beginning removal...
VundoFix V6.5.6
Checking Java version...
Scan started at 1:17:13 PM 9/1/2007
Listing files found while scanning....
No infected files were found.
Beginning removal...
VundoFix V6.5.6
Checking Java version...
Scan started at 1:29:23 PM 9/2/2007
Listing files found while scanning....
No infected files were found.
Beginning removal...
VundoFix V6.5.6
Checking Java version...
Scan started at 1:42:06 PM 9/2/2007
Listing files found while scanning....
No infected files were found.
VundoFix V6.5.6
Checking Java version...
Scan started at 5:36:08 PM 9/3/2007
Listing files found while scanning....
No infected files were found.
Beginning removal...
VundoFix V6.5.6
Checking Java version...
Scan started at 10:41:05 PM 9/24/2007
Listing files found while scanning....
No infected files were found.
Beginning removal...
VundoFix V6.5.6
Checking Java version...
Scan started at 12:37:38 PM 11/2/2007
Listing files found while scanning....
No infected files were found.
Beginning removal...
VundoFix V6.5.6
Checking Java version...
Scan started at 6:54:35 PM 11/13/2007
Listing files found while scanning....
No infected files were found.
Beginning removal...
VundoFix V6.5.6
Checking Java version...
Scan started at 10:28:28 PM 11/14/2007
Listing files found while scanning....
No infected files were found.
Beginning removal...
VundoFix V6.6.1
Checking Java version...
Scan started at 3:32:57 PM 11/15/2007
Listing files found while scanning....
C:\WINDOWS\system32\mljjhih.dll
Beginning removal...
Attempting to delete C:\WINDOWS\system32\mljjhih.dll
C:\WINDOWS\system32\mljjhih.dll Could not be deleted.
Performing Repairs to the registry.
Done!
Beginning removal...
Attempting to delete C:\WINDOWS\system32\mljjhih.dll
C:\WINDOWS\system32\mljjhih.dll Has been deleted!
Performing Repairs to the registry.
Done!
VundoFix V6.6.1
Checking Java version...
Scan started at 7:35:29 PM 11/15/2007
Listing files found while scanning....
No infected files were found.
Beginning removal...
VundoFix V6.6.1
Checking Java version...
Scan started at 4:00:46 PM 11/16/2007
Listing files found while scanning....
VundoFix V6.6.1
Checking Java version...
Scan started at 12:15:40 PM 11/17/2007
Listing files found while scanning....
No infected files were found.
VundoFix V6.6.1
Checking Java version...
Scan started at 1:48:46 PM 11/18/2007
Listing files found while scanning....
No infected files were found.
SUPERAntiSpyware Scan Log
http://www.superantispyware.com
Generated 11/18/2007 at 08:50 PM
Application Version : 3.9.1008
Core Rules Database Version : 3346
Trace Rules Database Version: 1347
Scan type : Complete Scan
Total Scan Time : 05:31:04
Memory items scanned : 537
Memory threats detected : 2
Registry items scanned : 5785
Registry threats detected : 15
File items scanned : 265041
File threats detected : 106
Trojan.WinFixer
C:\WINDOWS\SYSTEM32\SSQPO.DLL
C:\WINDOWS\SYSTEM32\SSQPO.DLL
HKLM\Software\Classes\CLSID\{D1E718AA-3477-4A46-8091-06E556B91F95}
HKCR\CLSID\{D1E718AA-3477-4A46-8091-06E556B91F95}
HKCR\CLSID\{D1E718AA-3477-4A46-8091-06E556B91F95}\InprocServer32
HKCR\CLSID\{D1E718AA-3477-4A46-8091-06E556B91F95}\InprocServer32#ThreadingModel
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D1E718AA-3477-4A46-8091-06E556B91F95}
Trojan.Downloader-PSCMain
C:\PROGRAM FILES\SECCENTER\SCPROT4.EXE
C:\PROGRAM FILES\SECCENTER\SCPROT4.EXE
[SC2] C:\PROGRAM FILES\SECCENTER\SCPROT4.EXE
C:\WINDOWS\Prefetch\SCPROT4.EXE-08A0753E.pf
Adware.Vundo-Variant/Small-A
HKLM\Software\Classes\CLSID\{2bb8ff18-5a43-4694-b0aa-f8420dc710b6}
HKCR\CLSID\{2BB8FF18-5A43-4694-B0AA-F8420DC710B6}
HKCR\CLSID\{2BB8FF18-5A43-4694-B0AA-F8420DC710B6}\InprocServer32
HKCR\CLSID\{2BB8FF18-5A43-4694-B0AA-F8420DC710B6}\InprocServer32#ThreadingModel
C:\WINDOWS\SYSTEM32\APTECDKJ.DLL
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2bb8ff18-5a43-4694-b0aa-f8420dc710b6}
C:\WINDOWS\SYSTEM32\AQSLXIXM.DLL
C:\WINDOWS\SYSTEM32\GAPEJPID.DLL
C:\WINDOWS\SYSTEM32\IHBUHAEF.DLL
C:\WINDOWS\SYSTEM32\IWFAVFTY.DLL
C:\WINDOWS\SYSTEM32\LBHOQTGE.DLL
C:\WINDOWS\SYSTEM32\MKWEMIYC.DLL
C:\WINDOWS\SYSTEM32\NCLOKVAN.DLL
C:\WINDOWS\SYSTEM32\PUXSOXQL.DLL
C:\WINDOWS\SYSTEM32\RSUFIXXJ.DLL
C:\WINDOWS\SYSTEM32\RTIAJEKN.DLL
C:\WINDOWS\SYSTEM32\SYTOYBFL.DLL
C:\WINDOWS\SYSTEM32\TUFWUTSB.DLL
C:\WINDOWS\SYSTEM32\UHIUDBLG.DLL
C:\WINDOWS\SYSTEM32\VNRFYFNE.DLL
C:\WINDOWS\SYSTEM32\YGXLYLPX.DLL
Unclassified.Unknown Origin
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{200D0AAD-71B1-51C9-DDB0-092BA4662A54}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks#{4CB8F4B4-5F66-4D9E-BC3B-184596A58824}
Adware.Vundo Variant
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks#{E4EEFFED-93CD-4CF0-A0F3-50D139121FEE}
C:\VUNDOFIX BACKUPS\MLJJHIH.DLL.BAD
C:\WINDOWS\SYSTEM32\YAYAWWW.DLL
Adware.Tracking Cookie
C:\Documents and Settings\Kevin\Cookies\kevin@interclick[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@gomyron[3].txt
C:\Documents and Settings\Kevin\Cookies\kevin@www.cibleclick[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@gamedownloadxp[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@ads.pointroll[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@gctracker.mine[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@stats.sphere[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@adecn[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@atdmt[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@richmedia.yahoo[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@server.iad.liveperson[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@nandomedia[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@burstnet[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@adredired[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@bs.serving-sys[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@serving-sys[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@adbrite[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@anat.tacoda[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@tracker.affistats[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@hitbox[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@www.burstbeacon[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@statcounter[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@gctracker.wasuup.co[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@media.adrevolver[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@clean.systemerrorfixer[3].txt
C:\Documents and Settings\Kevin\Cookies\kevin@2o7[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@protect.spyguardpro[3].txt
C:\Documents and Settings\Kevin\Cookies\kevin@statse.webtrendslive[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@ehg-viacom.hitbox[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@www.ppctracking[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@login.tracking101[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@tacoda[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@www.burstnet[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@systemerrorfixer[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@clickbank[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@server.iad.liveperson[3].txt
C:\Documents and Settings\Kevin\Cookies\kevin@mediaplex[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@advertising[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@secure.systemerrorfixer[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@sale.bestsellerantivirus[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@casalemedia[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@3.adbrite[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@revsci[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@fastclick[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@tribalfusion[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@clicksor[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@spyguardpro[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@ads.revsci[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@imrworldwide[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@anad.tacoda[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@ehg-kasperskylab.hitbox[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@protect.spyguardpro[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@ad.uk.tangozebra[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@specificclick[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@ad.yieldmanager[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@media.adrevolver[3].txt
C:\Documents and Settings\Kevin\Cookies\kevin@gomyron[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@doubleclick[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@creative.adsrevenue[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@fl01.ct2.comclick[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@exitexchange[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@sale.spyguardpro[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@adrevolver[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@bestsellerantivirus[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@clean.systemerrorfixer[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@gomyron[4].txt
C:\Documents and Settings\Kevin\Cookies\kevin@www5.addfreestats[1].txt
C:\Documents and Settings\Eileen\Cookies\eileen@winfixer[2].txt
C:\Documents and Settings\Eileen\Cookies\eileen@www.winfixer[1].txt
Trojan.Downloader-Gen/RetAd
HKLM\Software\Microsoft\Windows\CurrentVersion\Run#runner1 [ C:\WINDOWS\mrofinu77.exe 61A847B5BBF72815358B2B27128065E9C084320161C4661227A755E9C2933154389A28452DA545E9B1894E754BE54C29159A7DBE80DC744B6CDE3F516CAC59B6 ]
Trojan.Downloader-Gen/DDC
C:\DOCUMENTS AND SETTINGS\KEVIN\LOCAL SETTINGS\TEMP\ROYBAOTN.EXE
C:\DOCUMENTS AND SETTINGS\KEVIN\LOCAL SETTINGS\TEMP\VIVLVSDH.EXE
Adware.Unknown Origin
C:\PROGRAM FILES\COMMON FILES\KQWF\KQWFD\CLASS-BARREL
C:\PROGRAM FILES\COMMON FILES\KQWF\KQWFD\VOCABULARY
Adware.k8l
C:\PROGRAM FILES\DELL\VILOZO.HTML
C:\PROGRAM FILES\PAGE.HTML
Adware.Vundo-Variant/Small
C:\WINDOWS\SYSTEM32\AWTSRST.DLL
Malware.Ultimate Defender
C:\WINDOWS\SYSTEM32\FIBAGBIA\FIBAGBIA1.EXE
C:\WINDOWS\SYSTEM32\FIBAGBIA\FIBAGBIA2.EXE
C:\WINDOWS\SYSTEM32\FIBAGBIA\FIBAGBIA3.EXE
Adware.Vundo Variant/Rel
C:\WINDOWS\SYSTEM32\MCRH.TMP
C:\WINDOWS\SYSTEM32\OQTWA.BAK1
C:\WINDOWS\SYSTEM32\OQTWA.INI
C:\WINDOWS\SYSTEM32\RQTWA.TMP
Unclassified.Unknown Origin/System
C:\WINDOWS\SYSTEM32\SSTTR.DLL
Trojan.Unknown Origin
C:\WINDOWS\SYSTEM32\WNSTSIIT.EXE
PirateMan.EXE
2007-11-19, 08:37
SUPERAntiSpyware Scan Log
http://www.superantispyware.com
Generated 11/18/2007 at 08:50 PM
Application Version : 3.9.1008
Core Rules Database Version : 3346
Trace Rules Database Version: 1347
Scan type : Complete Scan
Total Scan Time : 05:31:04
Memory items scanned : 537
Memory threats detected : 2
Registry items scanned : 5785
Registry threats detected : 15
File items scanned : 265041
File threats detected : 106
Trojan.WinFixer
C:\WINDOWS\SYSTEM32\SSQPO.DLL
C:\WINDOWS\SYSTEM32\SSQPO.DLL
HKLM\Software\Classes\CLSID\{D1E718AA-3477-4A46-8091-06E556B91F95}
HKCR\CLSID\{D1E718AA-3477-4A46-8091-06E556B91F95}
HKCR\CLSID\{D1E718AA-3477-4A46-8091-06E556B91F95}\InprocServer32
HKCR\CLSID\{D1E718AA-3477-4A46-8091-06E556B91F95}\InprocServer32#ThreadingModel
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D1E718AA-3477-4A46-8091-06E556B91F95}
Trojan.Downloader-PSCMain
C:\PROGRAM FILES\SECCENTER\SCPROT4.EXE
C:\PROGRAM FILES\SECCENTER\SCPROT4.EXE
[SC2] C:\PROGRAM FILES\SECCENTER\SCPROT4.EXE
C:\WINDOWS\Prefetch\SCPROT4.EXE-08A0753E.pf
Adware.Vundo-Variant/Small-A
HKLM\Software\Classes\CLSID\{2bb8ff18-5a43-4694-b0aa-f8420dc710b6}
HKCR\CLSID\{2BB8FF18-5A43-4694-B0AA-F8420DC710B6}
HKCR\CLSID\{2BB8FF18-5A43-4694-B0AA-F8420DC710B6}\InprocServer32
HKCR\CLSID\{2BB8FF18-5A43-4694-B0AA-F8420DC710B6}\InprocServer32#ThreadingModel
C:\WINDOWS\SYSTEM32\APTECDKJ.DLL
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2bb8ff18-5a43-4694-b0aa-f8420dc710b6}
C:\WINDOWS\SYSTEM32\AQSLXIXM.DLL
C:\WINDOWS\SYSTEM32\GAPEJPID.DLL
C:\WINDOWS\SYSTEM32\IHBUHAEF.DLL
C:\WINDOWS\SYSTEM32\IWFAVFTY.DLL
C:\WINDOWS\SYSTEM32\LBHOQTGE.DLL
C:\WINDOWS\SYSTEM32\MKWEMIYC.DLL
C:\WINDOWS\SYSTEM32\NCLOKVAN.DLL
C:\WINDOWS\SYSTEM32\PUXSOXQL.DLL
C:\WINDOWS\SYSTEM32\RSUFIXXJ.DLL
C:\WINDOWS\SYSTEM32\RTIAJEKN.DLL
C:\WINDOWS\SYSTEM32\SYTOYBFL.DLL
C:\WINDOWS\SYSTEM32\TUFWUTSB.DLL
C:\WINDOWS\SYSTEM32\UHIUDBLG.DLL
C:\WINDOWS\SYSTEM32\VNRFYFNE.DLL
C:\WINDOWS\SYSTEM32\YGXLYLPX.DLL
Unclassified.Unknown Origin
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{200D0AAD-71B1-51C9-DDB0-092BA4662A54}
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks#{4CB8F4B4-5F66-4D9E-BC3B-184596A58824}
Adware.Vundo Variant
HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks#{E4EEFFED-93CD-4CF0-A0F3-50D139121FEE}
C:\VUNDOFIX BACKUPS\MLJJHIH.DLL.BAD
C:\WINDOWS\SYSTEM32\YAYAWWW.DLL
Adware.Tracking Cookie
C:\Documents and Settings\Kevin\Cookies\kevin@interclick[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@gomyron[3].txt
C:\Documents and Settings\Kevin\Cookies\kevin@www.cibleclick[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@gamedownloadxp[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@ads.pointroll[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@gctracker.mine[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@stats.sphere[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@adecn[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@atdmt[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@richmedia.yahoo[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@server.iad.liveperson[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@nandomedia[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@burstnet[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@adredired[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@bs.serving-sys[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@serving-sys[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@adbrite[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@anat.tacoda[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@tracker.affistats[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@hitbox[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@www.burstbeacon[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@statcounter[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@gctracker.wasuup.co[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@media.adrevolver[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@clean.systemerrorfixer[3].txt
C:\Documents and Settings\Kevin\Cookies\kevin@2o7[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@protect.spyguardpro[3].txt
C:\Documents and Settings\Kevin\Cookies\kevin@statse.webtrendslive[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@ehg-viacom.hitbox[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@www.ppctracking[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@login.tracking101[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@tacoda[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@www.burstnet[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@systemerrorfixer[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@clickbank[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@server.iad.liveperson[3].txt
C:\Documents and Settings\Kevin\Cookies\kevin@mediaplex[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@advertising[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@secure.systemerrorfixer[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@sale.bestsellerantivirus[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@casalemedia[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@3.adbrite[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@revsci[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@fastclick[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@tribalfusion[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@clicksor[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@spyguardpro[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@ads.revsci[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@imrworldwide[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@anad.tacoda[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@ehg-kasperskylab.hitbox[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@protect.spyguardpro[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@ad.uk.tangozebra[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@specificclick[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@ad.yieldmanager[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@media.adrevolver[3].txt
C:\Documents and Settings\Kevin\Cookies\kevin@gomyron[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@doubleclick[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@creative.adsrevenue[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@fl01.ct2.comclick[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@exitexchange[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@sale.spyguardpro[2].txt
C:\Documents and Settings\Kevin\Cookies\kevin@adrevolver[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@bestsellerantivirus[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@clean.systemerrorfixer[1].txt
C:\Documents and Settings\Kevin\Cookies\kevin@gomyron[4].txt
C:\Documents and Settings\Kevin\Cookies\kevin@www5.addfreestats[1].txt
C:\Documents and Settings\Eileen\Cookies\eileen@winfixer[2].txt
C:\Documents and Settings\Eileen\Cookies\eileen@www.winfixer[1].txt
Trojan.Downloader-Gen/RetAd
HKLM\Software\Microsoft\Windows\CurrentVersion\Run#runner1 [ C:\WINDOWS\mrofinu77.exe 61A847B5BBF72815358B2B27128065E9C084320161C4661227A755E9C2933154389A28452DA545E9B1894E754BE54C29159A7DBE80DC744B6CDE3F516CAC59B6 ]
Trojan.Downloader-Gen/DDC
C:\DOCUMENTS AND SETTINGS\KEVIN\LOCAL SETTINGS\TEMP\ROYBAOTN.EXE
C:\DOCUMENTS AND SETTINGS\KEVIN\LOCAL SETTINGS\TEMP\VIVLVSDH.EXE
Adware.Unknown Origin
C:\PROGRAM FILES\COMMON FILES\KQWF\KQWFD\CLASS-BARREL
C:\PROGRAM FILES\COMMON FILES\KQWF\KQWFD\VOCABULARY
Adware.k8l
C:\PROGRAM FILES\DELL\VILOZO.HTML
C:\PROGRAM FILES\PAGE.HTML
Adware.Vundo-Variant/Small
C:\WINDOWS\SYSTEM32\AWTSRST.DLL
Malware.Ultimate Defender
C:\WINDOWS\SYSTEM32\FIBAGBIA\FIBAGBIA1.EXE
C:\WINDOWS\SYSTEM32\FIBAGBIA\FIBAGBIA2.EXE
C:\WINDOWS\SYSTEM32\FIBAGBIA\FIBAGBIA3.EXE
Adware.Vundo Variant/Rel
C:\WINDOWS\SYSTEM32\MCRH.TMP
C:\WINDOWS\SYSTEM32\OQTWA.BAK1
C:\WINDOWS\SYSTEM32\OQTWA.INI
C:\WINDOWS\SYSTEM32\RQTWA.TMP
Unclassified.Unknown Origin/System
C:\WINDOWS\SYSTEM32\SSTTR.DLL
Trojan.Unknown Origin
C:\WINDOWS\SYSTEM32\WNSTSIIT.EXE
PirateMan.EXE
2007-11-19, 08:38
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 10:51:18 PM, on 11/18/2007
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16544)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\System32\DSentry.exe
C:\Program Files\Dell\Media Experience\PCMService.exe
C:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
C:\Documents and Settings\Kevin\Desktop\Unused Desktop Shortcuts\Iomega\AutoDisk\ADUserMon.exe
C:\Program Files\D-Tools\daemon.exe
C:\Program Files\Common Files\Symantec Shared\ccApp.exe
C:\Program Files\Windows Defender\MSASCui.exe
C:\Program Files\Winamp\winampa.exe
C:\WINDOWS\system32\SxgTkBar.exe
C:\Program Files\Roland\VSC32\vsc32cnf.exe
C:\Program Files\Roland\VSC32\vscvol.exe
C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\Messenger\msmsgs.exe
C:\Program Files\ByteGems.com\I Hate This Key\IHateThisKey.exe
C:\Program Files\Logitech\Profiler\lwemon.exe
C:\Program Files\DellSupport\DSAgnt.exe
C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
C:\Program Files\WinZip\WZQKPICK.EXE
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.yahoo.com
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = 165.228.131.12:80
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {4AAE97C5-351B-2218-415F-C381D6EE4764} - (no file)
O2 - BHO: (no name) - {61803E3E-DBF8-4F2A-B81B-4F3E60BCF43C} - (no file)
O2 - BHO: (no name) - {78E56BFF-F3D7-4C2E-8DE0-C71968E1BD66} - (no file)
O2 - BHO: Mario Forever Toolbar Helper - {A20854FD-DDB5-4931-8F76-D11EA2364D94} - C:\Program Files\Mario Forever Toolbar\v3.2.0.0\MarioForever_Toolbar.dll
O2 - BHO: NAV Helper - {A8F38D8D-E480-4D52-B7A2-731BB6995FDD} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar1.dll
O3 - Toolbar: Norton AntiVirus - {C4069E3A-68F1-403E-B40E-20066696354B} - C:\Program Files\Norton SystemWorks\Norton AntiVirus\NavShExt.dll
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
O3 - Toolbar: Mario Forever Toolbar - {71B6ACF7-4F0F-4FD8-BB69-6D1A4D271CB7} - C:\Program Files\Mario Forever Toolbar\v3.2.0.0\MarioForever_Toolbar.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar1.dll
O4 - HKLM\..\Run: [DVDSentry] C:\WINDOWS\System32\DSentry.exe
O4 - HKLM\..\Run: [PCMService] "C:\Program Files\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [UpdReg] C:\WINDOWS\UpdReg.EXE
O4 - HKLM\..\Run: [mmtask] c:\Program Files\MusicMatch\MusicMatch Jukebox\mmtask.exe
O4 - HKLM\..\Run: [ADUserMon] C:\Documents and Settings\Kevin\Desktop\Unused Desktop Shortcuts\Iomega\AutoDisk\ADUserMon.exe
O4 - HKLM\..\Run: [Deskup] C:\Documents and Settings\Kevin\Desktop\Unused Desktop Shortcuts\Iomega\DriveIcons\deskup.exe /IMGSTART
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [DAEMON Tools-1033] "C:\Program Files\D-Tools\daemon.exe" -lang 1033
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [ISUSPM Startup] "C:\Program Files\Common Files\InstallShield\UpdateService\isuspm.exe" -startup
O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [WinampAgent] C:\Program Files\Winamp\winampa.exe
O4 - HKLM\..\Run: [diagent] "C:\Program Files\Creative\SBLive\Diagnostics\diagent.exe" startup
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SxgTkBar] SxgTkBar.exe
O4 - HKLM\..\Run: [vsc32cnf.exe] C:\Program Files\Roland\VSC32\vsc32cnf.exe
O4 - HKLM\..\Run: [vscvol.exe] C:\Program Files\Roland\VSC32\vscvol.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [IMEKRMIG6.1] C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [MSMSGS] "C:\Program Files\Messenger\msmsgs.exe" /background
O4 - HKCU\..\Run: [IHateThisKey] C:\Program Files\ByteGems.com\I Hate This Key\IHateThisKey.exe
O4 - HKCU\..\Run: [Start WingMan Profiler] "C:\Program Files\Logitech\Profiler\lwemon.exe" /noui
O4 - HKCU\..\Run: [DellSupport] "C:\Program Files\DellSupport\DSAgnt.exe" /startup
O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
O4 - HKCU\..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe
O4 - HKUS\S-1-5-18\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [DWQueuedReporting] "C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" -t (User 'Default user')
O4 - Global Startup: Adobe Gamma Loader.lnk = C:\Program Files\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program Files\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: WinZip Quick Pick.lnk = C:\Program Files\WinZip\WZQKPICK.EXE
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8 - Extra context menu item: &Viewpoint Search - res://C:\Program Files\Viewpoint\Viewpoint Toolbar\ViewBar.dll/CXTSEARCH.HTML
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\WINDOWS\system32\msjava.dll
O9 - Extra button: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk
O9 - Extra 'Tools' menuitem: Express Cleanup - {5E638779-1818-4754-A595-EF1C63B87A56} - C:\Program Files\Norton SystemWorks\Norton Cleanup\WCQuick.lnk
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\System32\Shdocvw.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.yahoo.com
O15 - Trusted Zone: http://www.ocremix.org
O16 - DPF: {01A88BB1-1174-41EC-ACCB-963509EAE56B} (SysProWmi Class) - http://support.dell.com/systemprofiler/SysPro.CAB
O16 - DPF: {0A5FD7C5-A45C-49FC-ADB5-9952547D5715} (Creative Software AutoUpdate) - http://www.creative.com/su/ocx/15026/CTSUEng.cab
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english/kavwebscan_unicode.cab
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {9D190AE6-C81E-4039-8061-978EBAD10073} (F-Secure Online Scanner 3.0) - http://support.f-secure.com/ols/fscax.cab
O16 - DPF: {F6ACF75C-C32C-447B-9BEF-46B766368D29} (Creative Software AutoUpdate Support Package) - http://www.creative.com/su/ocx/15029/CTPID.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{E32EEA62-5D2E-4407-8932-B9DE13E23F9A}: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CS1\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: NameServer = 208.67.220.220,208.67.222.222
O20 - Winlogon Notify: !SASWinLogon - C:\Program Files\SUPERAntiSpyware\SASWINLO.dll
O20 - Winlogon Notify: awtqr - C:\WINDOWS\system32\awtqr.dll (file missing)
O20 - Winlogon Notify: mlljg - C:\WINDOWS\system32\mlljg.dll (file missing)
O20 - Winlogon Notify: qommklm - qommklm.dll (file missing)
O20 - Winlogon Notify: winxtx32 - winxtx32.dll (file missing)
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccEvtMgr.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSetMgr.exe
O23 - Service: Creative Service for CDROM Access - Unknown owner - C:\WINDOWS\System32\CTsvcCDA.exe (file missing)
O23 - Service: DSBrokerService - Unknown owner - C:\Program Files\DellSupport\brkrsvc.exe
O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
O23 - Service: Iomega App Services - Unknown owner - C:\PROGRA~1\Iomega\System32\AppServices.exe (file missing)
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: Norton AntiVirus Auto-Protect Service (navapsvc) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\navapsvc.exe
O23 - Service: Intel NCS NetService (NetSvc) - Intel(R) Corporation - C:\Program Files\Intel\NCS\Sync\NetSvc.exe
O23 - Service: Norton AntiVirus Firewall Monitor Service (NPFMntor) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\IWP\NPFMntor.exe
O23 - Service: Norton UnErase Protection (NProtectService) - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\NPROTECT.EXE
O23 - Service: Norton Protection Center Service (NSCService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Console\NSCSRVCE.EXE
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Symantec AVScan (SAVScan) - Symantec Corporation - C:\Program Files\Norton SystemWorks\Norton AntiVirus\SAVScan.exe
O23 - Service: Symantec Network Drivers Service (SNDSrvc) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SNDSrvc.exe
O23 - Service: SPBBCSvc - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\SPBBC\SPBBCSvc.exe
O23 - Service: Speed Disk service - Symantec Corporation - C:\PROGRA~1\NORTON~2\NORTON~2\SPEEDD~1\NOPDB.EXE
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SymWMI Service (SymWSC) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\Security Center\SymWSC.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - Unknown owner - C:\WINDOWS\system32\vmnetdhcp.exe (file missing)
O23 - Service: VMware Virtual Mount Manager Extended (vmount2) - VMware, Inc. - C:\Program Files\Common Files\VMware\VMware Virtual Image Editing\vmount2.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe
O23 - Service: Iomega Active Disk (_IOMEGA_ACTIVE_DISK_SERVICE_) - Unknown owner - C:\Program Files\Iomega\AutoDisk\ADService.exe (file missing)
--
End of file - 14467 bytes
steamwiz
2007-11-19, 20:44
HI
Still need to see C:\ComboFix.txt :)
steam
PirateMan.EXE, how is it going?