I have downloaded hijack this and comofix. I have a log that I made with hijack this and I used comofix. I have that log too. When I used comofix it took longer then 20 min so following the directions of one of the threads I opened my task manager and looked for Findstr, find, sed or swreg. I found something called Vfind.exe so I closed it and comofix finished and gave me a log. I know there is more to do because I have used spybot to see if that took care of the problem but it did not. Spybot still finds Virtumonde.dll 6 entries. I need someone who knows what they are doing to help me. Please.
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 8:54:18 AM, on 5/2/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\snmp.exe
C:\WINDOWS\system32\svchost.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Microsoft ActiveSync\wcescomm.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.dell4me.com/myway
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://mysearch.myway.com/jsp/dellsidebar.jsp?p=DE
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R3 - URLSearchHook: (no name) - {4D25F926-B9FE-4682-BF72-8AB8210D6D75} - C:\Program Files\MyWaySA\SrchAsDe\deSrcAs.dll
O3 - Toolbar: Show Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll
O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
O4 - HKLM\..\Run: [osCheck] "C:\Program Files\Norton Internet Security\osCheck.exe"
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [Logitech Hardware Abstraction Layer] KHALMNPR.EXE
O4 - HKLM\..\Run: [FG_Monitor] C:\Program Files\Folder Guard Pro\FGKey.exe /Start
O4 - HKLM\..\Run: [BM2bfd2f18] Rundll32.exe "C:\WINDOWS\system32\fmdttjiy.dll",s
O4 - HKLM\..\Run: [28ce1c84] rundll32.exe "C:\WINDOWS\system32\qwnuvpel.dll",b
O4 - HKLM\..\Run: [runner1] C:\WINDOWS\mrofinu1749.exe 61A847B5BBF72813359F31466188719AB689201522886B092CBD44BD8689220221DD3257
O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKLM\..\RunOnce: [SpybotDeletingA1466] command /c del "C:\WINDOWS\system32\fmdttjiy.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC9576] cmd /c del "C:\WINDOWS\system32\fmdttjiy.dll_old"
O4 - HKCU\..\Run: [LDM] C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\RunOnce: [] C:\Program Files\Internet Explorer\iexplore.exe http://www.symantec.com/techsupp/servlet/ProductMessages?module=2007&error=0&language=en&product=SymNRT&version=2008.0.1.19&build=Symantec&a=00000082.0000001e.0000004a&b=00000082.0000001f.00000078&c=00000082.00000045.00000119
O4 - HKCU\..\RunOnce: [SpybotDeletingB7293] command /c del "C:\WINDOWS\system32\fmdttjiy.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD8870] cmd /c del "C:\WINDOWS\system32\fmdttjiy.dll_old"
O4 - Global Startup: APC UPS Status.lnk = ?
O4 - Global Startup: AutoCAD Startup Accelerator.lnk = C:\Program Files\Common Files\Autodesk Shared\acstart17.exe
O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe
O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2BC66F54-93A8-11D3-BEB6-00105AA9B6AE} (Symantec AntiVirus scanner) - http://security.symantec.com/sscv6/SharedContent/vc/bin/AvSniff.cab
O16 - DPF: {4F1E5B1A-2A80-42CA-8532-2D05CB959537} (MSN Photo Upload Tool) - http://gfx2.mail.live.com/mail/w1/resources/MSNPUpld.cab
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1181087727296
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - http://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1181087692109
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O16 - DPF: {E87F6C8E-16C0-11D3-BEF7-009027438003} (Persits Software XUpload) - http://www.flhausplanroom.com/efs/XUpload.ocx
O16 - DPF: {FA91DF8D-53AB-455D-AB20-F2F023E498D3} (RSClientPrint Class) - http://weblink82.bc3.edu/ReportServer?rs:Command=Get&rc:GetImage=8.00.1038.00rsclientprint.cab
O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
O18 - Protocol: pm - {A479F961-CC9E-11D0-A220-000000000000} - C:\Program Files\Common Files\Repro Desk\PmProtocol.dll
O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
O23 - Service: APC UPS Service - American Power Conversion Corporation - C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Autodesk Data Management Job Dispatch - Autodesk - C:\Program Files\Autodesk\Data Management Server 2008\Server\Dispatch\Connectivity.WindowsService.JobDispatch.exe
O23 - Service: Autodesk EDM Server - Autodesk - C:\Program Files\Autodesk\Data Management Server 2008\Server\Webserver\Connectivity.EDMWS.Server.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
O23 - Service: LiveUpdate Notice - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
O23 - Service: mental ray 3.5 Satellite (32-bit) (mi-raysat_3dsmax9_32) - Unknown owner - C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe
--
End of file - 10131 bytes
ComboFix 08-05-01.1 - BRIAN OWEN 2008-05-02 10:05:33.1 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.3076 [GMT -4:00]
Running from: C:\Documents and Settings\BRIAN OWEN\Desktop\ComboFix.exe
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\BcIllnpo.ini
C:\WINDOWS\system32\BcIllnpo.ini2
C:\WINDOWS\system32\BLVEdMoq.ini
C:\WINDOWS\system32\BLVEdMoq.ini2
C:\WINDOWS\system32\dhalyggr.dll
C:\WINDOWS\system32\info.txt
C:\WINDOWS\system32\lepvunwq.ini
C:\WINDOWS\system32\mcrh.tmp
C:\WINDOWS\system32\qoMdEVLB.dll
C:\WINDOWS\system32\ssqQijiG.dll
C:\WINDOWS\system32\wvUkhfGX.dll
C:\WINDOWS\system32\XGfhkUvw.ini
C:\WINDOWS\system32\XGfhkUvw.ini2
C:\WINDOWS\winhelp.ini
.
((((((((((((((((((((((((( Files Created from 2008-04-02 to 2008-05-02 )))))))))))))))))))))))))))))))
.
2067-02-24 16:21 . 2003-02-05 05:02 79,947 --a--c--- C:\WINDOWS\fw20.vxd
2008-05-02 08:52 . 2008-05-02 08:52 <DIR> d-------- C:\Program Files\Trend Micro
2008-05-02 07:56 . 2008-05-02 07:56 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-05-02 07:56 . 2008-05-02 08:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-02 07:40 . 2008-05-02 07:40 105,536 --a------ C:\WINDOWS\system32\sorgnooh.dll_old
2008-05-02 07:37 . 2008-05-02 07:37 96,320 --a------ C:\WINDOWS\system32\qwnuvpel.dll_old
2008-05-02 07:26 . 2008-05-02 10:25 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-05-02 07:26 . 2008-05-02 07:26 1,409 --a------ C:\WINDOWS\QTFont.for
2008-05-01 14:16 . 2004-08-04 08:00 180,224 --a------ C:\WINDOWS\system32\dwwin.exe
2008-05-01 14:16 . 2004-08-04 08:00 180,224 --a--c--- C:\WINDOWS\system32\dllcache\dwwin.exe
2008-05-01 14:16 . 2004-08-04 08:00 45,568 --a------ C:\WINDOWS\system32\drwtsn32.exe
2008-05-01 14:16 . 2004-08-04 08:00 45,568 --a--c--- C:\WINDOWS\system32\dllcache\drwtsn32.exe
2008-05-01 10:31 . 2008-05-01 10:31 107,072 --a------ C:\WINDOWS\system32\xuvcfhho.dll_old
2008-05-01 09:56 . 2008-05-01 13:33 211,435 --a------ C:\acadminidump.dmp
2008-05-01 09:44 . 2008-05-01 09:44 107,072 --a------ C:\WINDOWS\system32\lpjvgbgr.dll_old
2008-05-01 09:43 . 2008-05-01 09:43 281,600 --a------ C:\WINDOWS\system32\opnllIcB.dll_old
2008-05-01 07:44 . 2008-05-01 07:44 107,072 --a------ C:\WINDOWS\system32\quoberef.dll_old
2008-05-01 07:39 . 2008-05-02 07:39 109,738 --a------ C:\WINDOWS\BM2bfd2f18.xml
2008-05-01 07:39 . 2008-05-01 07:39 107,072 --a------ C:\WINDOWS\system32\gpowytwa.dll_old
2008-04-30 14:53 . 2008-04-30 14:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Elaborate Bytes
2008-04-30 14:19 . 2008-05-01 09:05 <DIR> d-------- C:\Program Files\Elaborate Bytes
2008-04-30 14:00 . 2003-05-21 22:50 1,700,352 --a------ C:\WINDOWS\system32\GdiPlus.dll
2008-04-30 14:00 . 2002-01-05 12:40 487,424 --a------ C:\WINDOWS\system32\msvcp70.dll
2008-04-30 13:59 . 2008-04-30 14:00 <DIR> d-------- C:\Program Files\Common Files\AVSMedia
2008-04-30 13:59 . 2008-05-01 08:42 <DIR> d-------- C:\Program Files\AVSMedia
2008-04-30 13:59 . 2002-01-05 02:37 344,064 --a------ C:\WINDOWS\system32\msvcr70.dll
2008-04-30 10:31 . 2008-04-30 10:45 <DIR> d-------- C:\Program Files\Folder Guard Pro
2008-04-29 16:10 . 2008-04-30 09:32 <DIR> d-------- C:\Documents and Settings\BRIAN OWEN\Application Data\Folder Guard
2008-04-29 15:55 . 2008-04-29 15:55 <DIR> d-------- C:\Program Files\Axon Data
2008-04-29 15:55 . 2008-04-29 15:55 77 --a------ C:\WINDOWS\BOWEN@BANKSONENGINEERS.COM
2008-04-28 14:48 . 2008-04-28 15:41 <DIR> d-------- C:\CLOVERFIELD_DOM1
2008-04-28 13:32 . 2008-04-28 14:45 <DIR> d-------- C:\CLOVERFIELD_DOM
2008-04-28 11:02 . 2008-04-28 11:02 <DIR> d-------- C:\AVP_REQUIEM_RATED_FULL_FRAME1
2008-04-28 09:53 . 2008-04-28 10:51 <DIR> d-------- C:\AVP_REQUIEM_RATED_FULL_FRAME
2008-04-19 11:14 . 2008-04-19 11:14 <DIR> d-------- C:\Documents and Settings\BRIAN OWEN\Application Data\dvdcss
2008-04-19 11:11 . 2008-05-01 08:43 <DIR> d-------- C:\Program Files\ImTOO
2008-04-19 11:11 . 2005-11-21 01:48 45,056 --a------ C:\WINDOWS\system32\WNASPI32.DLL
2008-04-19 11:11 . 2005-11-21 01:48 16,512 --a------ C:\WINDOWS\system32\drivers\ASPI32.SYS
2008-04-17 11:29 . 2006-02-21 07:27 81,987 --a------ C:\WINDOWS\system32\AUCPLMNT.DLL
2008-04-11 16:23 . 2008-04-11 16:23 <DIR> d-------- C:\0e1f478d8a7954ef459d5b362541c7
2008-04-07 16:46 . 2008-04-07 16:46 <DIR> d-------- C:\Documents and Settings\BRIAN OWEN\Application Data\Ansys
2008-04-07 15:45 . 2008-04-07 15:46 <DIR> d-------- C:\Program Files\AOEMView 2008
2008-04-07 15:44 . 2005-07-27 13:43 150,224 --a------ C:\WINDOWS\system32\RGB9Rast_1.dll
2008-04-07 14:00 . 2008-04-07 14:01 <DIR> d-------- C:\AUTODESK INVENTOR
2008-04-04 15:22 . 2008-04-04 15:22 <DIR> d-------- C:\Program Files\Autodesk Student Community Download Tool
2008-04-04 10:43 . 2008-04-04 10:43 <DIR> d-------- C:\incoming
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-02 14:18 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-05-02 04:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-05-01 12:57 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-05-01 12:54 --------- d-----w C:\Program Files\Microsoft ActiveSync
2008-05-01 12:41 --------- d-----w C:\Program Files\AviSynth 2.5
2008-04-28 18:47 --------- d-----w C:\Documents and Settings\All Users\Application Data\DVD Shrink
2008-04-28 14:58 152,648 ----a-w C:\Documents and Settings\BRIAN OWEN\Application Data\GDIPFONTCACHEV1.DAT
2008-04-18 19:04 --------- d-----w C:\Documents and Settings\BRIAN OWEN\Application Data\Tunebite
2008-04-17 15:31 --------- d---a-w C:\Program Files\Canon
2008-04-09 12:31 --------- d-----w C:\Program Files\Microsoft SQL Server
2008-04-08 11:51 --------- d-----w C:\Documents and Settings\All Users\Application Data\Autodesk
2008-04-08 11:48 --------- d-----w C:\Documents and Settings\BRIAN OWEN\Application Data\Autodesk
2008-04-07 20:21 --------- d-----w C:\Program Files\Autodesk
2008-04-07 20:02 --------- d-----w C:\Program Files\Common Files\Autodesk Shared
2008-04-03 13:49 --------- d-----w C:\Program Files\Musicmatch
2008-04-03 13:46 --------- d-----w C:\Program Files\Common Files\EPSON
2008-04-01 13:19 --------- d-----w C:\Documents and Settings\All Users\Application Data\RapidSolution
2008-04-01 13:16 --------- d-----w C:\Program Files\RapidSolution
2008-03-31 12:40 --------- d-----w C:\Documents and Settings\BRIAN OWEN\Application Data\Apple Computer
2008-03-31 09:14 --------- d-----w C:\Program Files\iTunes
2008-03-31 09:14 --------- d-----w C:\Program Files\iPod
2008-03-24 21:44 --------- d-----w C:\Program Files\AutoCAD Civil 3D Land Desktop Companion 2008
2008-03-24 21:18 --------- d-----w C:\Program Files\Hydraflow Hydrographs Extension for AutoCAD Civil 3D 2008
2008-03-24 21:05 --------- d-----w C:\Program Files\AutoCAD Civil 3D 2008
2008-03-24 20:50 --------- d-----w C:\Program Files\Hydraflow Express Extension for AutoCAD Civil 3D 2008
2008-03-24 20:44 --------- d-----w C:\Program Files\Hydraflow Storm Sewers Extension for AutoCAD Civil 3D 2008
2008-03-19 20:04 --------- d-----w C:\Documents and Settings\All Users\Application Data\SlySoft
2008-03-19 17:51 --------- d-----w C:\Program Files\Common Files\Adobe
2008-03-17 12:47 --------- d-----w C:\Program Files\Mozilla Firefox 3 Beta 4
2008-03-14 16:30 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-14 16:18 --------- d-----w C:\Program Files\Alias
2008-03-13 12:09 --------- d-----w C:\Documents and Settings\BRIAN OWEN\Application Data\EBookSys
2008-03-07 01:32 706 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.inf
2008-03-07 01:32 23,904 ----a-w C:\WINDOWS\system32\drivers\COH_Mon.sys
2008-03-07 01:32 10,537 ----a-w C:\WINDOWS\system32\drivers\coh_mon.cat
2007-09-17 17:02 82 ----a-w C:\Documents and Settings\All Users\Application Data\SUMQU0C1-FE20-APII-YE7M-BEDSDWMY5R6A.dat
2006-08-01 20:03 336 -c--a-w C:\Program Files\temp995.bat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{602ADB0E-4AFF-4217-8AA1-95DAC4DFA408}]
2007-08-24 23:51 316784 --a------ C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\coIEPlg.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6D53EC84-6AAE-4787-AEEE-F4628F01010C}]
2008-02-04 08:25 116088 --a------ C:\PROGRA~1\COMMON~1\SYMANT~1\IDS\IPSBHO.dll
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}"= "C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll" [2007-08-24 23:51 316784]
[HKEY_CLASSES_ROOT\clsid\{7febefe3-6b19-4349-98d2-ffb09d4b49ca}]
[HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar.1]
[HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar]
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser]
"{7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA}"= C:\Program Files\Common Files\Symantec Shared\coShared\Browser\2.0\CoIEPlg.dll [2007-08-24 23:51 316784]
[HKEY_CLASSES_ROOT\clsid\{7febefe3-6b19-4349-98d2-ffb09d4b49ca}]
[HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar.1]
[HKEY_CLASSES_ROOT\CoIEPlg.CoToolbar]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LDM"="C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe" [2007-03-13 13:28 67128]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 08:00 15360]
"H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2005-11-15 20:44 1200128]
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"@"="C:\Program Files\Internet Explorer\iexplore.exe" [2008-02-29 04:55 625664]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2008-01-31 14:15 51048]
"osCheck"="C:\Program Files\Norton Internet Security\osCheck.exe" [2007-08-25 00:53 714608]
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-02-19 13:10 267048]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-05-20 15:46 28160 C:\WINDOWS\KHALMNPR.Exe]
"FG_Monitor"="C:\Program Files\Folder Guard Pro\FGKey.exe" [2007-02-25 00:00 132680]
"28ce1c84"="C:\WINDOWS\system32\qwnuvpel.dll" [ ]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
APC UPS Status.lnk - C:\Program Files\APC\APC PowerChute Personal Edition\Display.exe [2008-02-18 09:41:38 221247]
AutoCAD Startup Accelerator.lnk - C:\Program Files\Common Files\Autodesk Shared\acstart17.exe [2006-04-05 18:45:38 11000]
Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe [2007-03-13 13:28:13 67128]
Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-01-23 08:33:08 450560]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"AllowLegacyWebView"= 1 (0x1)
"AllowUnhashedWebView"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"="C:\\WINDOWS\\system32\\logonuiX.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ssqQijiG]
ssqQijiG.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"VIDC.HFYU"= huffyuv.dll
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^EPSON Status Monitor 3 Environment Check 2.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\EPSON Status Monitor 3 Environment Check 2.lnk
backup=C:\WINDOWS\pss\EPSON Status Monitor 3 Environment Check 2.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^fortis.bat]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\fortis.bat
backup=C:\WINDOWS\pss\fortis.batCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup
[HKLM\~\startupfolder\C:^Documents and Settings^BRIAN OWEN^Start Menu^Programs^Startup^Adobe Gamma.lnk]
path=C:\Documents and Settings\BRIAN OWEN\Start Menu\Programs\Startup\Adobe Gamma.lnk
backup=C:\WINDOWS\pss\Adobe Gamma.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^BRIAN OWEN^Start Menu^Programs^Startup^IE Privacy Cleaner.lnk]
path=C:\Documents and Settings\BRIAN OWEN\Start Menu\Programs\Startup\IE Privacy Cleaner.lnk
backup=C:\WINDOWS\pss\IE Privacy Cleaner.lnkStartup
[HKLM\~\startupfolder\C:^Documents and Settings^BRIAN OWEN^Start Menu^Programs^Startup^Webshots.lnk]
path=C:\Documents and Settings\BRIAN OWEN\Start Menu\Programs\Startup\Webshots.lnk
backup=C:\WINDOWS\pss\Webshots.lnkStartup
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
--a--c--- 2005-06-06 23:46 57344 C:\Program Files\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
--a------ 2005-11-15 20:44 1200128 C:\Program Files\Microsoft ActiveSync\wcescomm.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IAAnotif]
--a------ 2005-04-25 10:50 139264 C:\Program Files\Intel\Intel Matrix Storage Manager\iaanotif.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMEKRMIG6.1]
--a------ 2004-08-04 07:00 44032 C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
--a--c--- 2004-08-04 07:00 208952 C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\InCD]
C:\Program Files\Ahead\InCD\InCD.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ink Monitor]
C:\Program Files\EPSON\Ink Monitor\InkMonitor.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IntelliPoint]
--a------ 2004-06-03 02:50 204800 C:\Program Files\Microsoft IntelliPoint\point32.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSPM Startup]
--a------ 2004-06-16 06:03 221184 C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ISUSScheduler]
--a------ 2004-06-16 06:03 81920 C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
--a------ 2008-02-19 13:10 267048 C:\Program Files\iTunes\iTunesHelper.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
--a------ 2005-05-20 15:46 28160 C:\WINDOWS\KHALMNPR.Exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MimBoot]
C:\PROGRA~1\MUSICM~1\MUSICM~1\mimboot.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NBJ]
-ra------ 2003-12-08 15:28 1748992 C:\Program Files\Ahead\Nero BackItUp\NBJ.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
-ra------ 2001-07-09 06:50 155648 C:\WINDOWS\system32\NeroCheck.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
--a------ 2005-03-21 19:21 5537792 C:\WINDOWS\system32\NvCpl.dll
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
--a------ 2008-02-01 00:13 385024 C:\Program Files\QuickTime\qttask.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SigmatelSysTrayApp]
--a------ 2005-03-23 02:20 339968 C:\WINDOWS\stsystra.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SRS Audio Sandbox]
C:\Program Files\SRS Labs\Audio Sandbox\SRSSSC.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
--a------ 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
--a------ 2007-07-26 13:04 185632 C:\Program Files\Common Files\Real\Update_OB\realsched.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\tunebite.exe]
C:\Program Files\Tunebite\tunebite.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
--a------ 2006-10-18 20:05 204288 C:\Program Files\Windows Media Player\WMPNSCFG.exe
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"navapsvc"=2 (0x2)
"SPBBCSvc"=2 (0x2)
"SNDSrvc"=3 (0x3)
"ccISPwdSvc"=3 (0x3)
"SAVScan"=3 (0x3)
"NSCService"=3 (0x3)
"Bonjour Service"=2 (0x2)
"Adobe LM Service"=3 (0x3)
"Apple Mobile Device"=2 (0x2)
"comHost"=3 (0x3)
"CCALib8"=2 (0x2)
"EPSONStatusAgent2"=2 (0x2)
"FLEXnet Licensing Service"=3 (0x3)
"Iap"=2 (0x2)
"IDriverT"=3 (0x3)
"IAANTMon"=2 (0x2)
"LiveUpdate"=3 (0x3)
"LiveUpdate Notice Service"=2 (0x2)
"LiveUpdate Notice Ex"=2 (0x2)
"MDM"=2 (0x2)
"usnjsvc"=3 (0x3)
"NVSvc"=2 (0x2)
"MSSQL$SQLEXPRESS"=2 (0x2)
"SQLBrowser"=2 (0x2)
"SQLWriter"=2 (0x2)
"iPod Service"=3 (0x3)
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\ocerd\\JobMain.exe"=
"C:\\ocerd\\apftp.exe"=
"C:\\WINDOWS\\system32\\spoolsv.exe"=
"C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
"C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
"C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
"C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
"C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
"C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=
"C:\\Program Files\\Autodesk\\3ds Max 9\\3dsmax.exe"=
"C:\\Program Files\\Autodesk\\Backburner\\monitor.exe"=
"C:\\Program Files\\Autodesk\\Backburner\\manager.exe"=
"C:\\Program Files\\Autodesk\\Backburner\\server.exe"=
"C:\\Program Files\\iTunes\\iTunes.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
R2 FGUARD32;FGUARD32;C:\Program Files\Folder Guard Pro\FGUARD32.SYS [2007-02-25 00:00]
R2 LiveUpdate Notice;LiveUpdate Notice;"C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe" /h ccCommon []
R2 MSSQL$AUTODESKVAULT;SQL Server (AUTODESKVAULT);"C:\Program Files\Microsoft SQL Server\MSSQL.2\MSSQL\Binn\sqlservr.exe" -sAUTODESKVAULT []
R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 17:38]
S2 HidCom;USB-HID -> COM Driver Service;C:\WINDOWS\system32\DRIVERS\HidCom.sys [2004-08-10 17:47]
S3 COH_Mon;COH_Mon;C:\WINDOWS\system32\Drivers\COH_Mon.sys [2008-03-06 21:32]
S4 SQLWriter;SQL Server VSS Writer;"c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe" [2007-02-10 05:29]
*Newly Created Service* - COMHOST
.
Contents of the 'Scheduled Tasks' folder
"2008-03-29 15:53:01 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program Files\Apple Software Update\SoftwareUpdate.exe
"2008-04-04 12:40:18 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - BRIAN OWEN.job"
- C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exeh/TASK:
.
**************************************************************************
catchme 0.3.1353 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-02 10:25:44
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
**************************************************************************
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
C:\Program Files\APC\APC PowerChute Personal Edition\mainserv.exe
C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program Files\Autodesk\Data Management Server 2008\Server\Dispatch\Connectivity.WindowsService.JobDispatch.exe
C:\Program Files\Autodesk\Data Management Server 2008\Server\Webserver\Connectivity.EDMWS.Server.exe
C:\Program Files\Common Files\Autodesk Shared\Service\AdskScSrv.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\Program Files\Bonjour\mDNSResponder.exe
C:\Program Files\Autodesk\3ds Max 9\mentalray\satellite\raysat_3dsmax9_32server.exe
C:\WINDOWS\system32\snmp.exe
C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe
C:\PROGRA~1\MI3AA1~1\rapimgr.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\APC\APC PowerChute Personal Edition\apcsystray.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\Program Files\Common Files\Logitech\KHAL\KHALMNPR.EXE
C:\Program Files\iPod\bin\iPodService.exe
C:\Program Files\Symantec\LiveUpdate\LuComServer_3_4.EXE
C:\Program Files\Symantec\LiveUpdate\AUPDATE.EXE
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
C:\Program Files\Symantec\LiveUpdate\LuCallbackProxy.exe
.
**************************************************************************
.
Completion time: 2008-05-02 10:43:43 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-02 14:42:34
Pre-Run: 21,820,919,808 bytes free
Post-Run: 21,645,680,640 bytes free
340 --- E O F --- 2008-04-16 13:31:35
what's my next step?
Hello,
Apprantly you missed our sticky topics.
"BEFORE you POST"(READ this Procedure BEFORE Requesting Assistance) (http://forums.spybot.info/showthread.php?t=288)
Do NOT run 'fixes' before helpers have analyzed HJT/KAV scans (http://forums.spybot.info/showthread.php?t=16806)
As you have four posts in a new topic, you may want to consider reading those stickies and then starting a new topic providing a link back to this one. Helpers look for threads with no response.
Then I would close this.
Regards.