PDA

View Full Version : Virtumonde problem


Hamzlrr
2008-05-16, 21:35
heres the combofix log
ComboFix 08-05-15.2 - Palmer 2008-05-16 14:13:48.2 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.932.81.1033.18.1437 [GMT -4:00]
Running from: C:\Documents and Settings\Palmer\Desktop\ComboFix.exe

WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\WINDOWS\rs.txt
C:\WINDOWS\system32\HiQrsBeg.ini
C:\WINDOWS\system32\HiQrsBeg.ini2

.
((((((((((((((((((((((((( Files Created from 2008-04-16 to 2008-05-16 )))))))))))))))))))))))))))))))
.

2008-05-16 14:18 . 2008-05-16 14:18 317,824 --a------ C:\WINDOWS\system32\ssqOFXpq.dll
2008-05-16 14:18 . 2008-05-16 14:18 344 --ahs---- C:\WINDOWS\system32\qpXFOqss.ini
2008-05-16 13:56 . 2008-05-16 13:57 <DIR> d-------- C:\Program Files\Unlocker
2008-05-16 13:50 . 2008-05-16 13:50 <DIR> d-------- C:\Program Files\Trend Micro
2008-05-16 05:43 . 2008-05-16 13:58 1,411,345 ---hs---- C:\WINDOWS\system32\wdmumawx.ini
2008-05-16 05:43 . 2008-05-16 05:43 91,776 --a------ C:\WINDOWS\system32\xwamumdw.dll
2008-05-16 05:42 . 2008-05-16 05:42 317,824 --a------ C:\WINDOWS\system32\geBsrQiH.dll
2008-05-16 04:08 . 2008-05-16 04:36 1,410,793 ---hs---- C:\WINDOWS\system32\avrnjegx.ini
2008-05-16 02:31 . 2008-05-16 02:33 1,410,732 --ahs---- C:\WINDOWS\system32\wtyytdjs.ini
2008-05-16 02:31 . 2008-05-16 02:31 91,264 --a------ C:\WINDOWS\system32\sjdtyytw.dll
2008-05-16 01:35 . 2008-05-16 02:25 1,410,672 --ahs---- C:\WINDOWS\system32\acmssohl.ini
2008-05-16 01:34 . 2008-05-16 01:34 91,264 --a------ C:\WINDOWS\system32\lhossmca.dll
2008-05-16 00:17 . 2008-05-16 01:10 1,546,386 --ahs---- C:\WINDOWS\system32\skvolgop.ini
2008-05-16 00:17 . 2008-05-16 00:17 91,264 --a------ C:\WINDOWS\system32\poglovks.dll
2008-05-15 21:57 . 2008-05-16 14:16 664 --a------ C:\WINDOWS\system32\d3d9caps.dat
2008-05-15 21:13 . 2008-05-15 21:13 <DIR> d-------- C:\Program Files\LogicFunctions
2008-05-15 20:56 . 2008-05-15 20:56 <DIR> d-------- C:\Documents and Settings\Palmer\Application Data\TmpRecentIcons
2008-05-15 19:35 . 2008-05-15 21:58 1,410,672 --ahs---- C:\WINDOWS\system32\jpbgoxxo.ini
2008-05-15 19:35 . 2008-05-15 19:35 91,264 --a------ C:\WINDOWS\system32\oxxogbpj.dll
2008-05-15 19:28 . 2008-05-15 19:28 29,312 --a------ C:\WINDOWS\system32\ssqOIAtU.dll
2008-05-15 19:27 . 2008-05-15 19:27 29,312 --a------ C:\WINDOWS\system32\vtUlJcCT.dll
2008-05-15 19:27 . 2008-05-15 19:27 29,312 --a------ C:\WINDOWS\system32\ddcCTKBT.dll
2008-05-15 19:26 . 2008-05-15 11:41 278,528 --a------ C:\WINDOWS\fvowketqonp.dll
2008-05-15 19:26 . 2008-05-15 11:41 204,800 --a------ C:\WINDOWS\mpfanvqg.dll
2008-05-15 19:26 . 2008-05-15 19:30 160,256 --a------ C:\WINDOWS\system32\blackster.scr
2008-05-15 19:26 . 2008-05-15 11:41 135,168 --a------ C:\WINDOWS\exqb.exe
2008-05-15 19:26 . 2008-05-15 11:41 81,920 --a------ C:\WINDOWS\oadkxrts.exe
2008-05-15 00:27 . 2008-05-15 00:27 <DIR> d-------- C:\Program Files\BISHOP
2008-05-12 01:07 . 2008-05-12 01:07 <DIR> d-------- C:\Program Files\銀時計
2008-05-10 04:38 . 2008-05-10 04:38 <DIR> d-------- C:\Documents and Settings\Palmer\Application Data\Media Player Classic
2008-05-09 01:13 . 2008-05-09 01:13 <DIR> d-------- C:\Documents and Settings\All Users\Symantec Temporary Files
2008-05-07 15:56 . 2008-05-07 15:56 <DIR> d-------- C:\Program Files\Combined Community Codec Pack
2008-05-04 03:03 . 2008-05-09 02:03 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-05-04 03:03 . 2008-05-09 02:03 1,409 --a------ C:\WINDOWS\QTFont.for
2008-05-04 01:28 . 2008-05-04 01:28 <DIR> d-------- C:\Documents and Settings\Palmer\Application Data\Songbird1
2008-05-04 01:28 . 2008-05-04 01:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SongbirdVLC
2008-05-03 03:22 . 2008-05-12 01:38 <DIR> d-------- C:\Program Files\Xuse
2008-04-30 23:25 . 2008-04-30 23:25 2,560 --a------ C:\WINDOWS\system32\bitcometres.dll

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-05-15 23:32 --------- d-----w C:\Program Files\Norton Security Scan
2008-05-13 00:02 --------- d-----w C:\Program Files\Steam
2008-05-09 05:28 --------- d-----w C:\Program Files\Norton AntiVirus
2008-05-09 05:28 --------- d-----w C:\Program Files\Common Files\Symantec Shared
2008-05-09 05:28 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
2008-05-09 05:26 --------- d-----w C:\Program Files\Symantec
2008-05-09 05:21 --------- d-----w C:\Documents and Settings\Palmer\Application Data\Symantec
2008-05-04 05:37 --------- d-----w C:\Program Files\Java
2008-05-01 03:24 --------- d-----w C:\Program Files\BitComet
2008-04-21 03:20 --------- d-----w C:\Program Files\D-Tools
2008-03-29 08:41 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-03-28 06:29 --------- d-----w C:\Program Files\Magic MP3 Tagger
2008-03-26 23:41 --------- d-----w C:\Program Files\Mozilla Firefox 3 Beta 4
2008-03-24 06:56 --------- d-----w C:\Program Files\Vampire - Bloodlines
2008-03-24 06:49 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-03-24 06:40 --------- d-----w C:\Program Files\Activision
2008-03-23 09:39 --------- d-----w C:\Documents and Settings\All Users\Application Data\The Filter
2008-03-23 09:28 --------- d-----w C:\Program Files\Winamp
2008-03-23 09:28 --------- d-----w C:\Program Files\4front-headphones-1
2008-03-23 03:35 --------- d-----w C:\Documents and Settings\Palmer\Application Data\BitTorrent
2008-03-20 23:53 --------- d-----w C:\Program Files\DivX
2008-03-11 08:33 691,545 ----a-w C:\WINDOWS\unins000.exe
2007-11-01 02:58 39,624 ----a-w C:\Documents and Settings\Palmer\Application Data\GDIPFONTCACHEV1.DAT
2005-08-22 14:57 0 ----a-w C:\Documents and Settings\Palmer\WoW-1.6.1.4544-to-0.7.0-enUS-patch.exe
2005-05-16 02:10 487 ----a-w C:\Documents and Settings\Palmer\CR-DX7MP.reg
.

------- Sigcheck -------

2005-05-25 15:04 359808 88763a98a4c26c409741b4aa162720c9 C:\WINDOWS\$hf_mig$\KB893066\SP2GDR\tcpip.sys
2005-05-25 15:07 359936 63fdfea54eb53de2d863ee454937ce1e C:\WINDOWS\$hf_mig$\KB893066\SP2QFE\tcpip.sys
2006-01-12 22:28 359808 583e063fdc888ca30d05c2724b0d7ef4 C:\WINDOWS\$hf_mig$\KB913446\SP2GDR\tcpip.sys
2006-01-13 13:07 360448 5562cc0a47b2aef06d3417b733f3c195 C:\WINDOWS\$hf_mig$\KB913446\SP2QFE\tcpip.sys
2006-04-20 07:51 359808 1dbf125862891817f374f407626967f4 C:\WINDOWS\$hf_mig$\KB917953\SP2GDR\tcpip.sys
2006-04-20 08:18 360576 b2220c618b42a2212a59d91ebd6fc4b4 C:\WINDOWS\$hf_mig$\KB917953\SP2QFE\tcpip.sys
2006-04-20 07:38 340480 b8158e2a6112c0a5ca67bc158fc70218 C:\WINDOWS\$NtServicePackUninstall$\tcpip.sys
2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\$NtUninstallKB893066$\tcpip.sys
2002-08-29 02:58 332928 244a2f9816bc9b593957281ef577d976 C:\WINDOWS\$NtUninstallKB893066_0$\tcpip.sys
2005-05-25 15:04 359808 88763a98a4c26c409741b4aa162720c9 C:\WINDOWS\$NtUninstallKB913446$\tcpip.sys
2005-05-25 15:41 339968 228b0385bbfca24332fa22db45a8b684 C:\WINDOWS\$NtUninstallKB913446_0$\tcpip.sys
2006-01-12 22:28 359808 583e063fdc888ca30d05c2724b0d7ef4 C:\WINDOWS\$NtUninstallKB917953$\tcpip.sys
2006-01-12 21:13 340480 8c101c9c566e2384af28ef7c1de4a36e C:\WINDOWS\$NtUninstallKB917953_0$\tcpip.sys
2004-08-03 23:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\ServicePackFiles\i386\tcpip.sys
2004-08-04 02:14 359040 9f4b36614a0fc234525ba224957de55c C:\WINDOWS\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\tcpip.sys
2007-08-04 04:45 359808 ba57942c0029b0878afba052a3e33689 C:\WINDOWS\system32\dllcache\tcpip.sys
2007-08-04 04:45 359808 ba57942c0029b0878afba052a3e33689 C:\WINDOWS\system32\drivers\tcpip.sys

2005-03-01 20:34 2056832 81013f36b21c7f72cf784cc6731e0002 C:\WINDOWS\$hf_mig$\KB890859\SP2GDR\ntkrnlpa.exe
2005-03-01 20:36 2056832 d8aba3eab509627e707a3b14f00fbb6b C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntkrnlpa.exe
2005-03-01 20:36 1955840 62c353c0449fd961ef7814973fc2fd30 C:\WINDOWS\$NtServicePackUninstall$\ntkrnlpa.exe
2004-08-03 22:59 2056832 947fb1d86d14afcffdb54bf837ec25d0 C:\WINDOWS\$NtUninstallKB890859$\ntkrnlpa.exe
2002-08-29 02:04 1947904 0e8efb15746878a9b256e75267337233 C:\WINDOWS\$NtUninstallKB890859_0$\ntkrnlpa.exe
2005-03-01 20:34 2056832 81013f36b21c7f72cf784cc6731e0002 C:\WINDOWS\Driver Cache\i386\ntkrnlpa.exe
2004-08-03 22:59 2056832 947fb1d86d14afcffdb54bf837ec25d0 C:\WINDOWS\ServicePackFiles\i386\ntkrnlpa.exe
2004-08-04 01:58 2056832 947fb1d86d14afcffdb54bf837ec25d0 C:\WINDOWS\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\ntkrnlpa.exe
2005-03-01 20:34 2067712 73c6d7f370eee2330162a8dd3302159c C:\WINDOWS\system32\ntkrnlpa.exe
2005-03-01 20:34 2056832 81013f36b21c7f72cf784cc6731e0002 C:\WINDOWS\system32\VITrans\ntkrnlpa.exe

2005-03-01 20:59 2179328 4d4cf2c14550a4b7718e94a6e581856e C:\WINDOWS\$hf_mig$\KB890859\SP2GDR\ntoskrnl.exe
2005-03-01 21:04 2179456 28187802b7c368c0d3aef7d4c382aabb C:\WINDOWS\$hf_mig$\KB890859\SP2QFE\ntoskrnl.exe
2005-03-01 21:33 2040832 a15a2ee0be2f71fc1752a05660b8ebdc C:\WINDOWS\$NtServicePackUninstall$\ntoskrnl.exe
2004-08-03 23:20 2180992 ce218bc7088681faa06633e218596ca7 C:\WINDOWS\$NtUninstallKB890859$\ntoskrnl.exe
2002-08-29 03:03 2042240 b9080d97dbd631aadf9128f7316958d2 C:\WINDOWS\$NtUninstallKB890859_0$\ntoskrnl.exe
2005-03-01 20:59 2179328 4d4cf2c14550a4b7718e94a6e581856e C:\WINDOWS\Driver Cache\i386\ntoskrnl.exe
2004-08-03 23:20 2180992 ce218bc7088681faa06633e218596ca7 C:\WINDOWS\ServicePackFiles\i386\ntoskrnl.exe
2004-08-04 02:19 2180992 ce218bc7088681faa06633e218596ca7 C:\WINDOWS\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\ntoskrnl.exe
2005-03-01 20:59 2190208 ba9c5fd985ba9de863f482b892b0e4ad C:\WINDOWS\system32\ntoskrnl.exe
2005-03-01 20:59 2179328 4d4cf2c14550a4b7718e94a6e581856e C:\WINDOWS\system32\VITrans\ntoskrnl.exe

2004-08-04 00:56 1422336 cd7ee0e0b4c778c3df22f8dbb9f855b4 C:\WINDOWS\explorer.exe
2002-08-29 04:41 1004032 a82b28bfc2e4455fe43022a498c0ef0a C:\WINDOWS\$NtServicePackUninstall$\explorer.exe
2004-08-04 00:56 1032192 a0732187050030ae399b241436565e64 C:\WINDOWS\ServicePackFiles\i386\explorer.exe
2004-08-04 03:56 1032192 a0732187050030ae399b241436565e64 C:\WINDOWS\SoftwareDistribution\Download\16b2c96a0c41f4dfdb4d3cc228a4f819\explorer.exe
2004-08-04 00:56 1032192 a0732187050030ae399b241436565e64 C:\WINDOWS\system32\VITrans\explorer.exe
.
((((((((((((((((((((((((((((( snapshot@2008-05-16_ 4.36.19.73 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-05-16 08:24:48 2,048 --s-a-w C:\WINDOWS\bootstat.dat
+ 2008-05-16 18:16:39 2,048 --s-a-w C:\WINDOWS\bootstat.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{18CB1A7B-94CD-4582-8022-ADA16851E44B}]
2008-03-27 09:43 247296 --a------ C:\Program Files\LogicFunctions\LogicFunctions.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{2E529F87-2B52-438C-9E7C-7D0A0DD910BA}]
2008-05-15 19:27 29312 --a------ C:\WINDOWS\system32\ddcCTKBT.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{38249B41-8587-4B26-9633-641723ABFDDC}]
C:\WINDOWS\system32\efcYSiJB.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{89A9CC26-4818-4FFD-82E0-9C3CF815FEB2}]
2008-05-15 11:41 278528 --a------ C:\WINDOWS\fvowketqonp.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A49B09AE-ADFC-4A27-974E-3E5DF8B84C0D}]
C:\WINDOWS\system32\urqOGWmm.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A8B101D5-8647-47D0-8BCE-D420F5DE1DF8}]
C:\WINDOWS\system32\rqRLdCVM.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EB39ED3D-4995-4A11-ADB6-17414A0B3E3E}]
2008-05-16 05:42 317824 --a------ C:\WINDOWS\system32\geBsrQiH.dll

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{EEE381B1-11AF-4D56-AD15-65B43D222E92}]
2008-05-16 14:18 317824 --a------ C:\WINDOWS\system32\ssqOFXpq.dll

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
"{E738884B-E75D-4AC3-B03F-62F7E7DD853E}"= "C:\WINDOWS\pvnsmfor.dll" [ ]

[HKEY_CLASSES_ROOT\clsid\{e738884b-e75d-4ac3-b03f-62f7e7dd853e}]
[HKEY_CLASSES_ROOT\pvnsmfor.1]
[HKEY_CLASSES_ROOT\TypeLib\{28579586-9751-48D9-9F9B-BC3714D9F175}]
[HKEY_CLASSES_ROOT\pvnsmfor]

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CPU_Control"="C:\Program Files\CPU-Control\CPU_Control.exe" [2007-03-06 21:24 1010688]
"ATI Remote Control"="C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe" [2006-04-05 22:03 1622016]
"ATI Launchpad"="C:\Program Files\ATI Multimedia\main\LaunchPd.exe" [2003-12-03 08:17 106570]
"RocketDock"="C:\Program Files\RocketDock\RocketDock.exe" [2007-08-21 10:27 495616]
"SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 12:43 2097488]
"WMPNSCFG"="C:\Program Files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 20:05 204288]
"ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 00:56 15360]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NVMixerTray"="C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe" [2004-12-20 17:12 131072]
"Logitech Utility"="Logi_MwX.Exe" [2003-12-11 09:50 20992 C:\WINDOWS\Logi_MwX.Exe]
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2004-11-02 20:24 32768]
"SoundMan"="SOUNDMAN.EXE" [2006-06-20 17:42 577536 C:\WINDOWS\SOUNDMAN.EXE]
"Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2007-03-12 18:30 517768]
"nwiz"="nwiz.exe" [2007-10-28 17:52 1626112 C:\WINDOWS\system32\nwiz.exe]
"NvMediaCenter"="C:\WINDOWS\system32\NvMcTray.dll" [2007-10-28 17:52 81920]

C:\Documents and Settings\Palmer\Start Menu\Programs\Startup\
ActiveClick 2.0d.lnk.disabled [2006-09-03 01:08:36 734]
Yahoo! Widget Engine.lnk.disabled [2007-02-04 04:09:10 826]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Gamma Loader.lnk.disabled [2004-11-14 12:57:59 1918]
Adobe Reader Speed Launch.lnk.disabled [2005-11-06 13:24:34 1757]
hp psc 1000 series.lnk.disabled [2004-11-14 00:26:43 779]
hpoddt01.exe.lnk.disabled [2004-11-14 00:17:05 779]
Microsoft Office.lnk.disabled [2004-11-14 13:07:21 1730]

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{2E529F87-2B52-438C-9E7C-7D0A0DD910BA}"= C:\WINDOWS\system32\ddcCTKBT.dll [2008-05-15 19:27 29312]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
"mpfanvqg"= {53B7D82A-1D46-442E-86FD-90B846DDFA2D} - C:\WINDOWS\mpfanvqg.dll [2008-05-15 11:41 204800]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"UIHost"=hex(2):76,69,73,74,61,75,69,2e,65,78,65,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ddcCTKBT]
ddcCTKBT.dll 2008-05-15 19:27 29312 C:\WINDOWS\system32\ddcCTKBT.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\WBSrv]
C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\wbsrv.dll 2005-12-06 21:16 176128 C:\PROGRA~1\Stardock\OBJECT~1\WINDOW~1\WbSrv.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=wbsys.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.3iv2"= 3ivxVfWCodec.dll
"msacm.divxa32"= divxa32.acm
"VIDC.HFYU"= huffyuv.dll
"VIDC.VP31"= vp31vfw.dll
"VIDC.VCR2"= ATIVCR2.DLL
"VIDC.DRAW"= DVIDEO.DLL
"VIDC.VCR1"= ATIVCR1.DLL
"VIDC.YV12"= ATIYUV12.DLL
"VIDC.YU12"= ATIYUV12.DLL
"VIDC.PIM1"= pclepim1.dll
"VIDC.MJPG"= pvmjpg21.dll
"vidc.ffds"= C:\PROGRA~1\COMBIN~1\Filters\FFDShow\ff_vfw.dll

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Authentication Packages REG_MULTI_SZ msv1_0 C:\WINDOWS\system32\ssqOFXpq

[HKLM\~\startupfolder\C:^Documents and Settings^Palmer^Start Menu^Programs^Startup^LimeWire On Startup.lnk.disabled]
path=C:\Documents and Settings\Palmer\Start Menu\Programs\Startup\LimeWire On Startup.lnk.disabled
backup=C:\WINDOWS\pss\LimeWire On Startup.lnk.disabledStartup

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\msnmsgr]
--a------ 2007-01-19 13:54 5674352 C:\Program Files\MSN Messenger\msnmsgr.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
"MsnMsgr"="C:\Program Files\MSN Messenger\msnmsgr.exe" /background
"ATI Scheduler"=C:\Program Files\ATI Multimedia\MAIN\ATISched.EXE
"<NO NAME>"=
"Steam"="c:\program files\steam\steam.exe" -silent
"OM_Monitor"=C:\OLYMPUS\OLYMPUS Master\Monitor.exe -NoStart
"LiteKeep"=C:\DOCUME~1\Palmer\APPLIC~1\ABOUTS~1\link rule meta.exe
"BitTorrent"="C:\Program Files\BitTorrent\bittorrent.exe" --force_start_minimized
"iSproggler"="C:\Documents and Settings\Palmer\Desktop\iSproggler\iSproggler.exe"
"ctfmon.exe"=C:\WINDOWS\system32\CTFMON.EXE
"STYLEXP"=C:\Program Files\TGTSoft\StyleXP\StyleXP.exe -Hide
"Veoh"="C:\Program Files\Veoh Networks\Veoh\VeohClient.exe" /VeohHide
"Vista Sidebar"=C:\Program Files\Vista Sidebar\sidebar.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"NeroFilterCheck"=C:\WINDOWS\system32\NeroCheck.exe
"RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
"DAEMON Tools-1033"="C:\Program Files\D-Tools\daemon.exe" -lang 1033
"hsb"=C:\WINDOWS\hsb.exe
"rcjgdo"=c:\windows\system32\rcjgdo.exe
"saap"=c:\program files\180search assistant\saap.exe
"ujod"=C:\WINDOWS\ujod.exe
"iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe"
"OM_Monitor"=C:\OLYMPUS\OLYMPUS Master\FirstStart.exe
"PWRISOVM.EXE"=C:\Program Files\PowerISO\PWRISOVM.EXE
"SsAAD.exe"=C:\PROGRA~1\Sony\SONICS~1\SsAAD.exe
"ATIPTA"=C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
"ATICCC"="C:\Program Files\ATI Technologies\ATI.ACE\cli.exe" runtime
"QuickTime Task"="C:\Program Files\K-Lite Codec Pack\QuickTime\qttask.exe" -atboottime
"nwiz"=nwiz.exe /install
"UltraMon"="C:\Program Files\UltraMon\UltraMon.exe" /auto
"NvCplDaemon"=RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
"PHIME2002ASync"=C:\WINDOWS\System32\IME\TINTLGNT\TINTSETP.EXE /SYNC
"SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusDisableNotify"=dword:00000001

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"C:\\Program Files\\BitTorrent\\bittorrent.exe"=
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program Files\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program Files\\MSN Messenger\\livecall.exe"=
"C:\Documents and Settings\Palmer\Local Settings\Apps\2.0\4VM9R1DQ.WQC\OA2HGLLY.E31\thef...app_0d221d3645bc6701_0002.0005_8decbbb466c17454\The Filter.exe"= C:\Documents and Settings\Palmer\Local Settings\Apps\2.0\4VM9R1DQ.WQC\OA2HGLLY.E31\thef...app_0d221d3645bc6701_0002.0005_8decbbb466c17454\The Filter.exe:127.0.0.1/255.255.255.255:Enabled:The Filter: Windows Media Player plugin

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"18980:TCP"= 18980:TCP:BitComet 18980 TCP
"18980:UDP"= 18980:UDP:BitComet 18980 UDP
"26250:TCP"= 26250:TCP:BitComet 26250 TCP
"26250:UDP"= 26250:UDP:BitComet 26250 UDP

R0 nvcchflt;NVIDIA Disk Cache Filter Driver;C:\WINDOWS\system32\DRIVERS\nvcchflt.sys [2005-02-11 18:11]
R0 Si3112r;Silicon Image SiI 3112 SATARaid Controller;C:\WINDOWS\system32\DRIVERS\si3112r.sys [2002-10-15 22:57]
R2 {09BB444F-B2E2-4009-BAF2-7B727681223E};BuddyVM;C:\Program Files\VMLaunch\BuddyVM.sys [2004-12-03 20:12]
R2 UltraMonUtility;UltraMon Utility Driver;C:\Program Files\Common Files\Realtime Soft\UltraMonMirrorDrv\x32\UltraMonUtility.sys [2006-09-24 21:22]
R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 17:38]
R3 UltraMonMirror;UltraMonMirror;C:\WINDOWS\system32\DRIVERS\UltraMonMirror.sys [2006-09-24 21:23]
R3 US122;US122 Driver;C:\WINDOWS\system32\Drivers\US122.sys [2004-07-30 12:49]
R3 Us122WdmService;US122 Wdm Audio;C:\WINDOWS\system32\Drivers\US122Wdm.sys [2004-07-30 12:49]
S3 US122DL;US122 Firmware Downloader;C:\WINDOWS\system32\Drivers\US122DL.sys [2004-07-30 13:02]

.
Contents of the 'Scheduled Tasks' folder
"2008-05-12 07:47:40 C:\WINDOWS\Tasks\Norton Security Scan.job"
- C:\Program Files\Norton Security Scan\Nss.exe
"2008-05-16 06:59:53 C:\WINDOWS\Tasks\Spybot - Search & Destroy - Scheduled Task.job"
- C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
.
**************************************************************************

catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-05-16 14:17:23
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...


C:\WINDOWS\system32\qpXFOqss.ini 344 bytes
C:\WINDOWS\system32\qpXFOqss.ini2 344 bytes
C:\WINDOWS\system32\ssqOFXpq.dll 317824 bytes executable
C:\WINDOWS\system32\ultkcysc.ini 1325523 bytes

scan completed successfully
hidden files: 4

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\ddcCTKBT.dll
.
------------------------ Other Running Processes ------------------------
.
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\conime.exe
C:\Program Files\Symantec\LiveUpdate\AluSchedulerSvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Logitech\MouseWare\system\EM_EXEC.EXE
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\system32\UAService7.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
.
**************************************************************************
.
Completion time: 2008-05-16 14:27:51 - machine was rebooted
ComboFix-quarantined-files.txt 2008-05-16 18:27:45
ComboFix2.txt 2008-05-16 08:36:49

Pre-Run: 19,912,794,112 bytes free
Post-Run: 19,894,882,304 bytes free

322
Hamzlrr
2008-05-16, 21:37
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 2:32:46 PM, on 16/05/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\WINDOWS\system32\conime.exe
C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\Program Files\CPU-Control\CPU_Control.exe
C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
C:\Program Files\RocketDock\RocketDock.exe
C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
C:\Program Files\Windows Media Player\WMPNSCFG.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Logitech\MouseWare\system\em_exec.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
C:\WINDOWS\System32\svchost.exe
C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
C:\WINDOWS\System32\UAService7.exe
C:\Program Files\Viewpoint\Common\ViewpointService.exe
C:\Program Files\Viewpoint\Viewpoint Manager\ViewMgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\explorer.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll (file missing)
O3 - Toolbar: StylerToolBar - {D2F8F919-690B-4EA2-9FA7-A203D1E04F75} - C:\Program Files\Styler\TB\StylerTB.dll
O3 - Toolbar: pvnsmfor - {E738884B-E75D-4AC3-B03F-62F7E7DD853E} - C:\WINDOWS\pvnsmfor.dll (file missing)
O4 - HKLM\..\Run: [NVMixerTray] "C:\Program Files\NVIDIA Corporation\NvMixer\NVMixerTray.exe"
O4 - HKLM\..\Run: [Logitech Utility] Logi_MwX.Exe
O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKCU\..\Run: [CPU_Control] C:\Program Files\CPU-Control\CPU_Control.exe
O4 - HKCU\..\Run: [ATI Remote Control] C:\Program Files\ATI Multimedia\RemCtrl\ATIRW.exe
O4 - HKCU\..\Run: [ATI Launchpad] "C:\Program Files\ATI Multimedia\main\LaunchPd.exe"
O4 - HKCU\..\Run: [RocketDock] "C:\Program Files\RocketDock\RocketDock.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Startup: ActiveClick 2.0d.lnk.disabled
O4 - Startup: Yahoo! Widget Engine.lnk.disabled
O4 - Global Startup: Adobe Gamma Loader.lnk.disabled
O4 - Global Startup: Adobe Reader Speed Launch.lnk.disabled
O4 - Global Startup: hp psc 1000 series.lnk.disabled
O4 - Global Startup: hpoddt01.exe.lnk.disabled
O4 - Global Startup: Microsoft Office.lnk.disabled
O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: ATI TV - {44226DFF-747E-4edc-B30C-78752E50CD0C} - C:\Program Files\ATI Multimedia\tv\EXPLBAR.DLL
O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.2.2.28.dll/206 (file missing)
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
O21 - SSODL: mpfanvqg - {53B7D82A-1D46-442E-86FD-90B846DDFA2D} - C:\WINDOWS\mpfanvqg.dll
O23 - Service: Adobe LM Service - Unknown owner - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\System32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
O23 - Service: MSCSPTISRV - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\MSCSPTISRV.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: PACSPTISVR - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\PACSPTISVR.exe
O23 - Service: Pml Driver HPZ12 - HP - C:\WINDOWS\System32\HPZipm12.exe
O23 - Service: SF FrontLine Drivers Auto Removal (v1) (sfrem01) - Protection Technology (StarForce) - C:\WINDOWS\system32\sfrem01.exe
O23 - Service: Sony SPTI Service (SPTISRV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SPTISRV.exe
O23 - Service: SonicStage SCSI Service (SSScsiSV) - Sony Corporation - C:\Program Files\Common Files\Sony Shared\AVLib\SSScsiSV.exe
O23 - Service: StarWind AE Service (StarWindServiceAE) - Rocket Division Software - C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
O23 - Service: StyleXPService - Unknown owner - C:\Program Files\TGTSoft\StyleXP\StyleXPService.exe
O23 - Service: Symantec Core LC - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
O23 - Service: SecuROM User Access Service (V7) (UserAccess7) - Sony DADC Austria AG. - C:\WINDOWS\System32\UAService7.exe
O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

--
End of file - 8080 bytes
Shaba
2008-05-23, 12:53
Hi Hamzlrr

If you still need help, please rename HijackThis.exe to Hamzlrr.exe and post back a fresh HijackThis log :)
Shaba
2008-05-28, 17:17
Due to the lack of feedback this Topic is closed.

If it has been five days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.

If it has been less than five days since your last response and you need the thread re-opened, please send a private message (pm). A valid, working link to the closed topic is required.

Everyone else please begin a New Topic.