Jax840621
2008-06-04, 05:24
I have been trying to remove this virtumonde malware. I first noticed it because TeaTimer. Spybot will 'remove' it but within a few minutes of booting, TeaTimer goes crazy. I have also run ComboFix. This also 'removes' it, but it will be back within minutes. Spyware Doctor does not detect or clean it.
These logs were generated ComboFix first, KAV Second, and HJT last. My KAV report won't fit into one post. I have posted part of it. I have the full one if you would like that posted.
Here are my logs:
HJT:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:30:22 PM, on 6/2/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
D:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
D:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe
C:\Program Files\VPNremote for Windows XP\AvVpnService.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\system32\lkcitdl.exe
C:\WINDOWS\system32\lkads.exe
C:\WINDOWS\system32\lktsrv.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
D:\Program Files\National Instruments\MAX\nimxs.exe
C:\Program Files\McAfee\Common Framework\naPrdMgr.exe
D:\Program Files\National Instruments\Shared\Security\nidmsrv.exe
C:\WINDOWS\system32\nisvcloc.exe
D:\Program Files\National Instruments\Shared\Tagger\tagsrv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\dmadmin.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Synaptics\SynTP\Toshiba.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\Toshiba\Tvs\TvsTray.exe
C:\Program Files\Protector Suite QL\psqltray.exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\WINDOWS\system32\TPSMain.exe
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\toshiba\ivp\ism\pinger.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\system32\TPSBattM.exe
D:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
D:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\PROGRA~1\THEWEA~1\Desktop\DesktopWeather.exe
D:\Program Files\DAEMON Tools\daemon.exe
D:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientSystemTray.exe
C:\WINDOWS\system32\RAMASST.exe
D:\Program Files\Webshots\webshots.scr
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.toshibadirect.com/dpdstart
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.toshibadirect.com/dpdstart
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = co.proxy.avaya.com:8000
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [NVRotateSysTray] rundll32.exe C:\WINDOWS\system32\nvsysrot.dll,Enable
O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Protector Suite QL\launcher.exe" /startup
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "D:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [SoftwareStation] "C:\Program Files\eAcceleration\Station\station.exe" /b Startup
O4 - HKLM\..\Run: [StopSignSsTsMon] Rundll32.exe "C:\Program Files\Acceleration Software\Anti-Virus\sstsmon0.dll",VerifyStatus
O4 - HKLM\..\Run: [StopSignSsSsMon] Rundll32.exe "C:\Program Files\Acceleration Software\Anti-Virus\ssssmon.dll",VerifyStatus
O4 - HKLM\..\Run: [webscan] "C:\Program Files\Acceleration Software\Anti-Virus\stopsignav.exe" -k
O4 - HKLM\..\Run: [Windows Defender] "D:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [BM135a4420] Rundll32.exe "C:\WINDOWS\system32\wtolcuyb.dll",s
O4 - HKLM\..\RunOnce: [StopSignSsSsMon] Rundll32.exe "C:\Program Files\Acceleration Software\Anti-Virus\ssssmon.dll",VerifyStatus /ro
O4 - HKCU\..\Run: [Communicator] "D:\Program Files\Microsoft Office Communicator\Communicator.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [DW6] "C:\PROGRA~1\THEWEA~1\Desktop\DesktopWeather.exe"
O4 - HKCU\..\Run: [DAEMON Tools] "d:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKUS\S-1-5-19\..\Run: [Communicator] "D:\Program Files\Microsoft Office Communicator\Communicator.exe" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Communicator] "D:\Program Files\Microsoft Office Communicator\Communicator.exe" (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Communicator] "D:\Program Files\Microsoft Office Communicator\Communicator.exe" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Communicator] "D:\Program Files\Microsoft Office Communicator\Communicator.exe" (User 'Default user')
O4 - Startup: Webshots.lnk = D:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Amazon Unbox.lnk = ?
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.toshibadirect.com/dpdstart
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {338095E4-1806-4BA3-AB51-38A3179200E9} (QuickMksAxCtl Class) - http://127.0.0.1:8308/ui/plugin/vmwa...-win32-x86.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - D:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Amazon Unbox Video Service (ADVService) - Amazon.com - D:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe
O23 - Service: Avaya VPN Service (AvService) - Unknown owner - C:\Program Files\VPNremote for Windows XP\AvVpnService.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: eAcceleration Notification Service (eac_notifysvc) - eAcceleration Corp - C:\PROGRA~1\EACCEL~1\FRAMEW~1\eac_svc.exe
O23 - Service: eAcceleration Product Manager Service (eac_productsvc) - eAcceleration Corp - C:\PROGRA~1\EACCEL~1\FRAMEW~1\eac_productsvc.exe
O23 - Service: Imapi Helper - Alex Feinman - D:\Program Files\ISO Recorder\ImapiHelper.exe
O23 - Service: Lookout Citadel Server (LkCitadelServer) - National Instruments, Inc. - C:\WINDOWS\system32\lkcitdl.exe
O23 - Service: National Instruments PSP Server Locator (lkClassAds) - National Instruments Corporation - C:\WINDOWS\system32\lkads.exe
O23 - Service: National Instruments Time Synchronization (lkTimeSync) - National Instruments Corporation - C:\WINDOWS\system32\lktsrv.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: NI Configuration Manager (mxssvr) - National Instruments Corporation - D:\Program Files\National Instruments\MAX\nimxs.exe
O23 - Service: National Instruments Domain Service (NIDomainService) - National Instruments Corporation - D:\Program Files\National Instruments\Shared\Security\nidmsrv.exe
O23 - Service: NILM License Manager - Macrovision Corporation - D:\Program Files\National Instruments\Shared\License Manager\Bin\lmgrd.exe
O23 - Service: NI Service Locator (niSvcLoc) - National Instruments Corp. - C:\WINDOWS\system32\nisvcloc.exe
O23 - Service: National Instruments Variable Engine (NITaggerService) - National Instruments Corporation - D:\Program Files\National Instruments\Shared\Tagger\tagsrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: OpcEnum - OPC Foundation - C:\WINDOWS\system32\OpcEnum.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - D:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - D:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Swupdtmr - Unknown owner - c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
--
End of file - 13799 bytes
ComboFix:
ComboFix 08-05-29.1 - Jax 2008-06-01 13:59:16.7 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.870 [GMT -6:00]
Running from: C:\Documents and Settings\Jax\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\BM135a4420.xml
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\bxxluttg.dll
C:\WINDOWS\system32\linkyhhe.exe
C:\WINDOWS\system32\mxtdknlq.ini
C:\WINDOWS\system32\qlnkdtxm.dll
C:\WINDOWS\system32\qWDLkUvw.ini
C:\WINDOWS\system32\qWDLkUvw.ini2
C:\WINDOWS\system32\tsejjnai.dll
C:\WINDOWS\system32\wvUkLDWq.dll
.
((((((((((((((((((((((((( Files Created from 2008-05-01 to 2008-06-01 )))))))))))))))))))))))))))))))
.
2008-05-31 23:27 . 2008-05-31 23:30 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-05-31 22:49 . 2008-06-01 11:26 <DIR> d-------- C:\Program Files\Acceleration Software
2008-05-31 22:49 . 2008-05-31 22:49 <DIR> d-------- C:\Documents and Settings\Jax\Application Data\eAcceleration
2008-05-31 22:48 . 2008-05-31 22:49 <DIR> d-------- C:\Program Files\eAcceleration
2008-05-31 22:48 . 2008-06-01 11:25 <DIR> d-------- C:\Program Files\Common Files\eAcceleration
2008-05-31 22:48 . 2008-05-31 22:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\eAcceleration
2008-05-31 17:34 . 2007-12-10 13:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-05-31 17:34 . 2007-12-10 13:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-05-31 17:34 . 2008-02-01 11:55 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-05-31 17:34 . 2007-12-10 13:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-05-31 17:33 . 2008-05-31 17:33 <DIR> d-------- C:\Documents and Settings\Jax\Application Data\PC Tools
2008-05-31 16:04 . 2008-05-31 22:46 <DIR> d-------- C:\Documents and Settings\Jax\Application Data\Lavasoft
2008-05-31 14:15 . 2008-06-01 10:46 <DIR> d-------- C:\QUARANTINE
2008-05-31 14:04 . 2008-05-31 14:03 691,545 --a------ C:\WINDOWS\unins000.exe
2008-05-31 14:04 . 2008-05-31 14:04 2,543 --a------ C:\WINDOWS\unins000.dat
2008-05-31 14:01 . 2008-05-31 14:01 <DIR> d-------- C:\McAfee
2008-05-31 13:59 . 2008-05-31 13:59 <DIR> d-------- C:\Program Files\Common Files\Cisco Systems
2008-05-31 13:59 . 2008-05-31 13:59 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee
2008-05-31 13:59 . 2006-11-17 03:06 1,495,552 --a------ C:\WINDOWS\system32\epoPGPsdk.dll
2008-05-31 13:59 . 2006-11-30 08:50 168,776 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys
2008-05-31 13:59 . 2006-11-30 08:50 72,264 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys
2008-05-31 13:59 . 2006-11-30 08:50 64,360 --a------ C:\WINDOWS\system32\drivers\mfeapfk.sys
2008-05-31 13:59 . 2006-11-30 08:50 52,136 --a------ C:\WINDOWS\system32\drivers\mfetdik.sys
2008-05-31 13:59 . 2006-11-30 08:50 34,152 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys
2008-05-31 13:59 . 2006-11-17 03:06 280 --a------ C:\WINDOWS\system32\epoPGPsdk.dll.sig
2008-05-31 13:58 . 2008-05-31 13:59 <DIR> d-------- C:\Program Files\McAfee
2008-05-31 13:58 . 2008-05-31 13:58 <DIR> d-------- C:\Program Files\Common Files\McAfee
2008-05-31 00:01 . 2008-05-31 00:06 <DIR> d-------- C:\Program Files\Common Files\Macromedia
2008-05-30 23:41 . 2008-05-30 23:42 59,392 --a------ C:\WINDOWS\system32\cbXPhiIB.dll
2008-05-30 15:32 . 2008-05-30 15:32 682,232 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-05-29 15:33 . 2008-05-29 15:33 <DIR> d-------- C:\Documents and Settings\Jax\.netbeans-registration
2008-05-29 15:08 . 2003-09-03 16:28 67,200 --a------ C:\WINDOWS\system32\drivers\jusb.sys
2008-05-29 14:33 . 2003-09-05 10:08 245,852 --a------ C:\WINDOWS\system32\jusb.dll
2008-05-29 01:29 . 2008-06-01 13:51 <DIR> d-------- C:\Documents and Settings\Jax\Application Data\Azureus
2008-05-29 01:29 . 2008-05-29 01:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Azureus
2008-05-27 17:13 . 2008-05-27 17:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Amazon
2008-05-27 17:13 . 2008-05-27 17:13 <DIR> d-------- C:\Amazon Unbox
2008-05-27 17:12 . 2008-05-31 00:00 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2008-05-24 13:09 . 2008-05-24 13:09 <DIR> d-------- C:\Documents and Settings\Jax\Application Data\InterVideo
2008-05-22 13:06 . 2008-05-22 13:06 <DIR> d-------- C:\Program Files\The Weather Channel FW
2008-05-16 11:58 . 2008-05-16 11:58 12,632 --a------ C:\WINDOWS\system32\lsdelete.exe
2008-05-15 17:33 . 2008-05-15 17:33 <DIR> d-------- C:\WINDOWS\system32\cvirte
2008-05-12 08:26 . 2005-05-26 15:34 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll
2008-05-04 12:30 . 2008-05-04 12:30 <DIR> d-------- C:\Documents and Settings\Jax\Application Data\Webshots
2008-05-04 09:45 . 2008-05-04 09:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\packages
2008-05-04 07:21 . 2008-05-04 07:21 <DIR> d-------- C:\sj652
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-01 19:57 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-01 05:25 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-06-01 02:44 --------- d-----w C:\Program Files\VPNremote for Windows XP
2008-05-31 20:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-30 03:21 --------- d-----w C:\Documents and Settings\Jax\Application Data\Dev-Cpp
2008-05-26 20:57 --------- d-----w C:\Program Files\Google
2008-05-22 18:39 --------- d-----w C:\Documents and Settings\Jax\Application Data\AdobeUM
2008-05-22 16:39 --------- d-----w C:\Program Files\Common Files\Adobe
2008-05-16 02:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\National Instruments
2008-05-15 23:38 --------- d-----w C:\Program Files\Common Files\Merge Modules
2008-05-14 23:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-05-14 17:31 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-12 16:13 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-05-04 12:48 286,720 ------w C:\WINDOWS\Setup1.exe
2008-04-29 17:20 15,648 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys
2008-04-29 17:19 15,648 ----a-w C:\WINDOWS\system32\drivers\Awrtrd.sys
2008-04-29 17:19 12,960 ----a-w C:\WINDOWS\system32\drivers\Awrtpd.sys
2008-04-17 18:29 73,216 ------w C:\WINDOWS\ST6UNST.EXE
2008-04-10 19:10 --------- d-----w C:\Documents and Settings\Jax\Application Data\National Instruments
2008-04-06 21:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\VMware
2008-04-06 21:06 --------- d-----w C:\Program Files\SAPpc
2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-01 13:06 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2007-11-08 21:40 851,968 ----a-w C:\Program Files\internet explorer\plugins\libeay32.dll
2004-03-16 00:51 114,688 ----a-w C:\Program Files\internet explorer\plugins\LV71ActiveXControl.dll
2005-10-12 22:04 131,072 ----a-w C:\Program Files\internet explorer\plugins\LV80ActiveXControl.dll
2007-02-08 17:48 133,920 ----a-w C:\Program Files\internet explorer\plugins\LV82ActiveXControl.dll
2007-07-25 01:03 118,784 ----a-w C:\Program Files\internet explorer\plugins\LV85ActiveXControl.dll
2007-11-08 21:40 348,160 ----a-w C:\Program Files\internet explorer\plugins\msvcr71.dll
2007-11-08 21:40 950,272 ----a-w C:\Program Files\internet explorer\plugins\quickMksAx.dll
2007-11-08 21:40 159,744 ----a-w C:\Program Files\internet explorer\plugins\ssleay32.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{181F974D-BBE3-4801-9544-3AF1C05DF3BA}]
C:\WINDOWS\system32\mlJaaBRl.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{476FCA39-5318-4F72-B864-70185B670EA3}]
C:\WINDOWS\system32\khfFWpqO.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7D7DB869-3021-4CD2-AF0A-B3CAD75ECE31}]
2008-05-30 23:42 59392 --a------ C:\WINDOWS\system32\cbXPhiIB.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CF9132BF-79E1-4D62-B2B8-804B2F14096B}]
C:\WINDOWS\system32\qoMFXPFu.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Communicator"="D:\Program Files\Microsoft Office Communicator\Communicator.exe" [2005-05-12 13:40 4167376]
"SpybotSD TeaTimer"="D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
"DW6"="C:\PROGRA~1\THEWEA~1\Desktop\DesktopWeather.exe" [2008-05-14 13:41 785520]
"DAEMON Tools"="d:\Program Files\DAEMON Tools\daemon.exe" [2007-04-03 16:29 165784]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-05-01 14:04 7557120]
"nwiz"="nwiz.exe" [2006-05-01 14:04 1519616 C:\WINDOWS\system32\nwiz.exe]
"NVRotateSysTray"="C:\WINDOWS\system32\nvsysrot.dll" [2006-05-01 14:04 49152]
"PSQLLauncher"="C:\Program Files\Protector Suite QL\launcher.exe" [2006-05-05 19:36 30208]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-12-16 18:32 761945]
"THotkey"="C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe" [2006-01-05 15:02 352256]
"LtMoh"="C:\Program Files\ltmoh\Ltmoh.exe" [ ]
"NDSTray.exe"="NDSTray.exe" []
"Tvs"="C:\Program Files\Toshiba\Tvs\TvsTray.exe" [2005-11-30 14:25 73728]
"TFncKy"="TFncKy.exe" []
"TPSMain"="TPSMain.exe" [2005-05-31 23:00 282624 C:\WINDOWS\system32\TPSMain.exe]
"SmoothView"="C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2005-04-26 18:13 122880]
"Pinger"="c:\toshiba\ivp\ism\pinger.exe" [2005-03-17 19:37 151552]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-10-06 07:20 122940]
"Acrobat Assistant 7.0"="D:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2008-04-23 02:08 483328]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"SunJavaUpdateSched"="D:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 04:42 144784]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-01 15:22 3739648]
"MCUpdateExe"="C:\PROGRA~1\mcafee.com\agent\McUpdate.exe" [ ]
"ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.exe" [2006-11-30 08:50 112216]
"McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [2006-11-17 13:39 136768]
"SoftwareStation"="C:\Program Files\eAcceleration\Station\station.exe" [2008-04-15 17:30 173392]
"StopSignSsTsMon"="C:\Program Files\Acceleration Software\Anti-Virus\sstsmon0.dll" [2008-04-21 11:20 152976]
"StopSignSsSsMon"="C:\Program Files\Acceleration Software\Anti-Virus\ssssmon.dll" [2008-04-21 11:20 140696]
"webscan"="C:\Program Files\Acceleration Software\Anti-Virus\stopsignav.exe" [2008-05-14 17:06 763232]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"StopSignSsSsMon"="C:\Program Files\Acceleration Software\Anti-Virus\ssssmon.dll" [2008-04-21 11:20 140696]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Communicator"="D:\Program Files\Microsoft Office Communicator\Communicator.exe" [2005-05-12 13:40 4167376]
C:\Documents and Settings\Jax\Start Menu\Programs\Startup\
Webshots.lnk - D:\Program Files\Webshots\Launcher.exe [2008-05-04 12:30:34 45056]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2008-01-18 23:44:42 25214]
Amazon Unbox.lnk - D:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientSystemTray.exe [2007-07-11 17:25:20 97320]
RAMASST.lnk - C:\WINDOWS\system32\RAMASST.exe [2006-01-19 15:35:06 155648]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{7D7DB869-3021-4CD2-AF0A-B3CAD75ECE31}"= C:\WINDOWS\system32\cbXPhiIB.dll [2008-05-30 23:42 59392]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="C:\\WINDOWS\\system32\\Userinit.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cbXPhiIB]
cbXPhiIB.dll 2008-05-30 23:42 59392 C:\WINDOWS\system32\cbXPhiIB.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
psqlpwd.dll 2006-05-05 19:48 40448 C:\WINDOWS\system32\psqlpwd.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\TOSHIBA\\ivp\\NetInt\\Netint.exe"=
"C:\\TOSHIBA\\Ivp\\ISM\\pinger.exe"= C:\\TOSHIBA\\IVP\\ISM\\pinger.exe
"D:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"C:\\Program Files\\VPNremote for Windows XP\\VPNremote.exe"=
"D:\\Program Files\\Microsoft Office Communicator\\communicator.exe"=
"D:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main.exe"=
"D:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main_amdxp.exe"=
"D:\\Program Files\\Atari\\Neverwinter Nights 2\\nwupdate.exe"=
"D:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2server.exe"=
"D:\\Program Files\\Azureus\\Azureus.exe"=
"D:\\Program Files\\National Instruments\\LabVIEW 8.0\\LabVIEW.exe"=
"C:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=
R0 avipsec;Avaya IPSEC Driver;C:\WINDOWS\system32\drivers\avipsec.sys [2005-09-13 16:50]
R0 KR10N;KR10N;C:\WINDOWS\system32\drivers\KR10N.sys [2005-01-12 02:05]
R1 VProtocol;AVAYA VPNet VProtocol;C:\WINDOWS\system32\DRIVERS\vproto2k.sys [2005-09-13 16:50]
R2 AvService;Avaya VPN Service;C:\Program Files\VPNremote for Windows XP\AvVpnService.exe [2005-09-13 16:50]
R2 cvintdrv;cvintdrv;C:\WINDOWS\system32\drivers\cvintdrv.sys [2004-07-26 10:00]
R2 FdRedir;FdRedir;C:\Program Files\Common Files\Protector Suite QL\Drivers\FdRedir.sys [2006-05-05 20:00]
R2 FileDisk2;FileDisk Protector Kernel Driver;C:\Program Files\Common Files\Protector Suite QL\Drivers\filedisk.sys [2006-05-05 19:59]
R2 IOPort;IOPort;C:\WINDOWS\system32\DRIVERS\IOPORT.SYS [2001-03-01 01:15]
R2 mxssvr;NI Configuration Manager;"D:\Program Files\National Instruments\MAX\nimxs.exe" [2007-03-08 17:29]
R2 NITaggerService;National Instruments Variable Engine;"D:\Program Files\National Instruments\Shared\Tagger\tagsrv.exe" [2007-07-23 09:29]
R2 smihlp;SMI helper driver;C:\Program Files\Protector Suite QL\smihlp.sys [2006-05-05 19:33]
R3 ndisva;Avaya VPNet Virtual Adapter Driver;C:\WINDOWS\system32\DRIVERS\vadapter.sys [2005-09-13 16:50]
R3 TcUsb;TC USB Kernel Driver;C:\WINDOWS\system32\Drivers\tcusb.sys [2006-05-05 19:12]
R3 tosrfec;Bluetooth ACPI from TOSHIBA;C:\WINDOWS\system32\DRIVERS\tosrfec.sys [2005-09-09 16:47]
S2 eac_notifysvc;eAcceleration Notification Service;"C:\PROGRA~1\EACCEL~1\FRAMEW~1\eac_svc.exe" [2008-03-24 17:46]
S2 eac_productsvc;eAcceleration Product Manager Service;"C:\PROGRA~1\EACCEL~1\FRAMEW~1\eac_productsvc.exe" [2008-03-24 17:46]
S3 JUSB;JUSB.Sys Java USB Driver;C:\WINDOWS\system32\drivers\JUSB.sys [2003-09-03 16:28]
S3 krdpdre;krdpdre;C:\DOCUME~1\Jax\LOCALS~1\Temp\krdpdre.sys []
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\Autorun.exe
.
**************************************************************************
disk not found C:\
please note that you need administrator rights to perform deep scan
disk not found C:\
please note that you need administrator rights to perform deep scan
disk not found C:\
please note that you need administrator rights to perform deep scan
disk not found C:\
please note that you need administrator rights to perform deep scan
disk not found C:\
please note that you need administrator rights to perform deep scan
disk not found C:\
please note that you need administrator rights to perform deep scan
disk not found C:\
please note that you need administrator rights to perform deep scan
disk not found C:\
please note that you need administrator rights to perform deep scan
disk not found C:\
please note that you need administrator rights to perform deep scan
disk not found C:\
please note that you need administrator rights to perform deep scan
disk not found C:\
please note that you need administrator rights to perform deep scan
disk not found C:\
please note that you need administrator rights to perform deep scan
disk not found C:\
please note that you need administrator rights to perform deep scan
disk not found C:\
please note that you need administrator rights to perform deep scan
disk not found C:\
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
disk not found C:\
disk not found C:\
disk not found C:\
disk not found C:\
disk not found C:\
disk not found C:\
disk not found C:\
disk not found C:\
disk not found C:\
disk not found C:\
disk not found C:\
disk not found C:\
disk not found C:\
disk not found C:\
disk not found C:\
scan completed successfully
hidden files:
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\AvayaGina.dll
-> C:\WINDOWS\system32\cbXPhiIB.dll
PROCESS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\system32\nview.dll
.
------------------------ Other Running Processes ------------------------
.
D:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
D:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\system32\lkcitdl.exe
C:\WINDOWS\system32\lkads.exe
C:\WINDOWS\system32\lktsrv.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
D:\Program Files\National Instruments\Shared\Security\nidmsrv.exe
C:\Program Files\McAfee\Common Framework\naPrdMgr.exe
C:\WINDOWS\system32\nisvcloc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\TOSHIBA\IVP\swupdate\swupdtmr.exe
C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Synaptics\SynTP\Toshiba.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\Protector Suite QL\psqltray.exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\McAfee\Common Framework\Mctray.exe
C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe
D:\Program Files\Webshots\Webshots.scr
.
**************************************************************************
.
Completion time: 2008-06-01 14:09:33 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-01 20:09:26
ComboFix2.txt 2008-06-01 17:24:21
ComboFix3.txt 2008-06-01 17:14:39
ComboFix4.txt 2008-06-01 17:11:55
ComboFix5.txt 2008-06-01 16:43:35
Pre-Run: 500,031,488 bytes free
Post-Run: 494,051,328 bytes free
304 --- E O F --- 2008-06-01 17:00:45
This is not the full KAV log. It wouldn't fit into one post. I have the full one if you would like that posted.
KAV:
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Monday, June 02, 2008 4:19:16 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 2/06/2008
Kaspersky Anti-Virus database records: 821972
-------------------------------------------------------------------------------
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - My Computer:
Scan Statistics:
Total number of scanned objects: 105274
Number of viruses found: 11
Number of infected objects: 32
Number of suspicious objects: 0
Duration of the scan process: 01:48:28
Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\Jax\Local Settings\Temporary Internet Files\Content.IE5\4XBFNJWX\kb516107[1] Infected: not-a-virus:AdWare.Win32.Virtumonde.wpv skipped
C:\Documents and Settings\Jax\Local Settings\Temporary Internet Files\Content.IE5\F9GXJTQ3\css4[1] Infected: not-a-virus:AdWare.Win32.Virtumonde.wti skipped
C:\Documents and Settings\Jax\Local Settings\Temporary Internet Files\Content.IE5\F9GXJTQ3\kb456456[1] Infected: not-a-virus:AdWare.Win32.Virtumonde.wpu skipped
C:\RECYCLER\S-1-5-21-2340103986-951937984-3967435536-1005\Dc1\C\WINDOWS\system32\bxxluttg.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.wpv skipped
C:\RECYCLER\S-1-5-21-2340103986-951937984-3967435536-1005\Dc1\C\WINDOWS\system32\meycbjmm.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.wpv skipped
C:\RECYCLER\S-1-5-21-2340103986-951937984-3967435536-1005\Dc1\C\WINDOWS\system32\pwoprsic.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.wpu skipped
C:\RECYCLER\S-1-5-21-2340103986-951937984-3967435536-1005\Dc1\C\WINDOWS\system32\qlnkdtxm.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.wpu skipped
C:\System Volume Information\_restore{BB53A2CB-DF0B-41A1-A428-20CF4CC18FC0}\RP2\A0000119.dll Infected: Trojan-Downloader.Win32.ConHook.pr skipped
C:\System Volume Information\_restore{BB53A2CB-DF0B-41A1-A428-20CF4CC18FC0}\RP2\A0000120.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.wpu skipped
C:\System Volume Information\_restore{BB53A2CB-DF0B-41A1-A428-20CF4CC18FC0}\RP2\A0000121.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.wpv skipped
C:\System Volume Information\_restore{BB53A2CB-DF0B-41A1-A428-20CF4CC18FC0}\RP2\A0000122.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.wpu skipped
C:\System Volume Information\_restore{BB53A2CB-DF0B-41A1-A428-20CF4CC18FC0}\RP2\A0000123.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.wpv skipped
C:\System Volume Information\_restore{BB53A2CB-DF0B-41A1-A428-20CF4CC18FC0}\RP2\A0000125.dll Infected: Trojan.Win32.Monder.le skipped
C:\System Volume Information\_restore{BB53A2CB-DF0B-41A1-A428-20CF4CC18FC0}\RP2\A0000126.dll Infected: Trojan-Downloader.Win32.ConHook.pr skipped
C:\System Volume Information\_restore{BB53A2CB-DF0B-41A1-A428-20CF4CC18FC0}\RP2\A0000127.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.wpu skipped
C:\System Volume Information\_restore{BB53A2CB-DF0B-41A1-A428-20CF4CC18FC0}\RP2\A0000129.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.wpv skipped
C:\System Volume Information\_restore{BB53A2CB-DF0B-41A1-A428-20CF4CC18FC0}\RP4\A0002278.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.wpv skipped
C:\System Volume Information\_restore{BB53A2CB-DF0B-41A1-A428-20CF4CC18FC0}\RP4\A0002280.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.wpu skipped
C:\WINDOWS\system32\cbXPhiIB.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.vqj skipped
C:\WINDOWS\system32\quercyjt.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.wpu skipped
D:\Documents\TravelDrive\DivXPro511Adware.exe/stream/data0019 Infected: not-a-virus:AdWare.Win32.Gator.3202 skipped
D:\Documents\TravelDrive\DivXPro511Adware.exe/stream Infected: not-a-virus:AdWare.Win32.Gator.3202 skipped
D:\Documents\TravelDrive\DivXPro511Adware.exe NSIS: infected - 2 skipped
D:\Documents\VNC\Tight_VNC\tightvnc-1.2.9-setup.exe/data0002 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.h skipped
D:\Documents\VNC\Tight_VNC\tightvnc-1.2.9-setup.exe/data0003 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.b skipped
D:\Documents\VNC\Tight_VNC\tightvnc-1.2.9-setup.exe Inno: infected - 2 skipped
D:\Documents\VNC\Tight_VNC\tightvnc-1.3.8-setup.exe/data0003 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.1370 skipped
D:\Documents\VNC\Tight_VNC\tightvnc-1.3.8-setup.exe Inno: infected - 1 skipped
D:\Documents\VNC\Tight_VNC\VNCHooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.b skipped
D:\Documents\VNC\Ultra_VNC\UltraVNC-101-Setup.exe/file130 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.e skipped
D:\Documents\VNC\Ultra_VNC\UltraVNC-101-Setup.exe/file131 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.e skipped
D:\Documents\VNC\Ultra_VNC\UltraVNC-101-Setup.exe Inno: infected - 2 skipped
These logs were generated ComboFix first, KAV Second, and HJT last. My KAV report won't fit into one post. I have posted part of it. I have the full one if you would like that posted.
Here are my logs:
HJT:
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 4:30:22 PM, on 6/2/2008
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16640)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
D:\Program Files\Windows Defender\MsMpEng.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
D:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
D:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe
C:\Program Files\VPNremote for Windows XP\AvVpnService.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\system32\lkcitdl.exe
C:\WINDOWS\system32\lkads.exe
C:\WINDOWS\system32\lktsrv.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\WINDOWS\Explorer.EXE
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
D:\Program Files\National Instruments\MAX\nimxs.exe
C:\Program Files\McAfee\Common Framework\naPrdMgr.exe
D:\Program Files\National Instruments\Shared\Security\nidmsrv.exe
C:\WINDOWS\system32\nisvcloc.exe
D:\Program Files\National Instruments\Shared\Tagger\tagsrv.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\System32\dmadmin.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Synaptics\SynTP\Toshiba.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\Toshiba\Tvs\TvsTray.exe
C:\Program Files\Protector Suite QL\psqltray.exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\WINDOWS\system32\TPSMain.exe
C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
C:\toshiba\ivp\ism\pinger.exe
C:\WINDOWS\System32\DLA\DLACTRLW.EXE
C:\WINDOWS\system32\TPSBattM.exe
D:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe
D:\Program Files\Java\jre1.6.0_04\bin\jusched.exe
C:\Program Files\Google\Google Talk\googletalk.exe
C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE
C:\Program Files\McAfee\Common Framework\UdaterUI.exe
C:\Program Files\McAfee\Common Framework\McTray.exe
C:\PROGRA~1\THEWEA~1\Desktop\DesktopWeather.exe
D:\Program Files\DAEMON Tools\daemon.exe
D:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientSystemTray.exe
C:\WINDOWS\system32\RAMASST.exe
D:\Program Files\Webshots\webshots.scr
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\wscntfy.exe
C:\WINDOWS\system32\rundll32.exe
C:\PROGRA~1\MOZILL~1\FIREFOX.EXE
C:\Program Files\Internet Explorer\iexplore.exe
C:\WINDOWS\system32\taskmgr.exe
C:\WINDOWS\system32\notepad.exe
C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\system32\wbem\wmiprvse.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.toshibadirect.com/dpdstart
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://www.toshibadirect.com/dpdstart
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = co.proxy.avaya.com:8000
F2 - REG:system.ini: UserInit=C:\WINDOWS\system32\Userinit.exe
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /keeploaded /nodetect
O4 - HKLM\..\Run: [NVRotateSysTray] rundll32.exe C:\WINDOWS\system32\nvsysrot.dll,Enable
O4 - HKLM\..\Run: [PSQLLauncher] "C:\Program Files\Protector Suite QL\launcher.exe" /startup
O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [THotkey] C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe
O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
O4 - HKLM\..\Run: [Tvs] C:\Program Files\Toshiba\Tvs\TvsTray.exe
O4 - HKLM\..\Run: [TFncKy] TFncKy.exe
O4 - HKLM\..\Run: [TPSMain] TPSMain.exe
O4 - HKLM\..\Run: [SmoothView] C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe
O4 - HKLM\..\Run: [Pinger] c:\toshiba\ivp\ism\pinger.exe /run
O4 - HKLM\..\Run: [DLA] C:\WINDOWS\System32\DLA\DLACTRLW.EXE
O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "D:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"
O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "D:\Program Files\Java\jre1.6.0_04\bin\jusched.exe"
O4 - HKLM\..\Run: [googletalk] C:\Program Files\Google\Google Talk\googletalk.exe /autostart
O4 - HKLM\..\Run: [MCUpdateExe] C:\PROGRA~1\mcafee.com\agent\McUpdate.exe
O4 - HKLM\..\Run: [ShStatEXE] "C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.EXE" /STANDALONE
O4 - HKLM\..\Run: [McAfeeUpdaterUI] "C:\Program Files\McAfee\Common Framework\UdaterUI.exe" /StartedFromRunKey
O4 - HKLM\..\Run: [SoftwareStation] "C:\Program Files\eAcceleration\Station\station.exe" /b Startup
O4 - HKLM\..\Run: [StopSignSsTsMon] Rundll32.exe "C:\Program Files\Acceleration Software\Anti-Virus\sstsmon0.dll",VerifyStatus
O4 - HKLM\..\Run: [StopSignSsSsMon] Rundll32.exe "C:\Program Files\Acceleration Software\Anti-Virus\ssssmon.dll",VerifyStatus
O4 - HKLM\..\Run: [webscan] "C:\Program Files\Acceleration Software\Anti-Virus\stopsignav.exe" -k
O4 - HKLM\..\Run: [Windows Defender] "D:\Program Files\Windows Defender\MSASCui.exe" -hide
O4 - HKLM\..\Run: [BM135a4420] Rundll32.exe "C:\WINDOWS\system32\wtolcuyb.dll",s
O4 - HKLM\..\RunOnce: [StopSignSsSsMon] Rundll32.exe "C:\Program Files\Acceleration Software\Anti-Virus\ssssmon.dll",VerifyStatus /ro
O4 - HKCU\..\Run: [Communicator] "D:\Program Files\Microsoft Office Communicator\Communicator.exe"
O4 - HKCU\..\Run: [SpybotSD TeaTimer] D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [DW6] "C:\PROGRA~1\THEWEA~1\Desktop\DesktopWeather.exe"
O4 - HKCU\..\Run: [DAEMON Tools] "d:\Program Files\DAEMON Tools\daemon.exe" -lang 1033
O4 - HKUS\S-1-5-19\..\Run: [Communicator] "D:\Program Files\Microsoft Office Communicator\Communicator.exe" (User 'LOCAL SERVICE')
O4 - HKUS\S-1-5-20\..\Run: [Communicator] "D:\Program Files\Microsoft Office Communicator\Communicator.exe" (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [Communicator] "D:\Program Files\Microsoft Office Communicator\Communicator.exe" (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [Communicator] "D:\Program Files\Microsoft Office Communicator\Communicator.exe" (User 'Default user')
O4 - Startup: Webshots.lnk = D:\Program Files\Webshots\Launcher.exe
O4 - Global Startup: Adobe Acrobat Speed Launcher.lnk = ?
O4 - Global Startup: Amazon Unbox.lnk = ?
O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
O8 - Extra context menu item: Convert link target to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert link target to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert selected links to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O8 - Extra context menu item: Convert selected links to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Convert selection to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert selection to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: Convert to Adobe PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Convert to existing PDF - res://D:\Program Files\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: E&xport to Microsoft Excel - res://D:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - D:\Program Files\Java\jre1.6.0_04\bin\ssv.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\PROGRA~1\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\PROGRA~1\SPYBOT~1\SDHelper.dll
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O14 - IERESET.INF: START_PAGE_URL=http://www.toshibadirect.com/dpdstart
O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
O16 - DPF: {338095E4-1806-4BA3-AB51-38A3179200E9} (QuickMksAxCtl Class) - http://127.0.0.1:8308/ui/plugin/vmwa...-win32-x86.cab
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - D:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Amazon Unbox Video Service (ADVService) - Amazon.com - D:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe
O23 - Service: Avaya VPN Service (AvService) - Unknown owner - C:\Program Files\VPNremote for Windows XP\AvVpnService.exe
O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\system32\DVDRAMSV.exe
O23 - Service: eAcceleration Notification Service (eac_notifysvc) - eAcceleration Corp - C:\PROGRA~1\EACCEL~1\FRAMEW~1\eac_svc.exe
O23 - Service: eAcceleration Product Manager Service (eac_productsvc) - eAcceleration Corp - C:\PROGRA~1\EACCEL~1\FRAMEW~1\eac_productsvc.exe
O23 - Service: Imapi Helper - Alex Feinman - D:\Program Files\ISO Recorder\ImapiHelper.exe
O23 - Service: Lookout Citadel Server (LkCitadelServer) - National Instruments, Inc. - C:\WINDOWS\system32\lkcitdl.exe
O23 - Service: National Instruments PSP Server Locator (lkClassAds) - National Instruments Corporation - C:\WINDOWS\system32\lkads.exe
O23 - Service: National Instruments Time Synchronization (lkTimeSync) - National Instruments Corporation - C:\WINDOWS\system32\lktsrv.exe
O23 - Service: McAfee Framework Service (McAfeeFramework) - McAfee, Inc. - C:\Program Files\McAfee\Common Framework\FrameworkService.exe
O23 - Service: McAfee McShield (McShield) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
O23 - Service: McAfee Task Manager (McTaskManager) - McAfee, Inc. - C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
O23 - Service: NI Configuration Manager (mxssvr) - National Instruments Corporation - D:\Program Files\National Instruments\MAX\nimxs.exe
O23 - Service: National Instruments Domain Service (NIDomainService) - National Instruments Corporation - D:\Program Files\National Instruments\Shared\Security\nidmsrv.exe
O23 - Service: NILM License Manager - Macrovision Corporation - D:\Program Files\National Instruments\Shared\License Manager\Bin\lmgrd.exe
O23 - Service: NI Service Locator (niSvcLoc) - National Instruments Corp. - C:\WINDOWS\system32\nisvcloc.exe
O23 - Service: National Instruments Variable Engine (NITaggerService) - National Instruments Corporation - D:\Program Files\National Instruments\Shared\Tagger\tagsrv.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: OpcEnum - OPC Foundation - C:\WINDOWS\system32\OpcEnum.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - D:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - D:\Program Files\Spyware Doctor\pctsSvc.exe
O23 - Service: Swupdtmr - Unknown owner - c:\TOSHIBA\IVP\swupdate\swupdtmr.exe
O23 - Service: TOSHIBA Application Service (TAPPSRV) - TOSHIBA Corp. - C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
--
End of file - 13799 bytes
ComboFix:
ComboFix 08-05-29.1 - Jax 2008-06-01 13:59:16.7 - NTFSx86
Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.870 [GMT -6:00]
Running from: C:\Documents and Settings\Jax\Desktop\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\BM135a4420.xml
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\bxxluttg.dll
C:\WINDOWS\system32\linkyhhe.exe
C:\WINDOWS\system32\mxtdknlq.ini
C:\WINDOWS\system32\qlnkdtxm.dll
C:\WINDOWS\system32\qWDLkUvw.ini
C:\WINDOWS\system32\qWDLkUvw.ini2
C:\WINDOWS\system32\tsejjnai.dll
C:\WINDOWS\system32\wvUkLDWq.dll
.
((((((((((((((((((((((((( Files Created from 2008-05-01 to 2008-06-01 )))))))))))))))))))))))))))))))
.
2008-05-31 23:27 . 2008-05-31 23:30 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-05-31 22:49 . 2008-06-01 11:26 <DIR> d-------- C:\Program Files\Acceleration Software
2008-05-31 22:49 . 2008-05-31 22:49 <DIR> d-------- C:\Documents and Settings\Jax\Application Data\eAcceleration
2008-05-31 22:48 . 2008-05-31 22:49 <DIR> d-------- C:\Program Files\eAcceleration
2008-05-31 22:48 . 2008-06-01 11:25 <DIR> d-------- C:\Program Files\Common Files\eAcceleration
2008-05-31 22:48 . 2008-05-31 22:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\eAcceleration
2008-05-31 17:34 . 2007-12-10 13:53 81,288 --a------ C:\WINDOWS\system32\drivers\iksyssec.sys
2008-05-31 17:34 . 2007-12-10 13:53 66,952 --a------ C:\WINDOWS\system32\drivers\iksysflt.sys
2008-05-31 17:34 . 2008-02-01 11:55 42,376 --a------ C:\WINDOWS\system32\drivers\ikfilesec.sys
2008-05-31 17:34 . 2007-12-10 13:53 29,576 --a------ C:\WINDOWS\system32\drivers\kcom.sys
2008-05-31 17:33 . 2008-05-31 17:33 <DIR> d-------- C:\Documents and Settings\Jax\Application Data\PC Tools
2008-05-31 16:04 . 2008-05-31 22:46 <DIR> d-------- C:\Documents and Settings\Jax\Application Data\Lavasoft
2008-05-31 14:15 . 2008-06-01 10:46 <DIR> d-------- C:\QUARANTINE
2008-05-31 14:04 . 2008-05-31 14:03 691,545 --a------ C:\WINDOWS\unins000.exe
2008-05-31 14:04 . 2008-05-31 14:04 2,543 --a------ C:\WINDOWS\unins000.dat
2008-05-31 14:01 . 2008-05-31 14:01 <DIR> d-------- C:\McAfee
2008-05-31 13:59 . 2008-05-31 13:59 <DIR> d-------- C:\Program Files\Common Files\Cisco Systems
2008-05-31 13:59 . 2008-05-31 13:59 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee
2008-05-31 13:59 . 2006-11-17 03:06 1,495,552 --a------ C:\WINDOWS\system32\epoPGPsdk.dll
2008-05-31 13:59 . 2006-11-30 08:50 168,776 --a------ C:\WINDOWS\system32\drivers\mfehidk.sys
2008-05-31 13:59 . 2006-11-30 08:50 72,264 --a------ C:\WINDOWS\system32\drivers\mfeavfk.sys
2008-05-31 13:59 . 2006-11-30 08:50 64,360 --a------ C:\WINDOWS\system32\drivers\mfeapfk.sys
2008-05-31 13:59 . 2006-11-30 08:50 52,136 --a------ C:\WINDOWS\system32\drivers\mfetdik.sys
2008-05-31 13:59 . 2006-11-30 08:50 34,152 --a------ C:\WINDOWS\system32\drivers\mfebopk.sys
2008-05-31 13:59 . 2006-11-17 03:06 280 --a------ C:\WINDOWS\system32\epoPGPsdk.dll.sig
2008-05-31 13:58 . 2008-05-31 13:59 <DIR> d-------- C:\Program Files\McAfee
2008-05-31 13:58 . 2008-05-31 13:58 <DIR> d-------- C:\Program Files\Common Files\McAfee
2008-05-31 00:01 . 2008-05-31 00:06 <DIR> d-------- C:\Program Files\Common Files\Macromedia
2008-05-30 23:41 . 2008-05-30 23:42 59,392 --a------ C:\WINDOWS\system32\cbXPhiIB.dll
2008-05-30 15:32 . 2008-05-30 15:32 682,232 --a------ C:\WINDOWS\system32\drivers\sptd.sys
2008-05-29 15:33 . 2008-05-29 15:33 <DIR> d-------- C:\Documents and Settings\Jax\.netbeans-registration
2008-05-29 15:08 . 2003-09-03 16:28 67,200 --a------ C:\WINDOWS\system32\drivers\jusb.sys
2008-05-29 14:33 . 2003-09-05 10:08 245,852 --a------ C:\WINDOWS\system32\jusb.dll
2008-05-29 01:29 . 2008-06-01 13:51 <DIR> d-------- C:\Documents and Settings\Jax\Application Data\Azureus
2008-05-29 01:29 . 2008-05-29 01:29 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Azureus
2008-05-27 17:13 . 2008-05-27 17:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Amazon
2008-05-27 17:13 . 2008-05-27 17:13 <DIR> d-------- C:\Amazon Unbox
2008-05-27 17:12 . 2008-05-31 00:00 <DIR> d-------- C:\WINDOWS\Downloaded Installations
2008-05-24 13:09 . 2008-05-24 13:09 <DIR> d-------- C:\Documents and Settings\Jax\Application Data\InterVideo
2008-05-22 13:06 . 2008-05-22 13:06 <DIR> d-------- C:\Program Files\The Weather Channel FW
2008-05-16 11:58 . 2008-05-16 11:58 12,632 --a------ C:\WINDOWS\system32\lsdelete.exe
2008-05-15 17:33 . 2008-05-15 17:33 <DIR> d-------- C:\WINDOWS\system32\cvirte
2008-05-12 08:26 . 2005-05-26 15:34 2,297,552 --a------ C:\WINDOWS\system32\d3dx9_26.dll
2008-05-04 12:30 . 2008-05-04 12:30 <DIR> d-------- C:\Documents and Settings\Jax\Application Data\Webshots
2008-05-04 09:45 . 2008-05-04 09:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\packages
2008-05-04 07:21 . 2008-05-04 07:21 <DIR> d-------- C:\sj652
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-01 19:57 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-01 05:25 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
2008-06-01 02:44 --------- d-----w C:\Program Files\VPNremote for Windows XP
2008-05-31 20:11 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-05-30 03:21 --------- d-----w C:\Documents and Settings\Jax\Application Data\Dev-Cpp
2008-05-26 20:57 --------- d-----w C:\Program Files\Google
2008-05-22 18:39 --------- d-----w C:\Documents and Settings\Jax\Application Data\AdobeUM
2008-05-22 16:39 --------- d-----w C:\Program Files\Common Files\Adobe
2008-05-16 02:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\National Instruments
2008-05-15 23:38 --------- d-----w C:\Program Files\Common Files\Merge Modules
2008-05-14 23:33 --------- d-----w C:\Documents and Settings\All Users\Application Data\Microsoft Help
2008-05-14 17:31 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-05-12 16:13 98,304 ----a-w C:\WINDOWS\system32\CmdLineExt.dll
2008-05-04 12:48 286,720 ------w C:\WINDOWS\Setup1.exe
2008-04-29 17:20 15,648 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys
2008-04-29 17:19 15,648 ----a-w C:\WINDOWS\system32\drivers\Awrtrd.sys
2008-04-29 17:19 12,960 ----a-w C:\WINDOWS\system32\drivers\Awrtpd.sys
2008-04-17 18:29 73,216 ------w C:\WINDOWS\ST6UNST.EXE
2008-04-10 19:10 --------- d-----w C:\Documents and Settings\Jax\Application Data\National Instruments
2008-04-06 21:12 --------- d-----w C:\Documents and Settings\All Users\Application Data\VMware
2008-04-06 21:06 --------- d-----w C:\Program Files\SAPpc
2008-03-27 08:12 151,583 ----a-w C:\WINDOWS\system32\msjint40.dll
2008-03-19 09:47 1,845,248 ----a-w C:\WINDOWS\system32\win32k.sys
2008-03-01 13:06 826,368 ----a-w C:\WINDOWS\system32\wininet.dll
2007-11-08 21:40 851,968 ----a-w C:\Program Files\internet explorer\plugins\libeay32.dll
2004-03-16 00:51 114,688 ----a-w C:\Program Files\internet explorer\plugins\LV71ActiveXControl.dll
2005-10-12 22:04 131,072 ----a-w C:\Program Files\internet explorer\plugins\LV80ActiveXControl.dll
2007-02-08 17:48 133,920 ----a-w C:\Program Files\internet explorer\plugins\LV82ActiveXControl.dll
2007-07-25 01:03 118,784 ----a-w C:\Program Files\internet explorer\plugins\LV85ActiveXControl.dll
2007-11-08 21:40 348,160 ----a-w C:\Program Files\internet explorer\plugins\msvcr71.dll
2007-11-08 21:40 950,272 ----a-w C:\Program Files\internet explorer\plugins\quickMksAx.dll
2007-11-08 21:40 159,744 ----a-w C:\Program Files\internet explorer\plugins\ssleay32.dll
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{181F974D-BBE3-4801-9544-3AF1C05DF3BA}]
C:\WINDOWS\system32\mlJaaBRl.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{476FCA39-5318-4F72-B864-70185B670EA3}]
C:\WINDOWS\system32\khfFWpqO.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7D7DB869-3021-4CD2-AF0A-B3CAD75ECE31}]
2008-05-30 23:42 59392 --a------ C:\WINDOWS\system32\cbXPhiIB.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{CF9132BF-79E1-4D62-B2B8-804B2F14096B}]
C:\WINDOWS\system32\qoMFXPFu.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Communicator"="D:\Program Files\Microsoft Office Communicator\Communicator.exe" [2005-05-12 13:40 4167376]
"SpybotSD TeaTimer"="D:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
"DW6"="C:\PROGRA~1\THEWEA~1\Desktop\DesktopWeather.exe" [2008-05-14 13:41 785520]
"DAEMON Tools"="d:\Program Files\DAEMON Tools\daemon.exe" [2007-04-03 16:29 165784]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"="C:\WINDOWS\system32\NvCpl.dll" [2006-05-01 14:04 7557120]
"nwiz"="nwiz.exe" [2006-05-01 14:04 1519616 C:\WINDOWS\system32\nwiz.exe]
"NVRotateSysTray"="C:\WINDOWS\system32\nvsysrot.dll" [2006-05-01 14:04 49152]
"PSQLLauncher"="C:\Program Files\Protector Suite QL\launcher.exe" [2006-05-05 19:36 30208]
"SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2005-12-16 18:32 761945]
"THotkey"="C:\Program Files\Toshiba\Toshiba Applet\thotkey.exe" [2006-01-05 15:02 352256]
"LtMoh"="C:\Program Files\ltmoh\Ltmoh.exe" [ ]
"NDSTray.exe"="NDSTray.exe" []
"Tvs"="C:\Program Files\Toshiba\Tvs\TvsTray.exe" [2005-11-30 14:25 73728]
"TFncKy"="TFncKy.exe" []
"TPSMain"="TPSMain.exe" [2005-05-31 23:00 282624 C:\WINDOWS\system32\TPSMain.exe]
"SmoothView"="C:\Program Files\TOSHIBA\TOSHIBA Zooming Utility\SmoothView.exe" [2005-04-26 18:13 122880]
"Pinger"="c:\toshiba\ivp\ism\pinger.exe" [2005-03-17 19:37 151552]
"DLA"="C:\WINDOWS\System32\DLA\DLACTRLW.EXE" [2005-10-06 07:20 122940]
"Acrobat Assistant 7.0"="D:\Program Files\Adobe\Acrobat 7.0\Distillr\Acrotray.exe" [2008-04-23 02:08 483328]
"NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 11:50 155648]
"SunJavaUpdateSched"="D:\Program Files\Java\jre1.6.0_04\bin\jusched.exe" [2007-12-14 04:42 144784]
"googletalk"="C:\Program Files\Google\Google Talk\googletalk.exe" [2007-01-01 15:22 3739648]
"MCUpdateExe"="C:\PROGRA~1\mcafee.com\agent\McUpdate.exe" [ ]
"ShStatEXE"="C:\Program Files\McAfee\VirusScan Enterprise\SHSTAT.exe" [2006-11-30 08:50 112216]
"McAfeeUpdaterUI"="C:\Program Files\McAfee\Common Framework\UdaterUI.exe" [2006-11-17 13:39 136768]
"SoftwareStation"="C:\Program Files\eAcceleration\Station\station.exe" [2008-04-15 17:30 173392]
"StopSignSsTsMon"="C:\Program Files\Acceleration Software\Anti-Virus\sstsmon0.dll" [2008-04-21 11:20 152976]
"StopSignSsSsMon"="C:\Program Files\Acceleration Software\Anti-Virus\ssssmon.dll" [2008-04-21 11:20 140696]
"webscan"="C:\Program Files\Acceleration Software\Anti-Virus\stopsignav.exe" [2008-05-14 17:06 763232]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce]
"StopSignSsSsMon"="C:\Program Files\Acceleration Software\Anti-Virus\ssssmon.dll" [2008-04-21 11:20 140696]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"Communicator"="D:\Program Files\Microsoft Office Communicator\Communicator.exe" [2005-05-12 13:40 4167376]
C:\Documents and Settings\Jax\Start Menu\Programs\Startup\
Webshots.lnk - D:\Program Files\Webshots\Launcher.exe [2008-05-04 12:30:34 45056]
C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-7760-000000000002}\SC_Acrobat.exe [2008-01-18 23:44:42 25214]
Amazon Unbox.lnk - D:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientSystemTray.exe [2007-07-11 17:25:20 97320]
RAMASST.lnk - C:\WINDOWS\system32\RAMASST.exe [2006-01-19 15:35:06 155648]
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{7D7DB869-3021-4CD2-AF0A-B3CAD75ECE31}"= C:\WINDOWS\system32\cbXPhiIB.dll [2008-05-30 23:42 59392]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="C:\\WINDOWS\\system32\\Userinit.exe"
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\cbXPhiIB]
cbXPhiIB.dll 2008-05-30 23:42 59392 C:\WINDOWS\system32\cbXPhiIB.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\psfus]
psqlpwd.dll 2006-05-05 19:48 40448 C:\WINDOWS\system32\psqlpwd.dll
[HKEY_LOCAL_MACHINE\software\microsoft\security center]
"AntiVirusOverride"=dword:00000001
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\TOSHIBA\\ivp\\NetInt\\Netint.exe"=
"C:\\TOSHIBA\\Ivp\\ISM\\pinger.exe"= C:\\TOSHIBA\\IVP\\ISM\\pinger.exe
"D:\\Program Files\\Microsoft Office\\Office12\\OUTLOOK.EXE"=
"C:\\Program Files\\Google\\Google Talk\\googletalk.exe"=
"C:\\Program Files\\VPNremote for Windows XP\\VPNremote.exe"=
"D:\\Program Files\\Microsoft Office Communicator\\communicator.exe"=
"D:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main.exe"=
"D:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2main_amdxp.exe"=
"D:\\Program Files\\Atari\\Neverwinter Nights 2\\nwupdate.exe"=
"D:\\Program Files\\Atari\\Neverwinter Nights 2\\nwn2server.exe"=
"D:\\Program Files\\Azureus\\Azureus.exe"=
"D:\\Program Files\\National Instruments\\LabVIEW 8.0\\LabVIEW.exe"=
"C:\\Program Files\\McAfee\\Common Framework\\FrameworkService.exe"=
R0 avipsec;Avaya IPSEC Driver;C:\WINDOWS\system32\drivers\avipsec.sys [2005-09-13 16:50]
R0 KR10N;KR10N;C:\WINDOWS\system32\drivers\KR10N.sys [2005-01-12 02:05]
R1 VProtocol;AVAYA VPNet VProtocol;C:\WINDOWS\system32\DRIVERS\vproto2k.sys [2005-09-13 16:50]
R2 AvService;Avaya VPN Service;C:\Program Files\VPNremote for Windows XP\AvVpnService.exe [2005-09-13 16:50]
R2 cvintdrv;cvintdrv;C:\WINDOWS\system32\drivers\cvintdrv.sys [2004-07-26 10:00]
R2 FdRedir;FdRedir;C:\Program Files\Common Files\Protector Suite QL\Drivers\FdRedir.sys [2006-05-05 20:00]
R2 FileDisk2;FileDisk Protector Kernel Driver;C:\Program Files\Common Files\Protector Suite QL\Drivers\filedisk.sys [2006-05-05 19:59]
R2 IOPort;IOPort;C:\WINDOWS\system32\DRIVERS\IOPORT.SYS [2001-03-01 01:15]
R2 mxssvr;NI Configuration Manager;"D:\Program Files\National Instruments\MAX\nimxs.exe" [2007-03-08 17:29]
R2 NITaggerService;National Instruments Variable Engine;"D:\Program Files\National Instruments\Shared\Tagger\tagsrv.exe" [2007-07-23 09:29]
R2 smihlp;SMI helper driver;C:\Program Files\Protector Suite QL\smihlp.sys [2006-05-05 19:33]
R3 ndisva;Avaya VPNet Virtual Adapter Driver;C:\WINDOWS\system32\DRIVERS\vadapter.sys [2005-09-13 16:50]
R3 TcUsb;TC USB Kernel Driver;C:\WINDOWS\system32\Drivers\tcusb.sys [2006-05-05 19:12]
R3 tosrfec;Bluetooth ACPI from TOSHIBA;C:\WINDOWS\system32\DRIVERS\tosrfec.sys [2005-09-09 16:47]
S2 eac_notifysvc;eAcceleration Notification Service;"C:\PROGRA~1\EACCEL~1\FRAMEW~1\eac_svc.exe" [2008-03-24 17:46]
S2 eac_productsvc;eAcceleration Product Manager Service;"C:\PROGRA~1\EACCEL~1\FRAMEW~1\eac_productsvc.exe" [2008-03-24 17:46]
S3 JUSB;JUSB.Sys Java USB Driver;C:\WINDOWS\system32\drivers\JUSB.sys [2003-09-03 16:28]
S3 krdpdre;krdpdre;C:\DOCUME~1\Jax\LOCALS~1\Temp\krdpdre.sys []
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12 REG_MULTI_SZ Pml Driver HPZ12 Net Driver HPZ12
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]
\Shell\AutoRun\command - F:\Autorun.exe
.
**************************************************************************
disk not found C:\
please note that you need administrator rights to perform deep scan
disk not found C:\
please note that you need administrator rights to perform deep scan
disk not found C:\
please note that you need administrator rights to perform deep scan
disk not found C:\
please note that you need administrator rights to perform deep scan
disk not found C:\
please note that you need administrator rights to perform deep scan
disk not found C:\
please note that you need administrator rights to perform deep scan
disk not found C:\
please note that you need administrator rights to perform deep scan
disk not found C:\
please note that you need administrator rights to perform deep scan
disk not found C:\
please note that you need administrator rights to perform deep scan
disk not found C:\
please note that you need administrator rights to perform deep scan
disk not found C:\
please note that you need administrator rights to perform deep scan
disk not found C:\
please note that you need administrator rights to perform deep scan
disk not found C:\
please note that you need administrator rights to perform deep scan
disk not found C:\
please note that you need administrator rights to perform deep scan
disk not found C:\
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
disk not found C:\
disk not found C:\
disk not found C:\
disk not found C:\
disk not found C:\
disk not found C:\
disk not found C:\
disk not found C:\
disk not found C:\
disk not found C:\
disk not found C:\
disk not found C:\
disk not found C:\
disk not found C:\
disk not found C:\
scan completed successfully
hidden files:
**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------
PROCESS: C:\WINDOWS\system32\winlogon.exe
-> C:\WINDOWS\system32\AvayaGina.dll
-> C:\WINDOWS\system32\cbXPhiIB.dll
PROCESS: C:\WINDOWS\explorer.exe
-> C:\WINDOWS\system32\nview.dll
.
------------------------ Other Running Processes ------------------------
.
D:\Program Files\Lavasoft\Ad-Aware\aawservice.exe
D:\Program Files\Amazon\Amazon Unbox Video\ADVWindowsClientService.exe
C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
C:\WINDOWS\system32\DVDRAMSV.exe
C:\WINDOWS\system32\lkcitdl.exe
C:\WINDOWS\system32\lkads.exe
C:\WINDOWS\system32\lktsrv.exe
C:\Program Files\McAfee\Common Framework\FrameworkService.exe
C:\Program Files\McAfee\VirusScan Enterprise\Mcshield.exe
C:\Program Files\McAfee\VirusScan Enterprise\VsTskMgr.exe
C:\Program Files\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
D:\Program Files\National Instruments\Shared\Security\nidmsrv.exe
C:\Program Files\McAfee\Common Framework\naPrdMgr.exe
C:\WINDOWS\system32\nisvcloc.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\TOSHIBA\IVP\swupdate\swupdtmr.exe
C:\Program Files\TOSHIBA\TOSHIBA Applet\TAPPSRV.exe
C:\WINDOWS\system32\wdfmgr.exe
C:\WINDOWS\system32\rundll32.exe
C:\WINDOWS\system32\rundll32.exe
C:\Program Files\Synaptics\SynTP\Toshiba.exe
C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
C:\Program Files\Protector Suite QL\psqltray.exe
C:\Program Files\TOSHIBA\TOSHIBA Controls\TFncKy.exe
C:\WINDOWS\system32\TPSBattM.exe
C:\Program Files\McAfee\Common Framework\Mctray.exe
C:\Program Files\The Weather Channel FW\Desktop\DesktopWeather.exe
D:\Program Files\Webshots\Webshots.scr
.
**************************************************************************
.
Completion time: 2008-06-01 14:09:33 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-01 20:09:26
ComboFix2.txt 2008-06-01 17:24:21
ComboFix3.txt 2008-06-01 17:14:39
ComboFix4.txt 2008-06-01 17:11:55
ComboFix5.txt 2008-06-01 16:43:35
Pre-Run: 500,031,488 bytes free
Post-Run: 494,051,328 bytes free
304 --- E O F --- 2008-06-01 17:00:45
This is not the full KAV log. It wouldn't fit into one post. I have the full one if you would like that posted.
KAV:
-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
Monday, June 02, 2008 4:19:16 PM
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 2/06/2008
Kaspersky Anti-Virus database records: 821972
-------------------------------------------------------------------------------
Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true
Scan Target - My Computer:
Scan Statistics:
Total number of scanned objects: 105274
Number of viruses found: 11
Number of infected objects: 32
Number of suspicious objects: 0
Duration of the scan process: 01:48:28
Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\Jax\Local Settings\Temporary Internet Files\Content.IE5\4XBFNJWX\kb516107[1] Infected: not-a-virus:AdWare.Win32.Virtumonde.wpv skipped
C:\Documents and Settings\Jax\Local Settings\Temporary Internet Files\Content.IE5\F9GXJTQ3\css4[1] Infected: not-a-virus:AdWare.Win32.Virtumonde.wti skipped
C:\Documents and Settings\Jax\Local Settings\Temporary Internet Files\Content.IE5\F9GXJTQ3\kb456456[1] Infected: not-a-virus:AdWare.Win32.Virtumonde.wpu skipped
C:\RECYCLER\S-1-5-21-2340103986-951937984-3967435536-1005\Dc1\C\WINDOWS\system32\bxxluttg.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.wpv skipped
C:\RECYCLER\S-1-5-21-2340103986-951937984-3967435536-1005\Dc1\C\WINDOWS\system32\meycbjmm.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.wpv skipped
C:\RECYCLER\S-1-5-21-2340103986-951937984-3967435536-1005\Dc1\C\WINDOWS\system32\pwoprsic.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.wpu skipped
C:\RECYCLER\S-1-5-21-2340103986-951937984-3967435536-1005\Dc1\C\WINDOWS\system32\qlnkdtxm.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.wpu skipped
C:\System Volume Information\_restore{BB53A2CB-DF0B-41A1-A428-20CF4CC18FC0}\RP2\A0000119.dll Infected: Trojan-Downloader.Win32.ConHook.pr skipped
C:\System Volume Information\_restore{BB53A2CB-DF0B-41A1-A428-20CF4CC18FC0}\RP2\A0000120.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.wpu skipped
C:\System Volume Information\_restore{BB53A2CB-DF0B-41A1-A428-20CF4CC18FC0}\RP2\A0000121.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.wpv skipped
C:\System Volume Information\_restore{BB53A2CB-DF0B-41A1-A428-20CF4CC18FC0}\RP2\A0000122.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.wpu skipped
C:\System Volume Information\_restore{BB53A2CB-DF0B-41A1-A428-20CF4CC18FC0}\RP2\A0000123.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.wpv skipped
C:\System Volume Information\_restore{BB53A2CB-DF0B-41A1-A428-20CF4CC18FC0}\RP2\A0000125.dll Infected: Trojan.Win32.Monder.le skipped
C:\System Volume Information\_restore{BB53A2CB-DF0B-41A1-A428-20CF4CC18FC0}\RP2\A0000126.dll Infected: Trojan-Downloader.Win32.ConHook.pr skipped
C:\System Volume Information\_restore{BB53A2CB-DF0B-41A1-A428-20CF4CC18FC0}\RP2\A0000127.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.wpu skipped
C:\System Volume Information\_restore{BB53A2CB-DF0B-41A1-A428-20CF4CC18FC0}\RP2\A0000129.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.wpv skipped
C:\System Volume Information\_restore{BB53A2CB-DF0B-41A1-A428-20CF4CC18FC0}\RP4\A0002278.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.wpv skipped
C:\System Volume Information\_restore{BB53A2CB-DF0B-41A1-A428-20CF4CC18FC0}\RP4\A0002280.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.wpu skipped
C:\WINDOWS\system32\cbXPhiIB.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.vqj skipped
C:\WINDOWS\system32\quercyjt.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.wpu skipped
D:\Documents\TravelDrive\DivXPro511Adware.exe/stream/data0019 Infected: not-a-virus:AdWare.Win32.Gator.3202 skipped
D:\Documents\TravelDrive\DivXPro511Adware.exe/stream Infected: not-a-virus:AdWare.Win32.Gator.3202 skipped
D:\Documents\TravelDrive\DivXPro511Adware.exe NSIS: infected - 2 skipped
D:\Documents\VNC\Tight_VNC\tightvnc-1.2.9-setup.exe/data0002 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.h skipped
D:\Documents\VNC\Tight_VNC\tightvnc-1.2.9-setup.exe/data0003 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.b skipped
D:\Documents\VNC\Tight_VNC\tightvnc-1.2.9-setup.exe Inno: infected - 2 skipped
D:\Documents\VNC\Tight_VNC\tightvnc-1.3.8-setup.exe/data0003 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.1370 skipped
D:\Documents\VNC\Tight_VNC\tightvnc-1.3.8-setup.exe Inno: infected - 1 skipped
D:\Documents\VNC\Tight_VNC\VNCHooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.b skipped
D:\Documents\VNC\Ultra_VNC\UltraVNC-101-Setup.exe/file130 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.e skipped
D:\Documents\VNC\Ultra_VNC\UltraVNC-101-Setup.exe/file131 Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.e skipped
D:\Documents\VNC\Ultra_VNC\UltraVNC-101-Setup.exe Inno: infected - 2 skipped