View Full Version : Help with a nasty Virtumonde!
Hello. First I would like to say thanks for an excellent forum. I really appreciate all your efforts.
The problem is that I recently have been getting popups and a significant slower system. I also noticed that I no longer can use search engines (Google, Altavista, etc) in Mozilla and Opera (oddly enough it works with IE 6). I did a search with Spyware Doctor (Spybot does not detect it) and it confirms that I have a Virtumonde infection. This is my HJT log:
-----------------------------------------------------
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:20:25, on 2008-06-28
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\csrss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program\Java\jre1.6.0_05\bin\jusched.exe
C:\Program\Dell\Media Experience\PCMService.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\DeltTray.exe
C:\Program\iTunes\iTunesHelper.exe
C:\Program\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\WINDOWS\Philips\SPC610NC\Monitor.exe
C:\Program\AVG\AVG8\avgtray.exe
C:\WINDOWS\system32\Rundll32.exe
C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program\AVG\AVG8\avgwdsvc.exe
C:\Program\Glocalnet Bredband\Bredbandsklienten\GlocalnetBredbandService.exe
C:\Program\Intel\Intel Application Accelerator\iaantmon.exe
C:\Program\Canon\IJPLM\IJPLMSVC.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program\TVersity\Media Server\MediaServer.exe
C:\Program\AVG\AVG8\avgrsx.exe
C:\Program\AVG\AVG8\avgemc.exe
C:\Program\iPod\bin\iPodService.exe
C:\WINDOWS\System32\alg.exe
C:\WINDOWS\explorer.exe
C:\Program\Spyware Doctor\pctsAuxs.exe
C:\Program\Spyware Doctor\pctsSvc.exe
C:\Program\Spyware Doctor\pctsTray.exe
C:\Program\Internet Explorer\iexplore.exe
C:\Program\Trend Micro\HijackThis\HijackThis.exe
C:\WINDOWS\System32\wbem\wmiprvse.exe
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.euro.dell.com/countries/se/sve/gen/default.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.se/
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/countries/se/sve/gen/default.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
R3 - URLSearchHook: (no name) - {9CB65206-89C4-402c-BA80-02D8C59F9B1D} - C:\Program\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
O2 - BHO: (no name) - {20E59CA2-78B0-4431-BFD0-D8B5ADFC0056} - C:\WINDOWS\system32\pmnmMefc.dll (file missing)
O2 - BHO: (no name) - {3118F72F-DC3E-458A-9F6D-E539D182B1F4} - C:\WINDOWS\system32\khfGabBt.dll (file missing)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {9CB65201-89C4-402c-BA80-02D8C59F9B1D} - (no file)
O2 - BHO: (no name) - {A67504F2-C460-9696-6941-CE29A1803EE0} - C:\WINDOWS\system32\fvdxbjwb.dll (file missing)
O2 - BHO: {e1f1505f-63da-d7e8-72b4-468a37ed85aa} - {aa58de73-a864-4b27-8e7d-ad36f5051f1e} - C:\WINDOWS\system32\xsgabn.dll
O3 - Toolbar: Ask Toolbar - {FE063DB9-4EC0-403e-8DD8-394C54984B2C} - C:\Program\AskTBar\bar\1.bin\ASKTBAR.DLL
O4 - HKLM\..\Run: [UpdateManager] "C:\Program\Delade filer\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [IAAnotif] C:\Program\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Name of App] C:\Program\SAMSUNG\FW LiveUpdate\Liveupdate.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKLM\..\Run: [Virtual PDF Printer] C:\Program\Virtual PDF Printer\VirtualPDFPrinter.exe
O4 - HKLM\..\Run: [OCAudioIni] C:\Program\One-click Audio Converter\OCAudioIni.exe
O4 - HKLM\..\Run: [DeltTray] DeltTray.exe
O4 - HKLM\..\Run: [H2O] C:\Program\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program\Delade filer\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [SPC610NC_Monitor] C:\WINDOWS\Philips\SPC610NC\Monitor.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\Program\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [BMabb8e64a] Rundll32.exe "C:\WINDOWS\system32\inbbvqxp.dll",s
O4 - HKLM\..\Run: [ISTray] "C:\Program\Spyware Doctor\pctsTray.exe"
O4 - HKLM\..\RunOnce: [SpybotDeletingA7211] command /c del "C:\Program\Enigma Software Group\SpyHunter\SpyHunterMonitor.dll_old"
O4 - HKLM\..\RunOnce: [SpybotDeletingC2910] cmd /c del "C:\Program\Enigma Software Group\SpyHunter\SpyHunterMonitor.dll_old"
O4 - HKLM\..\RunOnce: [SpybotSnD] "C:\Program\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
O4 - HKCU\..\Run: [Yak!] C:\Program\Yak!\Yak.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program\Delade filer\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program\Delade filer\Adobe\Updater\AdobeUpdater.exe
O4 - HKCU\..\RunOnce: [SpybotDeletingB2052] command /c del "C:\Program\Enigma Software Group\SpyHunter\SpyHunterMonitor.dll_old"
O4 - HKCU\..\RunOnce: [SpybotDeletingD7603] cmd /c del "C:\Program\Enigma Software Group\SpyHunter\SpyHunterMonitor.dll_old"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJÄNST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program\DELADE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: pmnmMefc - pmnmMefc.dll (file missing)
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program\Delade filer\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\Program\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\Program\AVG\AVG8\avgwdsvc.exe
O23 - Service: Windows Security Drivers (csrs) - Unknown owner - C:\WINDOWS\csrss.exe (file missing)
O23 - Service: Glocalnet Bredband (GlocalnetBredbandClientService) - Glocalnet AB - C:\Program\Glocalnet Bredband\Bredbandsklienten\GlocalnetBredbandService.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: iPod Service - Apple Inc. - C:\Program\iPod\bin\iPodService.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program\Delade filer\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program\WinPcap\rpcapd.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program\Spyware Doctor\pctsSvc.exe
O23 - Service: TVersityMediaServer - Unknown owner - C:\Program\TVersity\Media Server\MediaServer.exe
--
End of file - 10119 bytes
---
Thank you in advance,
Ontrop.
pskelley
2008-06-29, 22:31
Welcome to Safer Networking, I wish to be sure you have viewed and understand this information.
"BEFORE you POST" (READ this Procedure before Requesting Assistance)
http://forums.spybot.info/showthread.php?t=288
All advice given is taken at your own risk.
Please make sure you have read this information so we are on the same page.
You are infected, I suggest you keep this computer offline except when troubleshooting, the junk may download more. If you have any tool I use, delete it and download it new from the link I provide. Read and follow the directions carefully, the tools will not work unless you do.
This can be a tough infection to remove so do not expect fast or easy.
See this information:
http://www.spywarewarrior.com/viewtopic.php?t=24810
http://www.castlecops.com/t187654-free_spyware_scwnload_a013_com_unknown_questionable.html
O4 - HKCU\..\RunOnce: [SpybotDeletingB2052] command /c del "C:\Program\Enigma Software Group\SpyHunter\SpyHunterMonitor.dll_old"
You are trying to remove SpyHunter, this is correct.
A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own. This tool is not a toy and not for everyday use.
Remove any old copies of combofix before you proceed.
Thanks to sUBs and anyone else who helped with this fix.
It is important that it is saved directly to your Desktop
Download ComboFix from Here (http://download.bleepingcomputer.com/sUBs/ComboFix.exe) to your Desktop
Double click combofix.exe and follow the prompts.
When finished, it shall produce a log for you. Post that log and a HiJackthis log in your next reply
Note: Do not mouseclick combofix's window while its running. That may cause it to stall
Post the combofix log and a new HJT log.
Tutorial
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
Thanks
Thank you for helping me.
When I first ran combofix, it reboted Windows. At startup it said that a log was about to be made. Then a window popped up and said "C:\Documents... file can't be found" together with an empty .txt log file. Everything else seemed to be fine so I ran Combofix a second time. This time succesful. Thought you might like to know that. Anyway, here is the Combofix log:
---
ComboFix 08-06-20.4 - Leif Nilsson 2008-06-29 23:06:53.2 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1053.18.621 [GMT 2:00]
Running from: C:\Documents and Settings\Leif Nilsson\Skrivbord\ComboFix.exe
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\WINDOWS\pskt.ini
.
((((((((((((((((((((((((( Files Created from 2008-05-28 to 2008-06-29 )))))))))))))))))))))))))))))))
.
2008-06-29 23:03 . 2008-06-29 23:03 <KAT> d-------- C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Lokala instõllningar
2008-06-29 23:03 . 2008-06-29 23:03 <KAT> d-------- C:\Documents and Settings\Win98\Lokala instõllningar
2008-06-29 23:03 . 2008-06-29 23:03 <KAT> d-------- C:\Documents and Settings\NetworkService\Lokala instõllningar
2008-06-29 23:03 . 2008-06-29 23:03 <KAT> d-------- C:\Documents and Settings\LocalService\Lokala instõllningar
2008-06-29 23:03 . 2008-06-29 23:03 <KAT> d-------- C:\Documents and Settings\Leif Nilsson\Lokala instõllningar
2008-06-29 23:03 . 2008-06-29 23:03 <KAT> d-------- C:\Documents and Settings\Administrat÷r
2008-06-29 22:56 . 2008-06-29 22:56 0 --a------ C:\WINDOWS\BMabb8e64a.xml
2008-06-28 18:44 . 2008-06-28 18:44 <KAT> d-------- C:\Program\Enigma Software Group
2008-06-28 17:44 . 2008-06-28 17:44 <KAT> d-------- C:\Program\Trend Micro
2008-06-28 17:20 . 2008-06-29 22:56 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-28 17:20 . 2008-06-28 17:20 1,409 --a------ C:\WINDOWS\QTFont.for
2008-06-28 14:38 . 2008-06-28 14:38 <KAT> d-------- C:\WINDOWS\%DownloadedProgramFiles%
2008-06-28 14:36 . 2006-07-27 13:52 367 --a------ C:\WINDOWS\SYSTEM32\LegitCheckControl.inf
2008-06-27 20:11 . 2008-06-27 20:11 81,920 --a------ C:\WINDOWS\SYSTEM32\rwuegnvm.dll
2008-06-27 20:08 . 2008-06-27 20:08 102,912 --a------ C:\WINDOWS\SYSTEM32\xsgabn.dll
2008-06-27 20:08 . 2008-06-27 20:08 102,912 --a------ C:\WINDOWS\SYSTEM32\lwemaixn.dll
2008-06-27 20:05 . 2008-06-27 20:05 90,112 --a------ C:\WINDOWS\SYSTEM32\inbbvqxp.dll
2008-06-26 21:02 . 2008-06-26 21:02 <KAT> d-------- C:\Program\Lavasoft
2008-06-26 21:02 . 2008-06-26 21:02 <KAT> d-------- C:\Program\Delade filer\Wise Installation Wizard
2008-06-26 21:02 . 2008-06-26 21:04 <KAT> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-06-25 23:29 . 2008-06-25 23:29 <KAT> d-------- C:\Documents and Settings\Leif Nilsson\Application Data\Elaborate Bytes
2008-06-24 23:41 . 2008-06-26 22:36 <KAT> d--h----- C:\$AVG8.VAULT$
2008-06-18 23:06 . 2008-06-18 23:19 <KAT> d-------- C:\Documents and Settings\Leif Nilsson\Application Data\winpt
2008-06-18 23:03 . 2008-06-18 23:03 <KAT> d-------- C:\Program\GNU
2008-06-18 23:03 . 2008-06-18 23:06 <KAT> d-------- C:\Documents and Settings\Leif Nilsson\Application Data\gnupg
2008-06-18 13:19 . 2008-06-18 13:34 <KAT> d-------- C:\Documents and Settings\Leif Nilsson\dwhelper
2008-06-13 19:36 . 2008-06-13 19:36 <KAT> d-------- C:\Dev-Pas
2008-06-13 18:41 . 2008-06-13 18:41 <KAT> d-------- C:\FPC
2008-06-11 18:58 . 2008-06-11 18:58 <KAT> d-------- C:\Dev-Cpp
2008-06-08 11:04 . 2008-06-28 08:24 <KAT> d-------- C:\WINDOWS\SYSTEM32\DRIVERS\Avg
2008-06-08 11:04 . 2008-06-08 11:04 <KAT> d-------- C:\Program\AVG
2008-06-08 11:04 . 2008-06-08 11:04 <KAT> d-------- C:\Documents and Settings\All Users\Application Data\avg8
2008-06-08 11:04 . 2008-06-08 11:04 96,520 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\avgldx86.sys
2008-06-08 11:04 . 2008-06-08 11:04 75,272 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\avgtdix.sys
2008-06-08 11:04 . 2008-06-08 11:04 10,520 --a------ C:\WINDOWS\SYSTEM32\avgrsstx.dll
2008-06-06 16:52 . 2008-06-06 16:52 <KAT> d-------- C:\WINDOWS\Philips
2008-06-06 16:52 . 2004-08-04 10:34 54,272 --a------ C:\WINDOWS\SYSTEM32\vfwwdm32.dll
2008-06-06 16:52 . 2004-08-04 10:34 54,272 --a------ C:\WINDOWS\SYSTEM32\DLLCACHE\vfwwdm32.dll
2008-06-04 21:45 . 2008-06-04 21:45 <KAT> d-------- C:\Documents and Settings\All Users\Application Data\CanonIJPLM
2008-06-04 21:42 . 2008-06-04 21:42 <KAT> d-------- C:\Program\Delade filer\ScanSoft Shared
2008-06-04 21:42 . 2008-06-04 21:42 <KAT> d-------- C:\Documents and Settings\Leif Nilsson\Application Data\ScanSoft
2008-06-04 21:42 . 2008-06-04 21:42 <KAT> d-------- C:\Documents and Settings\All Users\Application Data\ScanSoft
2008-06-04 21:42 . 2008-06-04 21:42 <KAT> d-------- C:\Documents and Settings\All Users\Application Data\InstallShield
2008-06-04 21:42 . 2008-06-04 21:42 400 --a------ C:\WINDOWS\MAXLINK.INI
2008-06-04 21:41 . 2008-06-04 21:41 <KAT> d-------- C:\Program\ScanSoft
2008-06-04 21:39 . 2008-06-04 21:39 <KAT> d--h----- C:\Documents and Settings\All Users\Application Data\CanonBJ
2008-06-04 21:38 . 2008-06-04 21:38 <KAT> d--h----- C:\WINDOWS\SYSTEM32\CanonIJ Uninstaller Information
2008-06-04 21:38 . 2008-06-04 21:38 <KAT> d--h----- C:\Program\CanonBJ
2008-06-04 21:38 . 2008-06-04 21:45 <KAT> d-------- C:\Program\Canon
2008-06-04 21:38 . 2006-12-25 22:00 198,656 --a------ C:\WINDOWS\SYSTEM32\CNMLM8R.DLL
2008-06-04 18:15 . 2008-06-06 18:50 <KAT> d-------- C:\Documents and Settings\Leif Nilsson\Application Data\Canon
2008-06-04 18:14 . 2004-08-04 08:01 25,856 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\usbprint.sys
2008-06-04 18:14 . 2004-08-04 08:01 25,856 --a------ C:\WINDOWS\SYSTEM32\DLLCACHE\usbprint.sys
2008-06-03 18:12 . 2008-06-03 18:12 <KAT> d-------- C:\Program\FMS
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-29 21:05 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-28 19:19 --------- d-----w C:\Program\DC++
2008-06-28 16:11 --------- d-----w C:\Documents and Settings\Leif Nilsson\Application Data\Azureus
2008-06-28 10:22 --------- d-----w C:\Documents and Settings\Leif Nilsson\Application Data\dvdcss
2008-06-27 21:50 --------- d-----w C:\Program\FlashFXP
2008-06-27 19:09 20 ----a-w C:\sccfg.sys
2008-06-26 21:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-26 21:05 --------- d-----w C:\Program\Spybot - Search & Destroy
2008-06-25 21:26 --------- d-----w C:\Program\Elaborate Bytes
2008-06-17 19:17 --------- d-----w C:\Program\Azureus
2008-06-15 19:35 --------- d-----w C:\Documents and Settings\Leif Nilsson\Application Data\DemoCreator
2008-06-14 18:01 272,128 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\bthport.sys
2008-06-14 18:01 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-04 20:37 --------- d-----w C:\Program\FirstClass
2008-06-04 19:42 --------- d-----w C:\Program\Delade filer\InstallShield
2008-06-02 23:36 --------- d-----w C:\Program\Google
2008-05-19 20:22 --------- d-----w C:\Program\Winamp
2008-05-17 11:26 --------- d-----w C:\Program\Folder Lock
2008-05-16 09:58 12,632 ----a-w C:\WINDOWS\SYSTEM32\lsdelete.exe
2008-05-11 17:27 --------- d-----w C:\Documents and Settings\Leif Nilsson\Application Data\AdobeUM
2008-05-08 20:01 --------- d-----w C:\Program\Opera
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\rmcast.sys
2008-05-07 05:16 1,289,728 ----a-w C:\WINDOWS\SYSTEM32\quartz.dll
2008-05-07 05:16 1,289,728 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\quartz.dll
2008-05-01 21:08 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2008-05-01 21:08 249,856 ------w C:\WINDOWS\Setup1.exe
2008-05-01 21:08 --------- d-----w C:\Program\SubSync
2008-05-01 21:06 --------- d-----w C:\Program\Gabest
2008-04-29 09:20 15,648 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys
2008-04-29 09:19 15,648 ----a-w C:\WINDOWS\system32\drivers\Awrtrd.sys
2008-04-29 09:19 12,960 ----a-w C:\WINDOWS\system32\drivers\Awrtpd.sys
2008-04-17 10:46 18,432 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\iedw.exe
2003-09-15 23:19 99,544 ----a-w C:\WINDOWS\INF\virprn.exe
2003-09-15 23:19 90,624 ----a-w C:\WINDOWS\INF\prtproc.dll
2003-09-15 23:19 18,950 ----a-w C:\WINDOWS\INF\virpntd.dll
2003-09-15 23:19 10,240 ----a-w C:\WINDOWS\INF\virport.dll
.
((((((((((((((((((((((((((((( snapshot@2008-06-29_23.03.03.37 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-29 17:55:02 71,884 ----a-w C:\WINDOWS\SYSTEM32\PERFC009.DAT
+ 2008-06-29 21:05:22 71,884 ----a-w C:\WINDOWS\SYSTEM32\PERFC009.DAT
- 2008-06-29 17:55:02 83,760 ----a-w C:\WINDOWS\SYSTEM32\perfc01D.dat
+ 2008-06-29 21:05:22 83,760 ----a-w C:\WINDOWS\SYSTEM32\perfc01D.dat
- 2008-06-29 17:55:02 425,500 ----a-w C:\WINDOWS\SYSTEM32\PERFH009.DAT
+ 2008-06-29 21:05:22 425,500 ----a-w C:\WINDOWS\SYSTEM32\PERFH009.DAT
- 2008-06-29 17:55:02 428,088 ----a-w C:\WINDOWS\SYSTEM32\perfh01D.dat
+ 2008-06-29 21:05:22 428,088 ----a-w C:\WINDOWS\SYSTEM32\perfh01D.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{20E59CA2-78B0-4431-BFD0-D8B5ADFC0056}]
C:\WINDOWS\system32\pmnmMefc.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3118F72F-DC3E-458A-9F6D-E539D182B1F4}]
C:\WINDOWS\system32\khfGabBt.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A67504F2-C460-9696-6941-CE29A1803EE0}]
C:\WINDOWS\system32\fvdxbjwb.dll
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{aa58de73-a864-4b27-8e7d-ad36f5051f1e}]
2008-06-27 20:08 102912 --a------ C:\WINDOWS\system32\xsgabn.dll
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yak!"="C:\Program\Yak!\Yak.exe" [ ]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program\Delade filer\Ahead\Lib\NMBgMonitor.exe" [ ]
"updateMgr"="C:\Program\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]
"AdobeUpdater"="C:\Program\Delade filer\Adobe\Updater\AdobeUpdater.exe" [2006-10-05 16:00 976472]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UpdateManager"="C:\Program\Delade filer\Sonic\Update Manager\sgtray.exe" [2003-08-19 02:01 110592]
"SunJavaUpdateSched"="C:\Program\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
"PCMService"="C:\Program\Dell\Media Experience\PCMService.exe" [2004-04-11 21:15 290816]
"IAAnotif"="C:\Program\Intel\Intel Application Accelerator\iaanotif.exe" [2004-06-29 12:23 135168]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-03-15 02:04 122933]
"ATIPTA"="C:\Program\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-05-25 23:35 335872]
"Name of App"="C:\Program\SAMSUNG\FW LiveUpdate\Liveupdate.exe" [ ]
"SpySweeper"="C:\Program\Webroot\Spy Sweeper\SpySweeper.exe" [ ]
"Virtual PDF Printer"="C:\Program\Virtual PDF Printer\VirtualPDFPrinter.exe" [ ]
"OCAudioIni"="C:\Program\One-click Audio Converter\OCAudioIni.exe" [ ]
"DeltTray"="DeltTray.exe" [2004-08-26 23:43 56320 C:\WINDOWS\SYSTEM32\delttray.exe]
"H2O"="C:\Program\SyncroSoft\Pos\H2O\cledx.exe" [2005-10-23 00:00 385024]
"QuickTime Task"="C:\Program\QuickTime\qttask.exe" [2008-02-01 00:13 385024]
"iTunesHelper"="C:\Program\iTunes\iTunesHelper.exe" [2008-02-04 15:18 267048]
"SSBkgdUpdate"="C:\Program\Delade filer\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 09:03 210472]
"OpwareSE4"="C:\Program\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 12:02 79400]
"SPC610NC_Monitor"="C:\WINDOWS\Philips\SPC610NC\Monitor.exe" [2006-11-03 11:01 319488]
"AVG8_TRAY"="C:\Program\AVG\AVG8\avgtray.exe" [2008-06-08 11:04 1177368]
"BMabb8e64a"="C:\WINDOWS\system32\inbbvqxp.dll" [2008-06-27 20:05 90112]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 10:34 15360]
"Oaph"="C:\WINDOWS\CROSOF~1\regsvr32.exe" [ ]
"uqqw"="C:\Program\DELADE~1\uqqw\uqqwm.exe" [ ]
C:\Documents and Settings\Leif Nilsson\Start-meny\Program\Autostart\
Adobe Gamma.lnk - C:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 20:16:50 113664]
C:\Documents and Settings\All Users\Start-meny\Program\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
Microsoft Office.lnk - C:\Program\Microsoft Office\Office\OSA9.EXE [1999-02-17 21:05:56 65588]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"AllowLegacyWebView"= 1 (0x1)
"AllowUnhashedWebView"= 1 (0x1)
[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{20E59CA2-78B0-4431-BFD0-D8B5ADFC0056}"= C:\WINDOWS\system32\pmnmMefc.dll [ ]
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmnmMefc]
pmnmMefc.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.VP31"= vp31vfw.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program\\Messenger\\msmsgs.exe"=
"C:\\Documents and Settings\\Leif Nilsson\\Skrivbord\\Linus heter Jag\\Qwix\\Qwix.exe"=
"C:\\Program\\FlashFXP\\flashfxp.exe"=
"C:\\Program\\DC++\\DCPlusPlus.exe"=
"C:\\WINDOWS\\SYSTEM32\\MediaServerDump\\LiveUpdate\\OLUpdate.exe"=
"C:\\Program\\XLink Kai Evolution VII\\kaiLaunch.exe"=
"C:\\Program\\Azureus\\Azureus.exe"=
"C:\\Program\\Glocalnet Bredband\\Bredbandsklienten\\GlocalnetBredband.exe"=
"C:\\Program\\Glocalnet Bredband\\Bredbandsklienten\\GlocalnetBredbandService.exe"=
"C:\\Program\\TVersity\\Media Server\\TVersity.exe"=
"C:\\Program\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program\\MSN Messenger\\livecall.exe"=
"C:\\WINDOWS\\SYSTEM32\\dplaysvr.exe"=
"C:\\WINDOWS\\SYSTEM32\\ftp.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program\\XLink Kai Evolution VII\\kaiEngine.exe"=
"C:\\Program\\Skype\\Phone\\Skype.exe"=
"C:\\Program\\iTunes\\iTunes.exe"=
"C:\\Program\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program\\AVG\\AVG8\\avgemc.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"41952:TCP"= 41952:TCP:Tversity
R0 sonypvl2;sonypvl2;C:\WINDOWS\system32\drivers\sonypvl2.sys [2003-07-25 15:02]
R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-06-08 11:04]
R1 sonypvf2;sonypvf2;C:\WINDOWS\system32\drivers\sonypvf2.sys [2003-08-20 10:51]
R1 sonypvt2;sonypvt2;C:\WINDOWS\system32\drivers\sonypvt2.sys [2003-08-20 10:44]
R2 avg8emc;AVG8 E-mail Scanner;C:\Program\AVG\AVG8\avgemc.exe [2008-06-08 11:04]
R2 avg8wd;AVG8 WatchDog;C:\Program\AVG\AVG8\avgwdsvc.exe [2008-06-08 11:04]
R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-06-08 11:04]
R2 GlocalnetBredbandClientService;Glocalnet Bredband;C:\Program\Glocalnet Bredband\Bredbandsklienten\GlocalnetBredbandService.exe [2007-01-03 00:27]
R2 IJPLMSVC;PIXMA Extended Survey Program;C:\Program\Canon\IJPLM\IJPLMSVC.EXE [2006-11-10 08:12]
R3 CLEDX;Team H2O CLEDX service;C:\WINDOWS\system32\DRIVERS\cledx.sys [2005-05-09 20:08]
S1 sonypvd2;sonypvd2;C:\WINDOWS\system32\DRIVERS\sonypvd2.sys [2003-06-24 10:29]
S2 csrs;Windows Security Drivers;"C:\WINDOWS\csrss.exe" []
S3 pcwe;pcwe;C:\Program\PC Wizard 2007\pcw86-32.sys []
S3 PsSdk30;PsSdk30;C:\WINDOWS\system32\Drivers\PsSdk30.drv []
S3 SPC610NC;SPC 610NC Laptop Camera;C:\WINDOWS\system32\DRIVERS\SPC610NC.SYS [2007-01-19 17:14]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4e5503bc-f143-11d9-b7c6-0011113120ed}]
\Shell\AutoRun\command - H:\Setup.exe
\Shell\setup\command - H:\setup.exe
.
Contents of the 'Scheduled Tasks' folder
"2008-06-12 08:51:07 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-29 23:08:26
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet002\Services\PsSdk30]
"ImagePath"="\??\C:\WINDOWS\system32\Drivers\PsSdk30.drv"
.
Completion time: 2008-06-29 23:09:49
ComboFix-quarantined-files.txt 2008-06-29 21:09:06
ComboFix2.txt 2008-06-29 21:03:28
Pre-Run: 46,135,693,312 byte ledigt
Post-Run: 46,128,009,216 byte ledigt
240 --- E O F --- 2008-06-20 21:08:13
---
Here is the HJT log:
---
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 23:10:45, on 2008-06-29
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program\AVG\AVG8\avgwdsvc.exe
C:\Program\Glocalnet Bredband\Bredbandsklienten\GlocalnetBredbandService.exe
C:\Program\Intel\Intel Application Accelerator\iaantmon.exe
C:\Program\Canon\IJPLM\IJPLMSVC.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program\TVersity\Media Server\MediaServer.exe
C:\Program\Java\jre1.6.0_05\bin\jusched.exe
C:\Program\Dell\Media Experience\PCMService.exe
C:\Program\Intel\Intel Application Accelerator\iaanotif.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\DeltTray.exe
C:\Program\SyncroSoft\Pos\H2O\cledx.exe
C:\Program\iTunes\iTunesHelper.exe
C:\Program\AVG\AVG8\avgemc.exe
C:\Program\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\WINDOWS\Philips\SPC610NC\Monitor.exe
C:\Program\iPod\bin\iPodService.exe
C:\Program\AVG\AVG8\avgrsx.exe
C:\Program\AVG\AVG8\avgrsx.exe
C:\WINDOWS\explorer.exe
C:\Program\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.se/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/countries/se/sve/gen/default.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
R3 - URLSearchHook: (no name) - {9CB65206-89C4-402c-BA80-02D8C59F9B1D} - C:\Program\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
O2 - BHO: (no name) - {20E59CA2-78B0-4431-BFD0-D8B5ADFC0056} - C:\WINDOWS\system32\pmnmMefc.dll (file missing)
O2 - BHO: (no name) - {3118F72F-DC3E-458A-9F6D-E539D182B1F4} - C:\WINDOWS\system32\khfGabBt.dll (file missing)
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {A67504F2-C460-9696-6941-CE29A1803EE0} - C:\WINDOWS\system32\fvdxbjwb.dll (file missing)
O2 - BHO: {e1f1505f-63da-d7e8-72b4-468a37ed85aa} - {aa58de73-a864-4b27-8e7d-ad36f5051f1e} - C:\WINDOWS\system32\xsgabn.dll
O4 - HKLM\..\Run: [UpdateManager] "C:\Program\Delade filer\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program\Java\jre1.6.0_05\bin\jusched.exe"
O4 - HKLM\..\Run: [PCMService] "C:\Program\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [IAAnotif] C:\Program\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Name of App] C:\Program\SAMSUNG\FW LiveUpdate\Liveupdate.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKLM\..\Run: [Virtual PDF Printer] C:\Program\Virtual PDF Printer\VirtualPDFPrinter.exe
O4 - HKLM\..\Run: [OCAudioIni] C:\Program\One-click Audio Converter\OCAudioIni.exe
O4 - HKLM\..\Run: [DeltTray] DeltTray.exe
O4 - HKLM\..\Run: [H2O] C:\Program\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program\Delade filer\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [SPC610NC_Monitor] C:\WINDOWS\Philips\SPC610NC\Monitor.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\Program\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [BMabb8e64a] Rundll32.exe "C:\WINDOWS\system32\inbbvqxp.dll",s
O4 - HKCU\..\Run: [Yak!] C:\Program\Yak!\Yak.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program\Delade filer\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKCU\..\Run: [AdobeUpdater] C:\Program\Delade filer\Adobe\Updater\AdobeUpdater.exe
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJÄNST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program\DELADE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: avgrsstx.dll
O20 - Winlogon Notify: pmnmMefc - pmnmMefc.dll (file missing)
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program\Delade filer\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\Program\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\Program\AVG\AVG8\avgwdsvc.exe
O23 - Service: Windows Security Drivers (csrs) - Unknown owner - C:\WINDOWS\csrss.exe (file missing)
O23 - Service: Glocalnet Bredband (GlocalnetBredbandClientService) - Glocalnet AB - C:\Program\Glocalnet Bredband\Bredbandsklienten\GlocalnetBredbandService.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: iPod Service - Apple Inc. - C:\Program\iPod\bin\iPodService.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program\Delade filer\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program\WinPcap\rpcapd.exe
O23 - Service: TVersityMediaServer - Unknown owner - C:\Program\TVersity\Media Server\MediaServer.exe
--
End of file - 8961 bytes
---
Thank you once again,
/Ontrop.
pskelley
2008-06-30, 00:54
Thanks for returning your information, read and follow all directions carefully and in the numbered order.
C:\Program\Yak!\Yak.exe <<< do you know what that program is?
1) C:\Program\Java\jre1.6.0_05\ <<< check Java for an update, I believe there will be one, see this information:
http://forums.spybot.info/showpost.php?p=12880&postcount=2
2) How to make files and folders visible:
Click Start > Open My Computer.
Select the Tools menu and click Folder Options.
Select the View Tab. Under the Hidden files and folders heading, select Show hidden files and folders.
Uncheck: Hide file extensions for known file types
Uncheck the Hide protected operating system files (recommended) option.
Click Yes to confirm. Click OK.
You may reverse this for safety when we are finished.
3) Please download ATF Cleaner by Atribune
http://www.atribune.org/public-beta/ATF-Cleaner.exe
Save it to your Desktop. We will use this later.
(follow the CFScript directions carefully)
4) Open notepad and copy/paste the text in the codebox below into it:
File::
C:\WINDOWS\system32\xsgabn.dll
C:\WINDOWS\system32\inbbvqxp.dll
C:\WINDOWS\SYSTEM32\rwuegnvm.dll
C:\WINDOWS\SYSTEM32\lwemaixn.dll
C:\WINDOWS\BMabb8e64a.xml
C:\WINDOWS\system32\pmnmMefc.dll
Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{20E59CA2-78B0-4431-BFD0-D8B5ADFC0056}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3118F72F-DC3E-458A-9F6D-E539D182B1F4}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A67504F2-C460-9696-6941-CE29A1803EE0}]
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{aa58de73-a864-4b27-8e7d-ad36f5051f1e}]
[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\pmnmMefc]
Folder::
C:\Program\Enigma Software Group
Save this as CFScript
http://i24.photobucket.com/albums/c30/ken545/CFScript.gif
Referring to the picture above, drag CFScript into ComboFix.exe.
This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log. (wait until you finish to post the logs)
5) Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:
(some items may have been removed by CFScript)
R3 - URLSearchHook: (no name) - {9CB65206-89C4-402c-BA80-02D8C59F9B1D} - C:\Program\AskTBar\SrchAstt\1.bin\A5SRCHAS.DLL
http://www.benedelman.org/spyware/ask-toolbars/ <<< see this
O2 - BHO: (no name) - {20E59CA2-78B0-4431-BFD0-D8B5ADFC0056} - C:\WINDOWS\system32\pmnmMefc.dll (file missing)
O2 - BHO: (no name) - {3118F72F-DC3E-458A-9F6D-E539D182B1F4} - C:\WINDOWS\system32\khfGabBt.dll (file missing)
O2 - BHO: (no name) - {A67504F2-C460-9696-6941-CE29A1803EE0} - C:\WINDOWS\system32\fvdxbjwb.dll (file missing)
O2 - BHO: {e1f1505f-63da-d7e8-72b4-468a37ed85aa} - {aa58de73-a864-4b27-8e7d-ad36f5051f1e} - C:\WINDOWS\system32\xsgabn.dll
O4 - HKLM\..\Run: [BMabb8e64a] Rundll32.exe "C:\WINDOWS\system32\inbbvqxp.dll",s
O20 - Winlogon Notify: pmnmMefc - pmnmMefc.dll (file missing)
Close all programs but HJT and all browser windows, then click on "Fix Checked"
6) Run ATF Cleaner
Double-click ATF-Cleaner.exe to run the program.
Click Select All found at the bottom of the list.
Click the Empty Selected button.
Click Exit on the Main menu to close the program.
Restart and post the combofix log from CFScript, a new HJT log and feedback from you. How is the computer running now.
Thanks
Thank you for your instructions and sorry for not responding in a while. I work most of the day. To answer your question about the Yak! program: I do not know anything about this program. Neither I or anybody else who uses this computer uses this program. I tried to Google it, but got nothing. Do you know anything about this program?
(Here is my new Combofix and Hijackthis log:)
Combofix:
---
ComboFix 08-06-20.4 - Leif Nilsson 2008-06-30 20:53:58.3 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1053.18.585 [GMT 2:00]
Running from: C:\Documents and Settings\Leif Nilsson\Skrivbord\ComboFix.exe
Command switches used :: C:\Documents and Settings\Leif Nilsson\Skrivbord\CFScript.txt
* Created a new restore point
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
FILE ::
C:\WINDOWS\BMabb8e64a.xml
C:\WINDOWS\system32\inbbvqxp.dll
C:\WINDOWS\SYSTEM32\lwemaixn.dll
C:\WINDOWS\system32\pmnmMefc.dll
C:\WINDOWS\SYSTEM32\rwuegnvm.dll
C:\WINDOWS\system32\xsgabn.dll
.
((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.
C:\Documents and Settings\Leif Nilsson\Lokala inställningar\Temporary Internet Files\default.temp
C:\Documents and Settings\Leif Nilsson\Lokala inställningar\Temporary Internet Files\exif.jpg
C:\Documents and Settings\Leif Nilsson\Lokala inställningar\Temporary Internet Files\firmware.inf
C:\Documents and Settings\Leif Nilsson\Lokala inställningar\Temporary Internet Files\ip3picfile.temp
C:\Documents and Settings\Leif Nilsson\Lokala inställningar\Temporary Internet Files\ip3Wmapic.temp
C:\Documents and Settings\Leif Nilsson\Lokala inställningar\Temporary Internet Files\update.inf
C:\Documents and Settings\Win98\Lokala inställningar\Application Data\Microsoft\Windows Media\10.0\WMSDKNSD.XML
C:\Program\Enigma Software Group
C:\WINDOWS\BMabb8e64a.xml
C:\WINDOWS\pskt.ini
C:\WINDOWS\system32\inbbvqxp.dll
C:\WINDOWS\SYSTEM32\lwemaixn.dll
C:\WINDOWS\SYSTEM32\rwuegnvm.dll
C:\WINDOWS\system32\xsgabn.dll
.
((((((((((((((((((((((((( Files Created from 2008-05-28 to 2008-06-30 )))))))))))))))))))))))))))))))
.
2008-06-30 20:47 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\SYSTEM32\javacpl.cpl
2008-06-29 23:03 . 2008-06-29 23:03 <KAT> d-------- C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Lokala inställningar
2008-06-29 23:03 . 2008-06-29 23:03 <KAT> d-------- C:\Documents and Settings\Win98\Lokala inställningar
2008-06-29 23:03 . 2008-06-29 23:03 <KAT> d-------- C:\Documents and Settings\NetworkService\Lokala inställningar
2008-06-29 23:03 . 2008-06-29 23:03 <KAT> d-------- C:\Documents and Settings\LocalService\Lokala inställningar
2008-06-29 23:03 . 2008-06-29 23:03 <KAT> d-------- C:\Documents and Settings\Leif Nilsson\Lokala inställningar
2008-06-29 23:03 . 2008-06-29 23:03 <KAT> d-------- C:\Documents and Settings\Administratör
2008-06-29 23:03 . <KAT> C:\Documents and Settings\Administrat÷r\Lokala inställningar
2008-06-29 23:03 . <KAT> C:\Documents and Settings\Administrat÷r\Lokala inställningar
2008-06-28 17:44 . 2008-06-28 17:44 <KAT> d-------- C:\Program\Trend Micro
2008-06-28 17:20 . 2008-06-30 20:20 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-28 17:20 . 2008-06-28 17:20 1,409 --a------ C:\WINDOWS\QTFont.for
2008-06-28 14:38 . 2008-06-28 14:38 <KAT> d-------- C:\WINDOWS\%DownloadedProgramFiles%
2008-06-28 14:36 . 2006-07-27 13:52 367 --a------ C:\WINDOWS\SYSTEM32\LegitCheckControl.inf
2008-06-26 21:02 . 2008-06-26 21:02 <KAT> d-------- C:\Program\Lavasoft
2008-06-26 21:02 . 2008-06-26 21:02 <KAT> d-------- C:\Program\Delade filer\Wise Installation Wizard
2008-06-26 21:02 . 2008-06-26 21:04 <KAT> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-06-25 23:29 . 2008-06-25 23:29 <KAT> d-------- C:\Documents and Settings\Leif Nilsson\Application Data\Elaborate Bytes
2008-06-24 23:41 . 2008-06-26 22:36 <KAT> d--h----- C:\$AVG8.VAULT$
2008-06-18 23:06 . 2008-06-18 23:19 <KAT> d-------- C:\Documents and Settings\Leif Nilsson\Application Data\winpt
2008-06-18 23:03 . 2008-06-18 23:03 <KAT> d-------- C:\Program\GNU
2008-06-18 23:03 . 2008-06-18 23:06 <KAT> d-------- C:\Documents and Settings\Leif Nilsson\Application Data\gnupg
2008-06-18 13:19 . 2008-06-18 13:34 <KAT> d-------- C:\Documents and Settings\Leif Nilsson\dwhelper
2008-06-13 19:36 . 2008-06-13 19:36 <KAT> d-------- C:\Dev-Pas
2008-06-13 18:41 . 2008-06-13 18:41 <KAT> d-------- C:\FPC
2008-06-11 18:58 . 2008-06-11 18:58 <KAT> d-------- C:\Dev-Cpp
2008-06-08 11:04 . 2008-06-28 08:24 <KAT> d-------- C:\WINDOWS\SYSTEM32\DRIVERS\Avg
2008-06-08 11:04 . 2008-06-08 11:04 <KAT> d-------- C:\Program\AVG
2008-06-08 11:04 . 2008-06-08 11:04 <KAT> d-------- C:\Documents and Settings\All Users\Application Data\avg8
2008-06-08 11:04 . 2008-06-08 11:04 96,520 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\avgldx86.sys
2008-06-08 11:04 . 2008-06-08 11:04 75,272 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\avgtdix.sys
2008-06-08 11:04 . 2008-06-08 11:04 10,520 --a------ C:\WINDOWS\SYSTEM32\avgrsstx.dll
2008-06-06 16:52 . 2008-06-06 16:52 <KAT> d-------- C:\WINDOWS\Philips
2008-06-06 16:52 . 2004-08-04 10:34 54,272 --a------ C:\WINDOWS\SYSTEM32\vfwwdm32.dll
2008-06-06 16:52 . 2004-08-04 10:34 54,272 --a------ C:\WINDOWS\SYSTEM32\DLLCACHE\vfwwdm32.dll
2008-06-04 21:45 . 2008-06-04 21:45 <KAT> d-------- C:\Documents and Settings\All Users\Application Data\CanonIJPLM
2008-06-04 21:42 . 2008-06-04 21:42 <KAT> d-------- C:\Program\Delade filer\ScanSoft Shared
2008-06-04 21:42 . 2008-06-04 21:42 <KAT> d-------- C:\Documents and Settings\Leif Nilsson\Application Data\ScanSoft
2008-06-04 21:42 . 2008-06-04 21:42 <KAT> d-------- C:\Documents and Settings\All Users\Application Data\ScanSoft
2008-06-04 21:42 . 2008-06-04 21:42 <KAT> d-------- C:\Documents and Settings\All Users\Application Data\InstallShield
2008-06-04 21:42 . 2008-06-04 21:42 400 --a------ C:\WINDOWS\MAXLINK.INI
2008-06-04 21:41 . 2008-06-04 21:41 <KAT> d-------- C:\Program\ScanSoft
2008-06-04 21:39 . 2008-06-04 21:39 <KAT> d--h----- C:\Documents and Settings\All Users\Application Data\CanonBJ
2008-06-04 21:38 . 2008-06-04 21:38 <KAT> d--h----- C:\WINDOWS\SYSTEM32\CanonIJ Uninstaller Information
2008-06-04 21:38 . 2008-06-04 21:38 <KAT> d--h----- C:\Program\CanonBJ
2008-06-04 21:38 . 2008-06-04 21:45 <KAT> d-------- C:\Program\Canon
2008-06-04 21:38 . 2006-12-25 22:00 198,656 --a------ C:\WINDOWS\SYSTEM32\CNMLM8R.DLL
2008-06-04 18:15 . 2008-06-06 18:50 <KAT> d-------- C:\Documents and Settings\Leif Nilsson\Application Data\Canon
2008-06-04 18:14 . 2004-08-04 08:01 25,856 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\usbprint.sys
2008-06-04 18:14 . 2004-08-04 08:01 25,856 --a------ C:\WINDOWS\SYSTEM32\DLLCACHE\usbprint.sys
2008-06-03 18:12 . 2008-06-03 18:12 <KAT> d-------- C:\Program\FMS
2008-05-16 11:58 . 2008-05-16 11:58 12,632 --a------ C:\WINDOWS\SYSTEM32\lsdelete.exe
2008-05-01 23:08 . 2008-05-01 23:08 <KAT> d-------- C:\Program\SubSync
2008-05-01 23:08 . 2008-05-01 23:08 249,856 --------- C:\WINDOWS\Setup1.exe
2008-05-01 23:08 . 2008-05-01 23:08 73,216 --a------ C:\WINDOWS\ST6UNST.EXE
2008-05-01 23:06 . 2008-05-01 23:06 <KAT> d-------- C:\Program\Gabest
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-06-30 18:48 --------- d-----w C:\Program\Java
2008-06-29 21:05 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-28 19:19 --------- d-----w C:\Program\DC++
2008-06-28 16:11 --------- d-----w C:\Documents and Settings\Leif Nilsson\Application Data\Azureus
2008-06-28 10:22 --------- d-----w C:\Documents and Settings\Leif Nilsson\Application Data\dvdcss
2008-06-27 21:50 --------- d-----w C:\Program\FlashFXP
2008-06-27 19:09 20 ----a-w C:\sccfg.sys
2008-06-26 21:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-26 21:05 --------- d-----w C:\Program\Spybot - Search & Destroy
2008-06-25 21:26 --------- d-----w C:\Program\Elaborate Bytes
2008-06-17 19:17 --------- d-----w C:\Program\Azureus
2008-06-15 19:35 --------- d-----w C:\Documents and Settings\Leif Nilsson\Application Data\DemoCreator
2008-06-14 18:01 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-04 20:37 --------- d-----w C:\Program\FirstClass
2008-06-04 19:42 --------- d-----w C:\Program\Delade filer\InstallShield
2008-06-02 23:36 --------- d-----w C:\Program\Google
2008-05-19 20:22 --------- d-----w C:\Program\Winamp
2008-05-17 11:26 --------- d-----w C:\Program\Folder Lock
2008-05-11 17:27 --------- d-----w C:\Documents and Settings\Leif Nilsson\Application Data\AdobeUM
2008-05-08 20:01 --------- d-----w C:\Program\Opera
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-04-29 09:20 15,648 ----a-w C:\WINDOWS\system32\drivers\NSDriver.sys
2008-04-29 09:19 15,648 ----a-w C:\WINDOWS\system32\drivers\Awrtrd.sys
2008-04-29 09:19 12,960 ----a-w C:\WINDOWS\system32\drivers\Awrtpd.sys
.
((((((((((((((((((((((((((((( snapshot@2008-06-29_23.03.03.37 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-29 20:55:39 2,048 --s-a-w C:\WINDOWS\BOOTSTAT.DAT
+ 2008-06-30 18:59:15 2,048 --s-a-w C:\WINDOWS\BOOTSTAT.DAT
- 2008-02-22 00:23:35 135,168 ----a-w C:\WINDOWS\SYSTEM32\java.exe
+ 2008-03-24 23:28:39 135,168 ----a-w C:\WINDOWS\SYSTEM32\java.exe
- 2008-02-22 00:23:39 135,168 ----a-w C:\WINDOWS\SYSTEM32\javaw.exe
+ 2008-03-24 23:28:43 135,168 ----a-w C:\WINDOWS\SYSTEM32\javaw.exe
- 2008-02-22 01:33:32 139,264 ----a-w C:\WINDOWS\SYSTEM32\javaws.exe
+ 2008-03-25 00:37:01 139,264 ----a-w C:\WINDOWS\SYSTEM32\javaws.exe
- 2008-06-29 17:55:02 71,884 ----a-w C:\WINDOWS\SYSTEM32\PERFC009.DAT
+ 2008-06-30 18:24:04 71,884 ----a-w C:\WINDOWS\SYSTEM32\PERFC009.DAT
- 2008-06-29 17:55:02 83,760 ----a-w C:\WINDOWS\SYSTEM32\perfc01D.dat
+ 2008-06-30 18:24:04 83,760 ----a-w C:\WINDOWS\SYSTEM32\perfc01D.dat
- 2008-06-29 17:55:02 425,500 ----a-w C:\WINDOWS\SYSTEM32\PERFH009.DAT
+ 2008-06-30 18:24:04 425,500 ----a-w C:\WINDOWS\SYSTEM32\PERFH009.DAT
- 2008-06-29 17:55:02 428,088 ----a-w C:\WINDOWS\SYSTEM32\perfh01D.dat
+ 2008-06-30 18:24:04 428,088 ----a-w C:\WINDOWS\SYSTEM32\perfh01D.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yak!"="C:\Program\Yak!\Yak.exe" [ ]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program\Delade filer\Ahead\Lib\NMBgMonitor.exe" [ ]
"updateMgr"="C:\Program\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UpdateManager"="C:\Program\Delade filer\Sonic\Update Manager\sgtray.exe" [2003-08-19 02:01 110592]
"PCMService"="C:\Program\Dell\Media Experience\PCMService.exe" [2004-04-11 21:15 290816]
"IAAnotif"="C:\Program\Intel\Intel Application Accelerator\iaanotif.exe" [2004-06-29 12:23 135168]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-03-15 02:04 122933]
"ATIPTA"="C:\Program\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-05-25 23:35 335872]
"Name of App"="C:\Program\SAMSUNG\FW LiveUpdate\Liveupdate.exe" [ ]
"SpySweeper"="C:\Program\Webroot\Spy Sweeper\SpySweeper.exe" [ ]
"Virtual PDF Printer"="C:\Program\Virtual PDF Printer\VirtualPDFPrinter.exe" [ ]
"OCAudioIni"="C:\Program\One-click Audio Converter\OCAudioIni.exe" [ ]
"DeltTray"="DeltTray.exe" [2004-08-26 23:43 56320 C:\WINDOWS\SYSTEM32\delttray.exe]
"H2O"="C:\Program\SyncroSoft\Pos\H2O\cledx.exe" [2005-10-23 00:00 385024]
"QuickTime Task"="C:\Program\QuickTime\qttask.exe" [2008-02-01 00:13 385024]
"iTunesHelper"="C:\Program\iTunes\iTunesHelper.exe" [2008-02-04 15:18 267048]
"SSBkgdUpdate"="C:\Program\Delade filer\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 09:03 210472]
"OpwareSE4"="C:\Program\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 12:02 79400]
"SPC610NC_Monitor"="C:\WINDOWS\Philips\SPC610NC\Monitor.exe" [2006-11-03 11:01 319488]
"AVG8_TRAY"="C:\Program\AVG\AVG8\avgtray.exe" [2008-06-08 11:04 1177368]
"BMabb8e64a"="C:\WINDOWS\system32\inbbvqxp.dll" [ ]
"SunJavaUpdateSched"="C:\Program\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 10:34 15360]
"Oaph"="C:\WINDOWS\CROSOF~1\regsvr32.exe" [ ]
"uqqw"="C:\Program\DELADE~1\uqqw\uqqwm.exe" [ ]
C:\Documents and Settings\Leif Nilsson\Start-meny\Program\Autostart\
Adobe Gamma.lnk - C:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 20:16:50 113664]
C:\Documents and Settings\All Users\Start-meny\Program\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
Microsoft Office.lnk - C:\Program\Microsoft Office\Office\OSA9.EXE [1999-02-17 21:05:56 65588]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"AllowLegacyWebView"= 1 (0x1)
"AllowUnhashedWebView"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.VP31"= vp31vfw.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program\\Messenger\\msmsgs.exe"=
"C:\\Documents and Settings\\Leif Nilsson\\Skrivbord\\Linus heter Jag\\Qwix\\Qwix.exe"=
"C:\\Program\\FlashFXP\\flashfxp.exe"=
"C:\\Program\\DC++\\DCPlusPlus.exe"=
"C:\\WINDOWS\\SYSTEM32\\MediaServerDump\\LiveUpdate\\OLUpdate.exe"=
"C:\\Program\\XLink Kai Evolution VII\\kaiLaunch.exe"=
"C:\\Program\\Azureus\\Azureus.exe"=
"C:\\Program\\Glocalnet Bredband\\Bredbandsklienten\\GlocalnetBredband.exe"=
"C:\\Program\\Glocalnet Bredband\\Bredbandsklienten\\GlocalnetBredbandService.exe"=
"C:\\Program\\TVersity\\Media Server\\TVersity.exe"=
"C:\\Program\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program\\MSN Messenger\\livecall.exe"=
"C:\\WINDOWS\\SYSTEM32\\dplaysvr.exe"=
"C:\\WINDOWS\\SYSTEM32\\ftp.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program\\XLink Kai Evolution VII\\kaiEngine.exe"=
"C:\\Program\\Skype\\Phone\\Skype.exe"=
"C:\\Program\\iTunes\\iTunes.exe"=
"C:\\Program\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program\\AVG\\AVG8\\avgemc.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"41952:TCP"= 41952:TCP:Tversity
R0 sonypvl2;sonypvl2;C:\WINDOWS\system32\drivers\sonypvl2.sys [2003-07-25 15:02]
R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-06-08 11:04]
R1 sonypvf2;sonypvf2;C:\WINDOWS\system32\drivers\sonypvf2.sys [2003-08-20 10:51]
R1 sonypvt2;sonypvt2;C:\WINDOWS\system32\drivers\sonypvt2.sys [2003-08-20 10:44]
R2 avg8emc;AVG8 E-mail Scanner;C:\Program\AVG\AVG8\avgemc.exe [2008-06-08 11:04]
R2 avg8wd;AVG8 WatchDog;C:\Program\AVG\AVG8\avgwdsvc.exe [2008-06-08 11:04]
R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-06-08 11:04]
R2 GlocalnetBredbandClientService;Glocalnet Bredband;C:\Program\Glocalnet Bredband\Bredbandsklienten\GlocalnetBredbandService.exe [2007-01-03 00:27]
R2 IJPLMSVC;PIXMA Extended Survey Program;C:\Program\Canon\IJPLM\IJPLMSVC.EXE [2006-11-10 08:12]
R3 CLEDX;Team H2O CLEDX service;C:\WINDOWS\system32\DRIVERS\cledx.sys [2005-05-09 20:08]
S1 sonypvd2;sonypvd2;C:\WINDOWS\system32\DRIVERS\sonypvd2.sys [2003-06-24 10:29]
S2 csrs;Windows Security Drivers;"C:\WINDOWS\csrss.exe" []
S3 pcwe;pcwe;C:\Program\PC Wizard 2007\pcw86-32.sys []
S3 PsSdk30;PsSdk30;C:\WINDOWS\system32\Drivers\PsSdk30.drv []
S3 SPC610NC;SPC 610NC Laptop Camera;C:\WINDOWS\system32\DRIVERS\SPC610NC.SYS [2007-01-19 17:14]
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4e5503bc-f143-11d9-b7c6-0011113120ed}]
\Shell\AutoRun\command - H:\Setup.exe
\Shell\setup\command - H:\setup.exe
.
Contents of the 'Scheduled Tasks' folder
"2008-06-12 08:51:07 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-06-30 20:59:43
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\System\ControlSet002\Services\PsSdk30]
"ImagePath"="\??\C:\WINDOWS\system32\Drivers\PsSdk30.drv"
.
------------------------ Other Running Processes ------------------------
.
C:\WINDOWS\SYSTEM32\ati2evxx.exe
C:\Program\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\SYSTEM32\ati2evxx.exe
C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program\Intel\Intel Application Accelerator\IAANTmon.exe
C:\Program\TVersity\Media Server\MediaServer.exe
C:\Program\iPod\bin\iPodService.exe
C:\Program\AVG\AVG8\avgrsx.exe
.
**************************************************************************
.
Completion time: 2008-06-30 21:07:15 - machine was rebooted
ComboFix-quarantined-files.txt 2008-06-30 19:07:12
ComboFix2.txt 2008-06-29 21:09:49
ComboFix3.txt 2008-06-29 21:03:28
Pre-Run: 46,003,810,304 byte ledigt
Post-Run: 45,985,705,984 byte ledigt
260 --- E O F --- 2008-06-20 21:08:13
---
Hijackthis:
---
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:14:56, on 2008-06-30
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Program\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program\AVG\AVG8\avgwdsvc.exe
C:\Program\Glocalnet Bredband\Bredbandsklienten\GlocalnetBredbandService.exe
C:\Program\Intel\Intel Application Accelerator\iaantmon.exe
C:\Program\Canon\IJPLM\IJPLMSVC.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program\TVersity\Media Server\MediaServer.exe
C:\Program\AVG\AVG8\avgemc.exe
C:\Program\Dell\Media Experience\PCMService.exe
C:\Program\Intel\Intel Application Accelerator\iaanotif.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\DeltTray.exe
C:\Program\SyncroSoft\Pos\H2O\cledx.exe
C:\Program\iTunes\iTunesHelper.exe
C:\Program\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\WINDOWS\Philips\SPC610NC\Monitor.exe
C:\Program\Java\jre1.6.0_06\bin\jusched.exe
C:\Program\iPod\bin\iPodService.exe
C:\WINDOWS\explorer.exe
C:\Program\AVG\AVG8\avgrsx.exe
C:\Program\AVG\AVG8\avgrsx.exe
C:\Program\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.se/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/countries/se/sve/gen/default.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.6.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [UpdateManager] "C:\Program\Delade filer\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [PCMService] "C:\Program\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [IAAnotif] C:\Program\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Name of App] C:\Program\SAMSUNG\FW LiveUpdate\Liveupdate.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKLM\..\Run: [Virtual PDF Printer] C:\Program\Virtual PDF Printer\VirtualPDFPrinter.exe
O4 - HKLM\..\Run: [OCAudioIni] C:\Program\One-click Audio Converter\OCAudioIni.exe
O4 - HKLM\..\Run: [DeltTray] DeltTray.exe
O4 - HKLM\..\Run: [H2O] C:\Program\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program\Delade filer\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [SPC610NC_Monitor] C:\WINDOWS\Philips\SPC610NC\Monitor.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\Program\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] C:\Program\Java\jre1.6.0_06\bin\jusched.exe
O4 - HKCU\..\Run: [Yak!] C:\Program\Yak!\Yak.exe
O4 - HKCU\..\Run: "C:\Program\Delade filer\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJÄNST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - blank (file missing)
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - blank (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program\DELADE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program\Delade filer\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\Program\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\Program\AVG\AVG8\avgwdsvc.exe
O23 - Service: Windows Security Drivers (csrs) - Unknown owner - C:\WINDOWS\csrss.exe (file missing)
O23 - Service: Glocalnet Bredband (GlocalnetBredbandClientService) - Glocalnet AB - C:\Program\Glocalnet Bredband\Bredbandsklienten\GlocalnetBredbandService.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: iPod Service - Apple Inc. - C:\Program\iPod\bin\iPodService.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program\Delade filer\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program\WinPcap\rpcapd.exe
O23 - Service: TVersityMediaServer - Unknown owner - C:\Program\TVersity\Media Server\MediaServer.exe
--
End of file - 8106 bytes
---
[B]The computer is now running allot better. The performance went up to, what I could tell, normal speed as soon as I did the first Combofix scan. I recently reconnected to the Internet (I have been using a second computer to access this forum) and tried to search Google in both Mozilla and Opera. It was successful! I have now disconnected once again and will stay so until you say otherwise.
Thank you very much for your help.
/Ontrop.
pskelley
2008-06-30, 23:37
Thanks for returning your information, and the feedback, you said:
I tried to Google it, but got nothing. Do you know anything about this program?The answer is no, I could not get information either, which was why I asked you.
Please let me see an uninstall list:
Open Hijackthis.
Click the "Open the Misc Tools" section Button.
Click the "Open Uninstall Manager" Button.
Click the "Save list..." Button.
Save it to your desktop. Copy and paste the contents into your reply.
(You may edit out Microsoft, Hotfixes, Security Update for Windows XP,
Update for Windows XP and Windows XP Hotfix to shorten the list)
I am sure you saw this:
WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
http://www.bleepingcomputer.com/combofix/how-to-use-combofix
Review that information to understand Recovery Console. Installation is optional but if you do not have the CD's needed, as is explained, it can be installed before we remove combofix.
If you do not have access to Recovery Console via a Windows CD, I strongly advise you to install this tool.
If you do not wish to install RC, let me know so I can continue with the cleanup.
If you install RC, post the C:\*CF-RC.txt*.
Since we do not need to scan with combofix, click NO
http://img.photobucket.com/albums/v666/sUBs/RC_whatnext.gif
http://img.photobucket.com/albums/v666/sUBs/RC_AllDone.gif
Thanks
Thank you. The only page I found about Yak! is this one:
http://siteadvisor.se/sites/silversand.net/downloads/10824209/
It is in swedish though. A translated summary would be:
"In our test yak.exe did not change the system registry or any files on the harddrive". I do not however know how accountable silversand.net is.
This is the uninstall log from Hijackthis:
---
Ad-Aware
Adobe Common File Installer
Adobe Flash Player 9 ActiveX
Adobe Flash Player Plugin
Adobe Help Center 1.0
Adobe Photoshop Album 2.0 Starter Edition
Adobe Photoshop CS2
Adobe Reader 7.0.9
Adobe Stock Photos 1.0
Amazing Slow Downer (remove only)
AP Tuner 3.06
Apple Mobile Device Support
Apple Software Update
ArcSoft Camera Suite 1.3
ATI - Software Uninstall Utility
ATI Control Panel
ATI Display Driver
Audacity 1.2.6
AVG Free 8.0
Azureus
Broadcom Advanced Control Suite 2
CallMe
Canon MP Navigator 3.1
Canon MP140 series
Canon MP140 series användarregistrering
Canon Utilities Easy-LayoutPrint
Canon Utilities Easy-PhotoPrint
CDisplay 1.8
DAEMON Tools
Dell Media Experience
Dell Solution Center
Delta
Dev-C++ 5 beta 9 release (4.9.9.2)
Digidesign Shared Plug-Ins 7.4
EPSON Printer Software
ESC64 programvaruguide
ffdshow [rev 1324] [2007-07-01]
File Writer output plugin for WinAMP 2 v1.17(c) (remove only)
FirstClass® Client
FlashFXP v3.02 (Build 1044) Scene Edition (Repack)
FMS
Folder Lock
Glocalnet Bredband
Google Earth
Guitar Pro 5.1
HijackThis 2.0.2
ImageMixer for Sony DVD Handycam
ImgBurn
Intel Application Accelerator
Interlok driver setup x32
iriver plus 3 (remove only)
iTunes
J2SE Runtime Environment 5.0 Update 11
Jasc Paint Shop Photo Album
Java(TM) 6 Update 6
K-Lite Codec Pack 2.72 Basic
Macromedia Dreamweaver 8
Macromedia Extension Manager
Macromedia Flash 8
Macromedia Flash 8 Video Encoder
Macromedia Flash Player 8
Macromedia Shockwave Player
Magic ISO Maker v5.4 (build 0239)
MicroStaff WINASPI
Mozilla Firefox (3.0)
MSXML 4.0 SP2 (KB936181)
neroxml
On2 VP3 Video for Windows Codec
Opera 9.21
PIXMA Extended Survey Program
Power Tab Editor 1.7
QuickTime
ScanSoft OmniPage SE 4
Screen VidShot
Skype 3.1
Skype Plugin Manager
Sonic DLA
Sonic RecordNow!
Sonic Update Manager
Sony DVD Architect 3.0
Sony DVD Handycam USB Driver
Sony Media Manager 2.0
Sony Vegas 6.0
Spybot - Search & Destroy
SubSync
TVersity Codec Pack 1.1
TVersity Media Server 0.9.11.4 beta
TVersity Media Server 0.9.10.8a beta
VideoLAN VLC media player 0.8.6c
Winamp
Windows Genuine Advantage v1.3.0254.0
Windows Installer 3.1 (KB893803)
Windows Internet Explorer 7
Windows Live Messenger
Windows Media Format 11 runtime
Windows Media Format 11 runtime
Windows Media Player 11
Windows Media Player 11
Windows XP Service Pack 2
WinPcap 3.1
WinRAR archiver
VobSub v2.23 (Remove Only)
XLink Kai Evolution 7
---
This is the RC log from Combofix:
---
WindowsXP-KB310994-SP2-Home-BootDisk-SVE.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS
[operating systems]
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /NoExecute=OptIn
C:\CMDCONS\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
---
Thanks.
/Ontrop.
pskelley
2008-07-01, 22:28
Thanks for returning your information and the feedback, do you wonder how a program got on your computer without your knowledge?
Uninstall list: I am looking for security issue and malware, it is a good chance for you to look for programs you no longer use to give your computer a break.
J2SE Runtime Environment 5.0 Update 11 << old Java, uninstall and see this:
http://forums.spybot.info/showpost.php?p=12880&postcount=2
That's all I see, the Recovery Console was installed correctly. I see no uninstall for C:\Program\Yak!\Yak.exe so let's use CFScript while we still have it.
1) Disable the Service
Click Start > Run and type services.msc
Scroll down to Windows Security Drivers and right click on it.
Click Properties and under Service Status click Stop, then under Startup Type change it to Disabled.
2) Open notepad and copy/paste the text in the codebox below into it:
File::
C:\WINDOWS\csrss.exe
Folder::
C:\Program\Yak!
Save this as CFScript
http://i24.photobucket.com/albums/c30/ken545/CFScript.gif
Referring to the picture above, drag CFScript into ComboFix.exe.
This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.
Thanks
Thanks for returning your information and the feedback, do you wonder how a program got on your computer without your knowledge?
Thank you for your quick response. I do wonder how Yak! got onto my computer. I fear that the answer is not "lack of protective software", but rather "careless handling". This is easily the most aggressive spyware I have ever come acrossed and it really extended far beyond my knowledge. Im very thankful, and impressed, by what you and all the other experts do for free here at Spybot forum. Thank you.
Combofix log:
---
ComboFix 08-06-20.4 - Leif Nilsson 2008-07-01 22:28:25.4 - NTFSx86
Running from: C:\Documents and Settings\Leif Nilsson\Skrivbord\ComboFix.exe
Command switches used :: C:\Documents and Settings\Leif Nilsson\Skrivbord\CFScript.txt
* Created a new restore point
FILE ::
C:\WINDOWS\csrss.exe
.
((((((((((((((((((((((((( Files Created from 2008-06-01 to 2008-07-01 )))))))))))))))))))))))))))))))
.
2008-06-30 20:47 . 2008-03-25 02:37 69,632 --a------ C:\WINDOWS\SYSTEM32\javacpl.cpl
2008-06-29 23:03 . 2008-06-30 21:07 <KAT> d-------- C:\WINDOWS\SYSTEM32\CONFIG\systemprofile\Lokala instõllningar
2008-06-29 23:03 . 2008-06-30 21:07 <KAT> d-------- C:\Documents and Settings\Win98\Lokala instõllningar
2008-06-29 23:03 . 2008-06-30 21:07 <KAT> d-------- C:\Documents and Settings\NetworkService\Lokala instõllningar
2008-06-29 23:03 . 2008-06-30 21:07 <KAT> d-------- C:\Documents and Settings\LocalService\Lokala instõllningar
2008-06-29 23:03 . 2008-06-30 21:07 <KAT> d-------- C:\Documents and Settings\Leif Nilsson\Lokala instõllningar
2008-06-29 23:03 . 2008-06-29 23:03 <KAT> d-------- C:\Documents and Settings\Administrat÷r
2008-06-28 17:44 . 2008-06-28 17:44 <KAT> d-------- C:\Program\Trend Micro
2008-06-28 17:20 . 2008-07-01 20:24 54,156 --ah----- C:\WINDOWS\QTFont.qfn
2008-06-28 17:20 . 2008-06-28 17:20 1,409 --a------ C:\WINDOWS\QTFont.for
2008-06-28 14:38 . 2008-06-28 14:38 <KAT> d-------- C:\WINDOWS\%DownloadedProgramFiles%
2008-06-28 14:36 . 2006-07-27 13:52 367 --a------ C:\WINDOWS\SYSTEM32\LegitCheckControl.inf
2008-06-26 21:02 . 2008-06-26 21:02 <KAT> d-------- C:\Program\Lavasoft
2008-06-26 21:02 . 2008-06-26 21:02 <KAT> d-------- C:\Program\Delade filer\Wise Installation Wizard
2008-06-26 21:02 . 2008-06-26 21:04 <KAT> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
2008-06-25 23:29 . 2008-06-25 23:29 <KAT> d-------- C:\Documents and Settings\Leif Nilsson\Application Data\Elaborate Bytes
2008-06-24 23:41 . 2008-06-26 22:36 <KAT> d--h----- C:\$AVG8.VAULT$
2008-06-18 23:06 . 2008-06-18 23:19 <KAT> d-------- C:\Documents and Settings\Leif Nilsson\Application Data\winpt
2008-06-18 23:03 . 2008-06-18 23:03 <KAT> d-------- C:\Program\GNU
2008-06-18 23:03 . 2008-06-18 23:06 <KAT> d-------- C:\Documents and Settings\Leif Nilsson\Application Data\gnupg
2008-06-18 13:19 . 2008-06-18 13:34 <KAT> d-------- C:\Documents and Settings\Leif Nilsson\dwhelper
2008-06-13 19:36 . 2008-06-13 19:36 <KAT> d-------- C:\Dev-Pas
2008-06-13 18:41 . 2008-06-13 18:41 <KAT> d-------- C:\FPC
2008-06-11 18:58 . 2008-06-11 18:58 <KAT> d-------- C:\Dev-Cpp
2008-06-08 11:04 . 2008-06-28 08:24 <KAT> d-------- C:\WINDOWS\SYSTEM32\DRIVERS\Avg
2008-06-08 11:04 . 2008-06-08 11:04 <KAT> d-------- C:\Program\AVG
2008-06-08 11:04 . 2008-06-08 11:04 <KAT> d-------- C:\Documents and Settings\All Users\Application Data\avg8
2008-06-08 11:04 . 2008-06-08 11:04 96,520 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\avgldx86.sys
2008-06-08 11:04 . 2008-06-08 11:04 75,272 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\avgtdix.sys
2008-06-08 11:04 . 2008-06-08 11:04 10,520 --a------ C:\WINDOWS\SYSTEM32\avgrsstx.dll
2008-06-06 16:52 . 2008-06-06 16:52 <KAT> d-------- C:\WINDOWS\Philips
2008-06-06 16:52 . 2004-08-04 10:34 54,272 --a------ C:\WINDOWS\SYSTEM32\vfwwdm32.dll
2008-06-06 16:52 . 2004-08-04 10:34 54,272 --a------ C:\WINDOWS\SYSTEM32\DLLCACHE\vfwwdm32.dll
2008-06-04 21:45 . 2008-06-04 21:45 <KAT> d-------- C:\Documents and Settings\All Users\Application Data\CanonIJPLM
2008-06-04 21:42 . 2008-06-04 21:42 <KAT> d-------- C:\Program\Delade filer\ScanSoft Shared
2008-06-04 21:42 . 2008-06-04 21:42 <KAT> d-------- C:\Documents and Settings\Leif Nilsson\Application Data\ScanSoft
2008-06-04 21:42 . 2008-06-04 21:42 <KAT> d-------- C:\Documents and Settings\All Users\Application Data\ScanSoft
2008-06-04 21:42 . 2008-06-04 21:42 <KAT> d-------- C:\Documents and Settings\All Users\Application Data\InstallShield
2008-06-04 21:42 . 2008-06-04 21:42 400 --a------ C:\WINDOWS\MAXLINK.INI
2008-06-04 21:41 . 2008-06-04 21:41 <KAT> d-------- C:\Program\ScanSoft
2008-06-04 21:39 . 2008-06-04 21:39 <KAT> d--h----- C:\Documents and Settings\All Users\Application Data\CanonBJ
2008-06-04 21:38 . 2008-06-04 21:38 <KAT> d--h----- C:\WINDOWS\SYSTEM32\CanonIJ Uninstaller Information
2008-06-04 21:38 . 2008-06-04 21:38 <KAT> d--h----- C:\Program\CanonBJ
2008-06-04 21:38 . 2008-06-04 21:45 <KAT> d-------- C:\Program\Canon
2008-06-04 21:38 . 2006-12-25 22:00 198,656 --a------ C:\WINDOWS\SYSTEM32\CNMLM8R.DLL
2008-06-04 18:15 . 2008-06-06 18:50 <KAT> d-------- C:\Documents and Settings\Leif Nilsson\Application Data\Canon
2008-06-04 18:14 . 2004-08-04 08:01 25,856 --a------ C:\WINDOWS\SYSTEM32\DRIVERS\usbprint.sys
2008-06-04 18:14 . 2004-08-04 08:01 25,856 --a------ C:\WINDOWS\SYSTEM32\DLLCACHE\usbprint.sys
2008-06-03 18:12 . 2008-06-03 18:12 <KAT> d-------- C:\Program\FMS
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-07-01 20:22 --------- d-----w C:\Program\Java
2008-06-29 21:05 --------- d---a-w C:\Documents and Settings\All Users\Application Data\TEMP
2008-06-28 19:19 --------- d-----w C:\Program\DC++
2008-06-28 16:11 --------- d-----w C:\Documents and Settings\Leif Nilsson\Application Data\Azureus
2008-06-28 10:22 --------- d-----w C:\Documents and Settings\Leif Nilsson\Application Data\dvdcss
2008-06-27 21:50 --------- d-----w C:\Program\FlashFXP
2008-06-27 19:09 20 ----a-w C:\sccfg.sys
2008-06-26 21:08 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-06-26 21:05 --------- d-----w C:\Program\Spybot - Search & Destroy
2008-06-25 21:26 --------- d-----w C:\Program\Elaborate Bytes
2008-06-17 19:17 --------- d-----w C:\Program\Azureus
2008-06-15 19:35 --------- d-----w C:\Documents and Settings\Leif Nilsson\Application Data\DemoCreator
2008-06-14 18:01 272,128 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\bthport.sys
2008-06-14 18:01 272,128 ------w C:\WINDOWS\system32\drivers\bthport.sys
2008-06-04 20:37 --------- d-----w C:\Program\FirstClass
2008-06-04 19:42 --------- d-----w C:\Program\Delade filer\InstallShield
2008-06-02 23:36 --------- d-----w C:\Program\Google
2008-05-19 20:22 --------- d-----w C:\Program\Winamp
2008-05-17 11:26 --------- d-----w C:\Program\Folder Lock
2008-05-16 09:58 12,632 ----a-w C:\WINDOWS\SYSTEM32\lsdelete.exe
2008-05-11 17:27 --------- d-----w C:\Documents and Settings\Leif Nilsson\Application Data\AdobeUM
2008-05-08 20:01 --------- d-----w C:\Program\Opera
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
2008-05-08 12:28 202,752 ----a-w C:\WINDOWS\SYSTEM32\DLLCACHE\rmcast.sys
2008-05-07 05:16 1,289,728 ----a-w C:\WINDOWS\SYSTEM32\quartz.dll
2008-05-07 05:16 1,289,728 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\quartz.dll
2008-05-01 21:08 73,216 ----a-w C:\WINDOWS\ST6UNST.EXE
2008-05-01 21:08 249,856 ------w C:\WINDOWS\Setup1.exe
2008-05-01 21:08 --------- d-----w C:\Program\SubSync
2008-05-01 21:06 --------- d-----w C:\Program\Gabest
2008-04-17 10:46 18,432 ------w C:\WINDOWS\SYSTEM32\DLLCACHE\iedw.exe
2003-09-15 23:19 99,544 ----a-w C:\WINDOWS\INF\virprn.exe
2003-09-15 23:19 90,624 ----a-w C:\WINDOWS\INF\prtproc.dll
2003-09-15 23:19 18,950 ----a-w C:\WINDOWS\INF\virpntd.dll
2003-09-15 23:19 10,240 ----a-w C:\WINDOWS\INF\virport.dll
.
((((((((((((((((((((((((((((( snapshot@2008-06-29_23.03.03.37 )))))))))))))))))))))))))))))))))))))))))
.
- 2008-06-29 20:55:39 2,048 --s-a-w C:\WINDOWS\BOOTSTAT.DAT
+ 2008-07-01 18:23:35 2,048 --s-a-w C:\WINDOWS\BOOTSTAT.DAT
- 2008-02-22 00:23:35 135,168 ----a-w C:\WINDOWS\SYSTEM32\java.exe
+ 2008-03-24 23:28:39 135,168 ----a-w C:\WINDOWS\SYSTEM32\java.exe
- 2008-02-22 00:23:39 135,168 ----a-w C:\WINDOWS\SYSTEM32\javaw.exe
+ 2008-03-24 23:28:43 135,168 ----a-w C:\WINDOWS\SYSTEM32\javaw.exe
- 2008-02-22 01:33:32 139,264 ----a-w C:\WINDOWS\SYSTEM32\javaws.exe
+ 2008-03-25 00:37:01 139,264 ----a-w C:\WINDOWS\SYSTEM32\javaws.exe
- 2008-06-29 17:55:02 71,884 ----a-w C:\WINDOWS\SYSTEM32\PERFC009.DAT
+ 2008-07-01 18:28:53 71,884 ----a-w C:\WINDOWS\SYSTEM32\PERFC009.DAT
- 2008-06-29 17:55:02 83,760 ----a-w C:\WINDOWS\SYSTEM32\perfc01D.dat
+ 2008-07-01 18:28:53 83,760 ----a-w C:\WINDOWS\SYSTEM32\perfc01D.dat
- 2008-06-29 17:55:02 425,500 ----a-w C:\WINDOWS\SYSTEM32\PERFH009.DAT
+ 2008-07-01 18:28:53 425,500 ----a-w C:\WINDOWS\SYSTEM32\PERFH009.DAT
- 2008-06-29 17:55:02 428,088 ----a-w C:\WINDOWS\SYSTEM32\perfh01D.dat
+ 2008-07-01 18:28:53 428,088 ----a-w C:\WINDOWS\SYSTEM32\perfh01D.dat
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Yak!"="C:\Program\Yak!\Yak.exe" [ ]
"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program\Delade filer\Ahead\Lib\NMBgMonitor.exe" [ ]
"updateMgr"="C:\Program\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" [2006-03-30 16:45 313472]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"UpdateManager"="C:\Program\Delade filer\Sonic\Update Manager\sgtray.exe" [2003-08-19 02:01 110592]
"PCMService"="C:\Program\Dell\Media Experience\PCMService.exe" [2004-04-11 21:15 290816]
"IAAnotif"="C:\Program\Intel\Intel Application Accelerator\iaanotif.exe" [2004-06-29 12:23 135168]
"dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-03-15 02:04 122933]
"ATIPTA"="C:\Program\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-05-25 23:35 335872]
"Name of App"="C:\Program\SAMSUNG\FW LiveUpdate\Liveupdate.exe" [ ]
"SpySweeper"="C:\Program\Webroot\Spy Sweeper\SpySweeper.exe" [ ]
"Virtual PDF Printer"="C:\Program\Virtual PDF Printer\VirtualPDFPrinter.exe" [ ]
"OCAudioIni"="C:\Program\One-click Audio Converter\OCAudioIni.exe" [ ]
"DeltTray"="DeltTray.exe" [2004-08-26 23:43 56320 C:\WINDOWS\SYSTEM32\delttray.exe]
"H2O"="C:\Program\SyncroSoft\Pos\H2O\cledx.exe" [2005-10-23 00:00 385024]
"QuickTime Task"="C:\Program\QuickTime\qttask.exe" [2008-02-01 00:13 385024]
"iTunesHelper"="C:\Program\iTunes\iTunesHelper.exe" [2008-02-04 15:18 267048]
"SSBkgdUpdate"="C:\Program\Delade filer\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" [2006-10-25 09:03 210472]
"OpwareSE4"="C:\Program\ScanSoft\OmniPageSE4\OpwareSE4.exe" [2007-02-04 12:02 79400]
"SPC610NC_Monitor"="C:\WINDOWS\Philips\SPC610NC\Monitor.exe" [2006-11-03 11:01 319488]
"AVG8_TRAY"="C:\Program\AVG\AVG8\avgtray.exe" [2008-06-08 11:04 1177368]
"SunJavaUpdateSched"="C:\Program\Java\jre1.6.0_06\bin\jusched.exe" [2008-03-25 04:28 144784]
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 10:34 15360]
"Oaph"="C:\WINDOWS\CROSOF~1\regsvr32.exe" [ ]
"uqqw"="C:\Program\DELADE~1\uqqw\uqqwm.exe" [ ]
C:\Documents and Settings\Leif Nilsson\Start-meny\Program\Autostart\
Adobe Gamma.lnk - C:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe [2005-03-16 20:16:50 113664]
C:\Documents and Settings\All Users\Start-meny\Program\Autostart\
Adobe Reader Speed Launch.lnk - C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe [2005-09-23 22:05:26 29696]
Microsoft Office.lnk - C:\Program\Microsoft Office\Office\OSA9.EXE [1999-02-17 21:05:56 65588]
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"AllowLegacyWebView"= 1 (0x1)
"AllowUnhashedWebView"= 1 (0x1)
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\windows]
"AppInit_DLLs"=avgrsstx.dll
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"vidc.VP31"= vp31vfw.dll
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"C:\\Program\\Messenger\\msmsgs.exe"=
"C:\\Documents and Settings\\Leif Nilsson\\Skrivbord\\Linus heter Jag\\Qwix\\Qwix.exe"=
"C:\\Program\\FlashFXP\\flashfxp.exe"=
"C:\\Program\\DC++\\DCPlusPlus.exe"=
"C:\\WINDOWS\\SYSTEM32\\MediaServerDump\\LiveUpdate\\OLUpdate.exe"=
"C:\\Program\\XLink Kai Evolution VII\\kaiLaunch.exe"=
"C:\\Program\\Azureus\\Azureus.exe"=
"C:\\Program\\Glocalnet Bredband\\Bredbandsklienten\\GlocalnetBredband.exe"=
"C:\\Program\\Glocalnet Bredband\\Bredbandsklienten\\GlocalnetBredbandService.exe"=
"C:\\Program\\TVersity\\Media Server\\TVersity.exe"=
"C:\\Program\\MSN Messenger\\msnmsgr.exe"=
"C:\\Program\\MSN Messenger\\livecall.exe"=
"C:\\WINDOWS\\SYSTEM32\\dplaysvr.exe"=
"C:\\WINDOWS\\SYSTEM32\\ftp.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"C:\\Program\\XLink Kai Evolution VII\\kaiEngine.exe"=
"C:\\Program\\Skype\\Phone\\Skype.exe"=
"C:\\Program\\iTunes\\iTunes.exe"=
"C:\\Program\\AVG\\AVG8\\avgupd.exe"=
"C:\\Program\\AVG\\AVG8\\avgemc.exe"=
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
"41952:TCP"= 41952:TCP:Tversity
R0 sonypvl2;sonypvl2;C:\WINDOWS\system32\drivers\sonypvl2.sys [2003-07-25 15:02]
R1 AvgLdx86;AVG AVI Loader Driver x86;C:\WINDOWS\system32\Drivers\avgldx86.sys [2008-06-08 11:04]
R1 sonypvf2;sonypvf2;C:\WINDOWS\system32\drivers\sonypvf2.sys [2003-08-20 10:51]
R1 sonypvt2;sonypvt2;C:\WINDOWS\system32\drivers\sonypvt2.sys [2003-08-20 10:44]
R2 avg8emc;AVG8 E-mail Scanner;C:\Program\AVG\AVG8\avgemc.exe [2008-06-08 11:04]
R2 avg8wd;AVG8 WatchDog;C:\Program\AVG\AVG8\avgwdsvc.exe [2008-06-08 11:04]
R2 AvgTdiX;AVG8 Network Redirector;C:\WINDOWS\system32\Drivers\avgtdix.sys [2008-06-08 11:04]
R2 GlocalnetBredbandClientService;Glocalnet Bredband;C:\Program\Glocalnet Bredband\Bredbandsklienten\GlocalnetBredbandService.exe [2007-01-03 00:27]
R2 IJPLMSVC;PIXMA Extended Survey Program;C:\Program\Canon\IJPLM\IJPLMSVC.EXE [2006-11-10 08:12]
R3 CLEDX;Team H2O CLEDX service;C:\WINDOWS\system32\DRIVERS\cledx.sys [2005-05-09 20:08]
S1 sonypvd2;sonypvd2;C:\WINDOWS\system32\DRIVERS\sonypvd2.sys [2003-06-24 10:29]
S3 pcwe;pcwe;C:\Program\PC Wizard 2007\pcw86-32.sys []
S3 PsSdk30;PsSdk30;C:\WINDOWS\system32\Drivers\PsSdk30.drv []
S3 SPC610NC;SPC 610NC Laptop Camera;C:\WINDOWS\system32\DRIVERS\SPC610NC.SYS [2007-01-19 17:14]
S4 csrs;Windows Security Drivers;"C:\WINDOWS\csrss.exe" []
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{4e5503bc-f143-11d9-b7c6-0011113120ed}]
\Shell\AutoRun\command - H:\Setup.exe
\Shell\setup\command - H:\setup.exe
*Newly Created Service* - CATCHME
.
Contents of the 'Scheduled Tasks' folder
"2008-06-12 08:51:07 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
- C:\Program\Apple Software Update\SoftwareUpdate.exe
.
**************************************************************************
catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-07-01 22:32:48
Windows 5.1.2600 Service Pack 2 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
[HKEY_LOCAL_MACHINE\system\ControlSet002\Services\PsSdk30]
"ImagePath"="\??\C:\WINDOWS\system32\Drivers\PsSdk30.drv"
.
Completion time: 2008-07-01 22:34:15
ComboFix-quarantined-files.txt 2008-07-01 20:33:39
ComboFix2.txt 2008-06-30 19:07:16
ComboFix3.txt 2008-06-29 21:09:49
ComboFix4.txt 2008-06-29 21:03:28
Pre-Run: 45,961,334,784 byte ledigt
Post-Run: 45,942,632,448 byte ledigt
228 --- E O F --- 2008-06-20 21:08:13
---
Hijackthis:
---
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 22:45:43, on 2008-07-01
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program\AVG\AVG8\avgwdsvc.exe
C:\Program\Glocalnet Bredband\Bredbandsklienten\GlocalnetBredbandService.exe
C:\Program\Intel\Intel Application Accelerator\iaantmon.exe
C:\Program\Canon\IJPLM\IJPLMSVC.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program\AVG\AVG8\avgrsx.exe
C:\Program\Dell\Media Experience\PCMService.exe
C:\Program\Intel\Intel Application Accelerator\iaanotif.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\DeltTray.exe
C:\Program\SyncroSoft\Pos\H2O\cledx.exe
C:\Program\iTunes\iTunesHelper.exe
C:\Program\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\WINDOWS\Philips\SPC610NC\Monitor.exe
C:\Program\AVG\AVG8\avgemc.exe
C:\Program\iPod\bin\iPodService.exe
C:\Program\Java\jre1.6.0_06\bin\jusched.exe
C:\WINDOWS\explorer.exe
C:\Program\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.se/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/countries/se/sve/gen/default.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.6.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [UpdateManager] "C:\Program\Delade filer\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [PCMService] "C:\Program\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [IAAnotif] C:\Program\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Name of App] C:\Program\SAMSUNG\FW LiveUpdate\Liveupdate.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKLM\..\Run: [Virtual PDF Printer] C:\Program\Virtual PDF Printer\VirtualPDFPrinter.exe
O4 - HKLM\..\Run: [OCAudioIni] C:\Program\One-click Audio Converter\OCAudioIni.exe
O4 - HKLM\..\Run: [DeltTray] DeltTray.exe
O4 - HKLM\..\Run: [H2O] C:\Program\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program\Delade filer\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [SPC610NC_Monitor] C:\WINDOWS\Philips\SPC610NC\Monitor.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\Program\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKCU\..\Run: [Yak!] C:\Program\Yak!\Yak.exe
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program\Delade filer\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJÄNST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_06\bin\npjpi160_06.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_06\bin\npjpi160_06.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program\DELADE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program\Delade filer\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\Program\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\Program\AVG\AVG8\avgwdsvc.exe
O23 - Service: Glocalnet Bredband (GlocalnetBredbandClientService) - Glocalnet AB - C:\Program\Glocalnet Bredband\Bredbandsklienten\GlocalnetBredbandService.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: iPod Service - Apple Inc. - C:\Program\iPod\bin\iPodService.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program\Delade filer\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program\WinPcap\rpcapd.exe
O23 - Service: TVersityMediaServer - Unknown owner - C:\Program\TVersity\Media Server\MediaServer.exe
--
End of file - 7978 bytes
---
Thanks.
/Ontrop.
pskelley
2008-07-02, 00:14
Looks like CFScript did not show that folder as being removed so it is very likely it does not exist, let's check.
Make sure you can still view all files and folkers:
http://www.xtra.co.nz/help/0,,4155-1916458,00.html
Open HijackThis and choose "Do a system scan only" then check the box in front of these line items:
O4 - HKCU\..\Run: [Yak!] C:\Program\Yak!\Yak.exe
Close all programs but HJT and all browser windows, then click on "Fix Checked"
C:\Program\Yak!\ <<< delete that folder and contents if there.
Let's remove combofix like this:
Click START then RUN
Now type or copy Combofix /u in the runbox and click OK.
Note the space between the X and the U, it needs to be there.
http://i189.photobucket.com/albums/z176/EPL47/CF_Cleanup.png
Download Malwarebytes' Anti-Malware to your Desktop
http://www.besttechie.net/tools/mbam-setup.exe
* Double-click mbam-setup.exe and follow the prompts to install the program.
* Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
* If an update is found, it will download and install the latest version.
* Once the program has loaded, select Perform FULL SCAN, then click Scan.
* When the scan is complete, click OK, then Show Results to view the results.
* Be sure that everything is checked, and click Remove Selected.
* When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt
* Please post contents of that file & a new HJT log in your next reply.
Let me know about any malware issues.
Thanks
Malwarebytes reported two infected registrykeyes:
Adware.Minibug
Malware.Trace
*Both were quarantined and deleted.
Log (sorry, it is in swedish):
---
Malwarebytes' Anti-Malware 1.19
Databasversion: 912
Windows 5.1.2600 Service Pack 2
08:11:30 2008-07-02
mbam-log-7-2-2008 (08-11-30).txt
Skanningstyp: Fullständig skanning (C:\|)
Antal skannade objekt: 182589
Förfluten tid: 58 minute(s), 7 second(s)
Infekterade minnesprocesser: 0
Infekterade minnesmoduler: 0
Infekterade registernycklar: 2
Infekterade registervärden: 0
Infekterade registerdataposter: 0
Infekterade mappar: 0
Infekterade filer: 0
Infekterade minnesprocesser:
(Inga illasinnade poster hittades)
Infekterade minnesmoduler:
(Inga illasinnade poster hittades)
Infekterade registernycklar (translation: "infected registrykeyes"):
HKEY_CLASSES_ROOT\CLSID\{2b96d5cc-c5b5-49a5-a69d-cc0a30f9028c} (Adware.Minibug) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\MS Juan (Malware.Trace) -> Quarantined and deleted successfully.
Infekterade registervärden:
(Inga illasinnade poster hittades)
Infekterade registerdataposter:
(Inga illasinnade poster hittades)
Infekterade mappar:
(Inga illasinnade poster hittades)
Infekterade filer:
(Inga illasinnade poster hittades)
---
Hijackthis log:
---
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 20:27:59, on 2008-07-02
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal
Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\Program\Lavasoft\Ad-Aware\aawservice.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
C:\Program\AVG\AVG8\avgwdsvc.exe
C:\Program\Glocalnet Bredband\Bredbandsklienten\GlocalnetBredbandService.exe
C:\Program\Intel\Intel Application Accelerator\iaantmon.exe
C:\Program\Canon\IJPLM\IJPLMSVC.EXE
C:\WINDOWS\System32\svchost.exe
C:\Program\TVersity\Media Server\MediaServer.exe
C:\Program\AVG\AVG8\avgrsx.exe
C:\Program\AVG\AVG8\avgemc.exe
C:\WINDOWS\system32\wuauclt.exe
C:\WINDOWS\Explorer.EXE
C:\Program\Delade filer\Sonic\Update Manager\sgtray.exe
C:\Program\Dell\Media Experience\PCMService.exe
C:\Program\Intel\Intel Application Accelerator\iaanotif.exe
C:\WINDOWS\system32\dla\tfswctrl.exe
C:\WINDOWS\system32\DeltTray.exe
C:\Program\SyncroSoft\Pos\H2O\cledx.exe
C:\Program\iTunes\iTunesHelper.exe
C:\Program\ScanSoft\OmniPageSE4\OpwareSE4.exe
C:\WINDOWS\Philips\SPC610NC\Monitor.exe
C:\Program\AVG\AVG8\avgtray.exe
C:\Program\Java\jre1.6.0_06\bin\jusched.exe
C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe
C:\Program\iPod\bin\iPodService.exe
C:\Program\Mozilla Firefox\firefox.exe
C:\Program\Trend Micro\HijackThis\HijackThis.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.se/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.euro.dell.com/countries/se/sve/gen/default.htm
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = Länkar
O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program\Java\jre1.6.0_06\bin\ssv.dll
O4 - HKLM\..\Run: [UpdateManager] "C:\Program\Delade filer\Sonic\Update Manager\sgtray.exe" /r
O4 - HKLM\..\Run: [PCMService] "C:\Program\Dell\Media Experience\PCMService.exe"
O4 - HKLM\..\Run: [IAAnotif] C:\Program\Intel\Intel Application Accelerator\iaanotif.exe
O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
O4 - HKLM\..\Run: [ATIPTA] C:\Program\ATI Technologies\ATI Control Panel\atiptaxx.exe
O4 - HKLM\..\Run: [Name of App] C:\Program\SAMSUNG\FW LiveUpdate\Liveupdate.exe
O4 - HKLM\..\Run: [SpySweeper] "C:\Program\Webroot\Spy Sweeper\SpySweeper.exe" /startintray
O4 - HKLM\..\Run: [Virtual PDF Printer] C:\Program\Virtual PDF Printer\VirtualPDFPrinter.exe
O4 - HKLM\..\Run: [OCAudioIni] C:\Program\One-click Audio Converter\OCAudioIni.exe
O4 - HKLM\..\Run: [DeltTray] DeltTray.exe
O4 - HKLM\..\Run: [H2O] C:\Program\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKLM\..\Run: [QuickTime Task] "C:\Program\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [iTunesHelper] "C:\Program\iTunes\iTunesHelper.exe"
O4 - HKLM\..\Run: [SSBkgdUpdate] "C:\Program\Delade filer\Scansoft Shared\SSBkgdUpdate\SSBkgdupdate.exe" -Embedding -boot
O4 - HKLM\..\Run: [OpwareSE4] "C:\Program\ScanSoft\OmniPageSE4\OpwareSE4.exe"
O4 - HKLM\..\Run: [SPC610NC_Monitor] C:\WINDOWS\Philips\SPC610NC\Monitor.exe
O4 - HKLM\..\Run: [AVG8_TRAY] C:\Program\AVG\AVG8\avgtray.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program\Java\jre1.6.0_06\bin\jusched.exe"
O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program\Delade filer\Ahead\Lib\NMBgMonitor.exe"
O4 - HKCU\..\Run: [updateMgr] "C:\Program\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe" AcRdB7_0_9 -reboot 1
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOKAL TJÄNST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
O4 - Startup: Adobe Gamma.lnk = C:\Program\Delade filer\Adobe\Calibration\Adobe Gamma Loader.exe
O4 - Global Startup: Adobe Reader Speed Launch.lnk = C:\Program\Adobe\Acrobat 7.0\Reader\reader_sl.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Program\Microsoft Office\Office\OSA9.EXE
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java-konsol - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program\Java\jre1.6.0_06\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
O16 - DPF: {2917297F-F02B-4B9D-81DF-494B6333150B} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary/MineSweeper.cab31267.cab
O16 - DPF: {B38870E4-7ECB-40DA-8C6A-595F0A5519FF} (MsnMessengerSetupDownloadControl Class) - http://messenger.msn.com/download/msnmessengersetupdownloader.cab
O18 - Protocol: linkscanner - {F274614C-63F8-47D5-A4D1-FBDDE494F8D1} - C:\Program\AVG\AVG8\avgpp.dll
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program\DELADE~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: avgrsstx.dll
O23 - Service: Lavasoft Ad-Aware Service (aawservice) - Lavasoft - C:\Program\Lavasoft\Ad-Aware\aawservice.exe
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program\Delade filer\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program\Delade filer\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\SYSTEM32\ati2sgag.exe
O23 - Service: AVG8 E-mail Scanner (avg8emc) - AVG Technologies CZ, s.r.o. - C:\Program\AVG\AVG8\avgemc.exe
O23 - Service: AVG8 WatchDog (avg8wd) - AVG Technologies CZ, s.r.o. - C:\Program\AVG\AVG8\avgwdsvc.exe
O23 - Service: Glocalnet Bredband (GlocalnetBredbandClientService) - Glocalnet AB - C:\Program\Glocalnet Bredband\Bredbandsklienten\GlocalnetBredbandService.exe
O23 - Service: IAA Event Monitor (IAANTMon) - Intel Corporation - C:\Program\Intel\Intel Application Accelerator\iaantmon.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program\Delade filer\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: PIXMA Extended Survey Program (IJPLMSVC) - Unknown owner - C:\Program\Canon\IJPLM\IJPLMSVC.EXE
O23 - Service: iPod Service - Apple Inc. - C:\Program\iPod\bin\iPodService.exe
O23 - Service: NMIndexingService - Unknown owner - C:\Program\Delade filer\Ahead\Lib\NMIndexingService.exe (file missing)
O23 - Service: Remote Packet Capture Protocol v.0 (experimental) (rpcapd) - CACE Technologies - C:\Program\WinPcap\rpcapd.exe
O23 - Service: TVersityMediaServer - Unknown owner - C:\Program\TVersity\Media Server\MediaServer.exe
--
End of file - 8176 bytes
Thank you,
/Ontrop.
pskelley
2008-07-02, 22:01
Everything looks good in your HJT log, if you are having no problems, let's do this.
Turn off System Restore.
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
Check Turn off System Restore.
Click Apply, and then click OK.
Reboot
Turn ON System Restore,
On the Desktop, right-click My Computer.
Click Properties.
Click the System Restore tab.
UN-Check *Turn off System Restore*.
Click Apply, and then click OK.
Some good information for you:
http://users.telenet.be/bluepatchy/miekiemoes/slowcomputer.html
http://www.microsoft.com/windowsxp/using/helpandsupport/learnmore/tips/mcgill1.mspx
Here is some great information from experts in this field that will help you stay clean and safe online.
http://users.telenet.be/bluepatchy/miekiemoes/prevention.html
http://forums.spybot.info/showthread.php?t=279
http://russelltexas.com/malware/allclear.htm
http://forum.malwareremoval.com/viewtopic.php?t=14
http://www.bleepingcomputer.com/forums/topict2520.html
http://cybercoyote.org/security/not-admin.shtml
http://www.malwarecomplaints.info/
Thanks...pskelley
Safer Networking Forums
http://www.spybot.info/en/donate/index.html
If you are reading this information...thank a teacher,
If you are reading it in English...thank a soldier.
I have no further problems with the computer. Thank you very much.
/Ontrop.