XP home edition/service pac 3/ Dell Optiplex 170L
Have run scanner several times and it consistently crashes at about 34,000 Powered Keylogger.
Bluescreen reads registry problem/ tech info reads;
Stop: 0x00000051 (0x00000004, 0x00000001, 0xE115CEB8, 0x000201E0)
Please note that all instructions given are customised for this computer only, the tools used may cause damage if used on a computer with different infections.
If you think you have similar problems, please post a log in the HJT forum and wait for help.
Hello and welcome to the forums
My name is Katana and I will be helping you to remove any infection(s) that you may have.
Please observe these rules while we work:
Please Read All Instructions Carefully
If you don't understand something, stop and ask! Don't keep going on.
Please do not run any other tools or scans whilst I am helping you
Please continue to respond until I give you the "All Clear"
(Just because you can't see a problem doesn't mean it isn't there)
If you can do those few things, everything should go smoothly http://www.countingcows.de/laechel.gif
Please Note, your security programs may give warnings for some of the tools I will ask you to use.
Be assured, any links I give are safe
----------------------------------------------------------------------------------------
Download and Run RSIT
Please download Random's System Information Tool by random/random from here (http://images.malwareremoval.com/random/RSIT.exe) and save it to your desktop.
Double click on RSIT.exe to run RSIT.
Click Continue at the disclaimer screen.
Once it has finished, two logs will open:
log.txt will be opened maximized.
info.txt will be opened minimized.
Please post the contents of both log.txt and info.txt.
Hi Katana,
Let me know if I did this right. tx.
Logfile of random's system information tool 1.04 (written by random/random)
Run by Owner at 2008-11-08 17:39:52
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 15 GB (41%) free of 38 GB
Total RAM: 1022 MB (62% free)
Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 5:40:20 PM, on 11/8/2008
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal
Running processes:
C:\WINDOWS2\System32\smss.exe
C:\WINDOWS2\system32\csrss.exe
C:\WINDOWS2\system32\winlogon.exe
C:\WINDOWS2\system32\services.exe
C:\WINDOWS2\system32\lsass.exe
C:\WINDOWS2\system32\svchost.exe
C:\WINDOWS2\system32\svchost.exe
C:\WINDOWS2\System32\svchost.exe
C:\WINDOWS2\system32\svchost.exe
C:\WINDOWS2\system32\svchost.exe
C:\WINDOWS2\Explorer.EXE
C:\WINDOWS2\system32\spoolsv.exe
C:\WINDOWS2\system32\cisvc.exe
C:\Program Files\Spyware Doctor\pctsAuxs.exe
C:\Program Files\Spyware Doctor\pctsSvc.exe
C:\WINDOWS2\SYSTEM32\3cmlink.exe
C:\WINDOWS2\SYSTEM32\3cshtdwn.exe
C:\WINDOWS2\SYSTEM32\3cmlink.exe
C:\WINDOWS2\system32\hkcmd.exe
C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe
C:\Program Files\Spyware Doctor\pctsTray.exe
C:\WINDOWS2\system32\ctfmon.exe
C:\Program Files\DNA\btdna.exe
C:\Program Files\SmartDisk\FlashPath\sdstat.exe
C:\Program Files\U.S. Robotics\ControlCenter\Reminder.exe
C:\Program Files\U.S. Robotics\U.S. Robotics Internet Call Notification\CallWaiting.exe
C:\WINDOWS2\system32\wscntfy.exe
C:\WINDOWS2\System32\alg.exe
C:\WINDOWS2\system32\cidaemon.exe
C:\Program Files\Mozilla Firefox\firefox.exe
C:\Documents and Settings\Owner.ME\Desktop\RSIT.exe
C:\WINDOWS2\system32\wbem\wmiprvse.exe
C:\Documents and Settings\Owner.ME\Desktop\HiJackThis\Owner.exe
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - (no file)
O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
O2 - BHO: (no name) - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~2\SDHelper.dll
O2 - BHO: (no name) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - (no file)
O4 - HKLM\..\Run: [3c1807pd] C:\WINDOWS2\SYSTEM32\3cmlink.exe RunServices \Device\3cpipe-3c1807pd
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS2\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS2\system32\hkcmd.exe
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe" /min
O4 - HKLM\..\Run: [NeroCheck] C:\WINDOWS2\system32\\NeroCheck.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Eraser1066] "C:\Program Files\Eraser\Eraserl.exe" -disk C:\
O4 - HKLM\..\Run: [ISTray] "C:\Program Files\Spyware Doctor\pctsTray.exe"
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS2\system32\ctfmon.exe
O4 - HKCU\..\Run: [BitTorrent DNA] "C:\Program Files\DNA\btdna.exe"
O4 - Global Startup: FlashPath Monitor.lnk = C:\Program Files\SmartDisk\FlashPath\sdstat.exe
O4 - Global Startup: Instant Update Reminder.lnk = ?
O4 - Global Startup: U.S. Robotics Internet Call Notification.lnk = C:\Program Files\U.S. Robotics\U.S. Robotics Internet Call Notification\CallWaiting.exe
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_03\bin\npjpi142_03.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS2\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS2\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
O16 - DPF: {215B8138-A3CF-44C5-803F-8226143CFC0A} (Trend Micro ActiveX Scan Agent 6.6) - http://housecall65.trendmicro.com/housecall/applet/html/native/x86/win32/activex/hcImpl.cab
O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1197185936484
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1197704452031
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://www.adobe.com/products/acrobat/nos/gp.cab
O17 - HKLM\System\CCS\Services\Tcpip\..\{86CED218-4688-40E1-B1A1-19325FEAAF0B}: NameServer = 208.106.45.3 208.106.118.3
O23 - Service: AntiVir PersonalEdition Classic Scheduler (AntiVirScheduler) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe (file missing)
O23 - Service: AntiVir PersonalEdition Classic Guard (AntiVirService) - Unknown owner - C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe (file missing)
O23 - Service: Google Updater Service (gusvc) - Unknown owner - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe (file missing)
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Program Files\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Program Files\Spyware Doctor\pctsSvc.exe
--
End of file - 5643 bytes
======Scheduled tasks folder======
C:\WINDOWS2\tasks\ErrorSmart Scheduled Scan.job
C:\WINDOWS2\tasks\Uniblue SpyEraser Nag.job
C:\WINDOWS2\tasks\Uniblue SpyEraser.job
======Registry dump======
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]
Adobe PDF Reader Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll [2006-10-22 62080]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
C:\PROGRA~1\SPYBOT~2\SDHelper.dll [2005-05-31 853672]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"3c1807pd"=C:\WINDOWS2\SYSTEM32\3cmlink.exe [2003-04-03 73728]
"IgfxTray"=C:\WINDOWS2\system32\igfxtray.exe [2003-04-07 155648]
"HotKeysCmds"=C:\WINDOWS2\system32\hkcmd.exe [2003-04-07 114688]
"SunJavaUpdateSched"=C:\Program Files\Java\j2re1.4.2_03\bin\jusched.exe [2003-11-19 32881]
"avgnt"=C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgnt.exe /min []
"NeroCheck"=C:\WINDOWS2\system32\\NeroCheck.exe [2001-07-09 155648]
"USRpdA"= []
"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe [2008-01-11 39792]
"Eraser1066"=C:\Program Files\Eraser\Eraserl.exe [2003-07-25 184320]
"ISTray"=C:\Program Files\Spyware Doctor\pctsTray.exe [2008-08-25 1168264]
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS2\system32\ctfmon.exe [2008-04-13 15360]
"BitTorrent DNA"=C:\Program Files\DNA\btdna.exe [2008-09-30 289088]
C:\Documents and Settings\All Users.WINDOWS2\Start Menu\Programs\Startup
FlashPath Monitor.lnk - C:\Program Files\SmartDisk\FlashPath\sdstat.exe
Instant Update Reminder.lnk - C:\Program Files\U.S. Robotics\ControlCenter\Reminder.exe
U.S. Robotics Internet Call Notification.lnk - C:\Program Files\U.S. Robotics\U.S. Robotics Internet Call Notification\CallWaiting.exe
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS2\system32\igfxsrvc.dll [2003-04-07 315392]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS2\system32\WPDShServiceObj.dll [2006-10-18 133632]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]
"{F552DDE6-2090-4bf4-B924-6141E87789A5}"= []
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdauxservice]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\sdcoreservice]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdauxservice]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\sdcoreservice]
[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Program Files\U.S. Robotics\ControlCenter\Temp\ccftpclient.exe"="C:\Program Files\U.S. Robotics\ControlCenter\Temp\ccftpclient.exe:*:Enabled:ccftpclient"
"C:\Program Files\U.S. Robotics\ControlCenter\Reminder.exe"="C:\Program Files\U.S. Robotics\ControlCenter\Reminder.exe:*:Enabled:Reminder"
"C:\Program Files\U.S. Robotics\ControlCenter\ctrlcntr.exe"="C:\Program Files\U.S. Robotics\ControlCenter\ctrlcntr.exe:*:Enabled:ctrlcntr"
"C:\WINDOWS2\Network Diagnostic\xpnetdiag.exe"="C:\WINDOWS2\Network Diagnostic\xpnetdiag.exe:*:Disabled:@xpsp3res.dll,-20000"
"C:\WINDOWS2\system32\sessmgr.exe"="C:\WINDOWS2\system32\sessmgr.exe:*:Disabled:@xpsp2res.dll,-22019"
"C:\Program Files\Mozilla Firefox\firefox.exe"="C:\Program Files\Mozilla Firefox\firefox.exe:*:Enabled:Mozilla Firefox"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Program Files\DNA\btdna.exe"="C:\Program Files\DNA\btdna.exe:*:Enabled:DNA"
"C:\Program Files\BitTorrent\bittorrent.exe"="C:\Program Files\BitTorrent\bittorrent.exe:*:Enabled:BitTorrent"
[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
======List of files/folders created in the last 1 months======
2008-11-08 17:39:52 ----D---- C:\rsit
2008-11-07 00:53:22 ----D---- C:\Program Files\Misc. Support Library (Spybot - Search & Destroy)
2008-11-07 00:53:22 ----D---- C:\Program Files\File Scanner Library (Spybot - Search & Destroy)
2008-11-06 10:22:34 ----HDC---- C:\WINDOWS2\$NtUninstallKB956841$
2008-11-06 02:19:41 ----HDC---- C:\WINDOWS2\$NtUninstallKB954211$
2008-11-06 02:18:30 ----HDC---- C:\WINDOWS2\$NtUninstallKB956390$
2008-11-06 02:09:55 ----D---- C:\WINDOWS2\TEMP
2008-11-02 10:49:39 ----D---- C:\New Folder
2008-10-31 18:29:04 ----HDC---- C:\WINDOWS2\$NtUninstallKB956391$
2008-10-31 18:28:48 ----HDC---- C:\WINDOWS2\$NtUninstallKB957095$
2008-10-31 04:24:38 ----HDC---- C:\WINDOWS2\$NtUninstallKB956803$
2008-10-31 04:24:26 ----HDC---- C:\WINDOWS2\$NtUninstallKB958644$
2008-10-28 10:33:22 ----D---- C:\dellregfix
2008-10-27 08:52:46 ----AD---- C:\Documents and Settings\All Users.WINDOWS2\Application Data\TEMP
2008-10-27 08:52:35 ----D---- C:\Program Files\Spyware Doctor
2008-10-27 08:52:35 ----D---- C:\Documents and Settings\Owner.ME\Application Data\PC Tools
2008-10-27 03:27:14 ----A---- C:\Program Files\sdsetup.exe
2008-10-27 03:00:41 ----D---- C:\Program Files\Autoruns
2008-10-17 01:57:45 ----D---- C:\Documents and Settings\All Users.WINDOWS2\Application Data\Spybot - Search & Destroy
2008-10-17 01:51:27 ----A---- C:\Program Files\inst_antispy.exe
2008-10-14 15:55:42 ----A---- C:\Program Files\ccsetup212.exe
2008-10-13 23:15:02 ----D---- C:\Program Files\Spybot - Search & Destroy
2008-10-13 23:14:48 ----D---- C:\Program Files\FLVPlayer4Free
2008-10-12 00:33:08 ----D---- C:\Documents and Settings\All Users.WINDOWS2\Application Data\Spybot - Search & Destroy(2)
======List of files/folders modified in the last 1 months======
2008-11-08 17:40:00 ----D---- C:\WINDOWS2\Prefetch
2008-11-08 17:39:01 ----D---- C:\Documents and Settings\Owner.ME\Application Data\DNA
2008-11-08 17:35:15 ----D---- C:\Program Files\Mozilla Firefox
2008-11-08 17:34:37 ----A---- C:\WINDOWS2\ModemLog_U.S. Robotics V.92 Fax Win Int.txt
2008-11-08 17:19:10 ----D---- C:\WINDOWS2\system32\drivers
2008-11-08 13:17:39 ----A---- C:\WINDOWS2\SchedLgU.Txt
2008-11-07 19:04:21 ----RD---- C:\Program Files
2008-11-07 01:16:17 ----D---- C:\WINDOWS2
2008-11-07 01:04:54 ----D---- C:\WINDOWS2\Debug
2008-11-06 13:17:45 ----D---- C:\Program Files\Trend Micro
2008-11-06 13:13:08 ----A---- C:\Program Files\HijackThis.exe
2008-11-06 10:22:42 ----HD---- C:\WINDOWS2\inf
2008-11-06 10:22:37 ----RSHDC---- C:\WINDOWS2\system32\dllcache
2008-11-06 10:22:36 ----D---- C:\WINDOWS2\system32
2008-11-06 10:22:10 ----HD---- C:\WINDOWS2\$hf_mig$
2008-11-06 10:22:09 ----D---- C:\WINDOWS2\system32\CatRoot2
2008-11-05 12:57:22 ----A---- C:\WINDOWS2\system32\PerfStringBackup.INI
2008-11-02 06:20:02 ----D---- C:\WINDOWS2\system32\CatRoot
2008-11-02 05:22:45 ----D---- C:\WINDOWS2\system32\config
2008-11-02 05:22:34 ----D---- C:\WINDOWS2\system32\wbem
2008-11-02 05:22:34 ----D---- C:\WINDOWS2\Registration
2008-11-02 05:22:07 ----D---- C:\WINDOWS2\Help
2008-11-02 05:21:04 ----D---- C:\Program Files\U.S. Robotics
2008-10-31 08:25:53 ----D---- C:\WINDOWS2\Minidump
2008-10-30 14:08:46 ----D---- C:\WINDOWS2\system32\ReinstallBackups
2008-10-20 18:46:27 ----SHD---- C:\WINDOWS2\Installer
2008-10-20 18:46:27 ----D---- C:\Config.Msi
2008-10-19 13:10:47 ----D---- C:\Documents and Settings\All Users.WINDOWS2\Application Data\Google Updater
2008-10-17 01:19:10 ----D---- C:\Documents and Settings
2008-10-15 08:34:24 ----A---- C:\WINDOWS2\system32\netapi32.dll
2008-10-15 08:34:24 ----A---- C:\WINDOWS2\system32\netapi32(2).dll
2008-10-14 00:07:40 ----A---- C:\Program Files\flvplayer4free_setup.exe
2008-10-09 22:07:23 ----D---- C:\Program Files\Common Files
======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R1 avipbb;avipbb; C:\WINDOWS2\system32\DRIVERS\avipbb.sys [2008-07-17 75072]
R1 IKSysFlt;System Filter Driver; C:\WINDOWS2\system32\drivers\iksysflt.sys [2008-08-25 66952]
R1 IKSysSec;System Security Driver; C:\WINDOWS2\system32\drivers\iksyssec.sys [2008-08-25 81288]
R1 intelppm;Intel Processor Driver; C:\WINDOWS2\system32\DRIVERS\intelppm.sys [2008-04-13 36352]
R1 Myscope;Myscope; \??\C:\Program Files\U.S. Robotics\U.S. Robotics Internet Call Notification\W2k\myscope.sys []
R1 OMCI;OMCI; C:\WINDOWS2\SYSTEM32\DRIVERS\OMCI.SYS [2001-08-22 13632]
R1 ssmdrv;ssmdrv; C:\WINDOWS2\system32\DRIVERS\ssmdrv.sys [2007-03-01 28352]
R2 FlashNT;FlashNT; C:\WINDOWS2\system32\drivers\FlashNT.sys [2001-02-06 72784]
R2 Sdselect;Sdselect; C:\WINDOWS2\system32\drivers\Sdselect.sys [2000-11-14 73296]
R3 {6080A529-897E-4629-A488-ABA0C29B635E};Intel(R) Graphics Platform (SoftBIOS) Driver; C:\WINDOWS2\system32\drivers\ialmsbw.sys [2003-04-15 113504]
R3 {D31A0762-0CEB-444e-ACFF-B049A1F6FE91};Intel(R) Graphics Chipset (KCH) Driver; C:\WINDOWS2\system32\drivers\ialmkchw.sys [2003-04-15 78752]
R3 3c1807pd;U.S. Robotics V.92 Fax Win Int; C:\WINDOWS2\system32\DRIVERS\3c1807pd.sys [2003-04-03 329120]
R3 aeaudio;aeaudio; C:\WINDOWS2\system32\drivers\aeaudio.sys [2002-04-01 4816]
R3 ialm;ialm; C:\WINDOWS2\system32\DRIVERS\ialmnt5.sys [2003-04-15 90907]
R3 smwdm;smwdm; C:\WINDOWS2\system32\drivers\smwdm.sys [2003-05-06 580992]
R3 usbehci;Microsoft USB 2.0 Enhanced Host Controller Miniport Driver; C:\WINDOWS2\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2 Enabled Hub; C:\WINDOWS2\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Microsoft USB Universal Host Controller Miniport Driver; C:\WINDOWS2\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 Usrserft;Myscope Upper Filter Driver; \??\C:\Program Files\U.S. Robotics\U.S. Robotics Internet Call Notification\W2k\usrserft.sys []
S1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgio.sys []
S3 avgntflt;avgntflt; \??\C:\Program Files\Avira\AntiVir PersonalEdition Classic\avgntflt.sys []
S3 RegGuard;RegGuard; \??\C:\WINDOWS2\system32\Drivers\regguard.sys []
S3 SymEvent;SymEvent; \??\C:\Program Files\Symantec\SYMEVENT.SYS []
S3 USRpdA;U.S. Robotics 56K PCI Faxmodem Driver; C:\WINDOWS2\system32\DRIVERS\USRpdA.sys [2001-08-17 113762]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS2\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS2\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
R2 sdAuxService;PC Tools Auxiliary Service; C:\Program Files\Spyware Doctor\pctsAuxs.exe [2008-06-13 356920]
R2 sdCoreService;PC Tools Security Service; C:\Program Files\Spyware Doctor\pctsSvc.exe [2008-10-09 1079176]
S2 AntiVirScheduler;AntiVir PersonalEdition Classic Scheduler; C:\Program Files\Avira\AntiVir PersonalEdition Classic\sched.exe []
S2 AntiVirService;AntiVir PersonalEdition Classic Guard; C:\Program Files\Avira\AntiVir PersonalEdition Classic\avguard.exe []
S2 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe []
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS2\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS2\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 WMPNetworkSvc;Windows Media Player Network Sharing Service; C:\Program Files\Windows Media Player\WMPNetwk.exe [2006-10-18 913408]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS2\system32\svchost.exe [2008-04-13 14336]
-----------------EOF-----------------
info.txt logfile of random's system information tool 1.04 2008-11-08 17:40:22
======Uninstall list======
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS2\INF\PCHealth.inf
Adobe Acrobat and Reader 8.1.2 Security Update 1 (KB403742)-->MsiExec.exe /X{6846389C-BAC0-4374-808E-B120F86AF5D7}
Adobe Flash Player ActiveX-->C:\WINDOWS2\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player Plugin-->C:\WINDOWS2\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Photoshop Album 2.0 Starter Edition-->MsiExec.exe /I{11B569C2-4BF6-4ED0-9D17-A4273943CB24}
Adobe Reader 8.1.2-->MsiExec.exe /I{AC76BA86-7AD7-1033-7B44-A81200000003}
CCleaner (remove only)-->"C:\Program Files\CCleaner\uninst.exe"
Code::Blocks-->"C:\Program Files\CodeBlocks\unins000.exe"
Dell ResourceCD-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D78653C3-A8FF-415F-92E6-D774E634FF2D}\setup.exe"
Eraser-->"C:\Program Files\Eraser\unins000.exe"
FlashPath-->C:\WINDOWS2\IsUninst.exe -fC:\WINDOWS2\flashpth.isu -c"C:\Program Files\SmartDisk\FlashPath\fpsm.dll"
FLVPlayer4Free Free FLV Player 3.2.0.0-->"C:\Program Files\FLVPlayer4Free\unins001.exe"
getPlus(R)_ocx-->rundll32.exe advpack.dll,LaunchINFSection C:\WINDOWS2\inf\GETPLUSo.INF, DefaultUninstall
HighMAT Extension to Microsoft Windows XP CD Writing Wizard-->MsiExec.exe /X{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F}
HijackThis 2.0.2-->"C:\Program Files\HijackThis.exe" /uninstall
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS2\$NtUninstallKB929399$\spuninst\spuninst.exe"
Hotfix for Windows Media Player 11 (KB939683)-->"C:\WINDOWS2\$NtUninstallKB939683$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB952287)-->"C:\WINDOWS2\$NtUninstallKB952287$\spuninst\spuninst.exe"
Intel(R) Extreme Graphics Driver-->RUNDLL32.EXE C:\WINDOWS2\system32\ialmrem.dll,UninstallW2KIGfx PCI\VEN_8086&DEV_2572
Java 2 Runtime Environment, SE v1.4.2_03-->MsiExec.exe /I{7148F0A8-6813-11D6-A77B-00B0D0142030}
MarketingBuilder-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{D6F99644-E0C9-11D3-84E6-00A0243F43C0}\setup.exe"
Microsoft .NET Framework 2.0 Service Pack 1-->MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS2\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS2\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS2\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS2\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Mozilla Firefox (3.0.3)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
Nero - Burning Rom-->MsiExec.exe /X{A4D7B764-4140-11D4-88EB-0050DA3579C0}
Nvu 1.0-->"C:\Program Files\Nvu\unins000.exe"
OLYMPUS USB Reader/Writer-->C:\PROGRA~1\COMMON~1\INSTAL~1\Driver\7\INTEL3~1\IDriver.exe /M{9DFC9A77-86B4-4139-A4CF-A5E774422D28} /l1033
Pelles C for Windows (remove only)-->"C:\Program Files\PellesC\uninst.exe"
Security Update for Windows Media Player 11 (KB936782)-->"C:\WINDOWS2\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Security Update for Windows Media Player 11 (KB954154)-->"C:\WINDOWS2\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Security Update for Windows XP (KB923789)-->C:\WINDOWS2\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS2\system32\MacroMed\Flash\KB923789.inf
Security Update for Windows XP (KB938464)-->"C:\WINDOWS2\$NtUninstallKB938464$\spuninst\spuninst.exe"
Security Update for Windows XP (KB941569)-->"C:\WINDOWS2\$NtUninstallKB941569$\spuninst\spuninst.exe"
Security Update for Windows XP (KB946648)-->"C:\WINDOWS2\$NtUninstallKB946648$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950759)-->"C:\WINDOWS2\$NtUninstallKB950759$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950760)-->"C:\WINDOWS2\$NtUninstallKB950760$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950762)-->"C:\WINDOWS2\$NtUninstallKB950762$\spuninst\spuninst.exe"
Security Update for Windows XP (KB950974)-->"C:\WINDOWS2\$NtUninstallKB950974$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951066)-->"C:\WINDOWS2\$NtUninstallKB951066$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376)-->"C:\WINDOWS2\$NtUninstallKB951376$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951376-v2)-->"C:\WINDOWS2\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951698)-->"C:\WINDOWS2\$NtUninstallKB951698$\spuninst\spuninst.exe"
Security Update for Windows XP (KB951748)-->"C:\WINDOWS2\$NtUninstallKB951748$\spuninst\spuninst.exe"
Security Update for Windows XP (KB952954)-->"C:\WINDOWS2\$NtUninstallKB952954$\spuninst\spuninst.exe"
Security Update for Windows XP (KB953838)-->"C:\WINDOWS2\$NtUninstallKB953838$\spuninst\spuninst.exe"
Security Update for Windows XP (KB953839)-->"C:\WINDOWS2\$NtUninstallKB953839$\spuninst\spuninst.exe"
Security Update for Windows XP (KB954211)-->"C:\WINDOWS2\$NtUninstallKB954211$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956390)-->"C:\WINDOWS2\$NtUninstallKB956390$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956391)-->"C:\WINDOWS2\$NtUninstallKB956391$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956803)-->"C:\WINDOWS2\$NtUninstallKB956803$\spuninst\spuninst.exe"
Security Update for Windows XP (KB956841)-->"C:\WINDOWS2\$NtUninstallKB956841$\spuninst\spuninst.exe"
Security Update for Windows XP (KB957095)-->"C:\WINDOWS2\$NtUninstallKB957095$\spuninst\spuninst.exe"
Security Update for Windows XP (KB958644)-->"C:\WINDOWS2\$NtUninstallKB958644$\spuninst\spuninst.exe"
SoundMAX-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{F0A37341-D692-11D4-A984-009027EC0A9C}\setup.exe"
Spelling Dictionaries Support For Adobe Reader 8-->MsiExec.exe /I{AC76BA86-7AD7-5464-3428-800000000003}
Spybot - Search & Destroy 1.4-->"C:\Program Files\Spybot - Search & Destroy\unins001.exe"
Spyware Doctor 6.0-->C:\Program Files\Spyware Doctor\unins000.exe /LOG
U.S. Robotics ControlCenter-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{B83E0346-D2D0-11D5-A9AE-00105AA9E047}\Setup.exe" -l0x9 anything
U.S. Robotics Internet Call Notification-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{42583D0F-F958-460C-9E6B-43A1F68B830B}\Setup.exe" -l0x9
UBCD4Win 3.12-->"C:\UBCD4Win\unins000.exe"
Update for Windows XP (KB951072-v2)-->"C:\WINDOWS2\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Update for Windows XP (KB951978)-->"C:\WINDOWS2\$NtUninstallKB951978$\spuninst\spuninst.exe"
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS2\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\Program Files\Windows Media Player\Setup_wm.exe" /Uninstall
Windows Media Player 11-->"C:\WINDOWS2\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows Resource Kit Tools-->MsiExec.exe /I{FA237125-51FF-408C-8BB8-30C2B3DFFF9C}
Windows XP Service Pack 3-->"C:\WINDOWS2\$NtServicePackUninstall$\spuninst\spuninst.exe"
======Hosts File======
127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com
======Environment variables======
"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=C:\Program Files\Windows Resource Kits\Tools\;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 3 Stepping 4, GenuineIntel
"PROCESSOR_REVISION"=0304
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
-----------------EOF-----------------
Step 1
Malwarebytes' Anti-Malware
Please download Malwarebytes' Anti-Malware (http://www.besttechie.net/tools/mbam-setup.exe) to your desktop.
Double-click mbam-setup.exe and follow the prompts to install the program.
At the end, be sure a checkmark is placed next to
Update Malwarebytes' Anti-Malware
and Launch Malwarebytes' Anti-Malware
then click Finish.
If an update is found, it will download and install the latest version.
Once the program has loaded, select Perform full scan, then click Scan.
When the scan is complete, click OK, then Show Results to view the results.
Be sure that everything is checked, and click Remove Selected.
When completed, a log will open in Notepad. please copy and paste the log into your next reply
If you accidently close it, the log file is saved here and will be named like this:
C:\Documents and Settings\Username\Application Data\Malwarebytes\Malwarebytes' Anti-Malware\Logs\mbam-log-date (time).txt
----------------------------------------------------------- -----------------------------------------------------------
Step 2
Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Please download JavaRa (http://sourceforge.net/project/downloading.php?groupname=javara&filename=JavaRa.zip&use_mirror=osdn) and unzip it to your desktop.
***Please close any instances of Internet Explorer (or other web browser) before continuing!***
Double-click on JavaRa.exe to start the program.
From the drop-down menu, choose English and click on Select.
JavaRa will open; click on Remove Older Versions to remove the older versions of Java installed on your computer.
Click Yes when prompted. When JavaRa is done, a notice will appear that a logfile has been produced. Click OK.
A logfile will pop up. Please save it to a convenient location.
Now download and install Java Runtime Environment (JRE) (http://java.sun.com/javase/downloads/index.jsp).
----------------------------------------------------------- -----------------------------------------------------------
Step 3
Your Adobe Acrobat Reader is out of date. Older versions have vulnerabilities that malware can use to infect your system.
Adobe Reader is a large program and uses unnecessary space.
If you prefer a smaller program you can get Foxit 2.0 from http://www.foxitsoftware.com/pdf/rd_intro.php << Recommended
There is a newer version of Adobe Acrobat Reader available.
Please go to this link Adobe Acrobat Reader Download Link (http://www.adobe.com/products/acrobat/readstep2.html)
Click Download
On the right Untick Adobe Phototshop Album Starter Edition if you do not wish to include this in the installation.
Click the Continue button
Click Run, and click Run again
Next click the Install Now button and follow the on screen prompts
When the installation is complete go to Add/Remove Programs and uninstall all previous versions.
----------------------------------------------------------- -----------------------------------------------------------
Step 4
Logs/Information to Post in Reply
Please post the following logs/Information in your reply
MalwareBytes Log
Information
There is nothing there that would cause problems ??
----------------------------------------------------------- -----------------------------------------------------------
Step 1
Download ComboFix from one of these locations:
Link 1 (http://download.bleepingcomputer.com/sUBs/ComboFix.exe)
Link 2 (http://www.forospyware.com/sUBs/ComboFix.exe)
Link 3 (http://subs.geekstogo.com/ComboFix.exe)
* IMPORTANT !!! Save ComboFix.exe to your Desktop
Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
See HERE (http://www.bleepingcomputer.com/forums/topic114351.html) for help
Double click on ComboFix.exe & follow the prompts.
As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.
**Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.
http://img.photobucket.com/albums/v706/ried7/RcAuto1.gif
Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:
http://img.photobucket.com/albums/v706/ried7/whatnext.png
Click on Yes, to continue scanning for malware.
When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply.
----------------------------------------------------------- -----------------------------------------------------------
Step 2
Kaspersky Online Scanner .
Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
NOTE:- This scan is best done from IE (Internet Explorer)
NOTE:- Vista users should start IE by Start(Vista Orb) >> Internet Explorer >> Right-Click Run As Admin
Go Here http://www.kaspersky.com/kos/eng/partner/default/kavwebscan.html
Read the Requirements and limitations before you click Accept.
Once the database has downloaded, click My Computer in the left pane
Now go and put the kettle on !
When the scan has completed, click Save Report As...
Enter a name for the file in the Filename: text box and then click the down arrow to the right of Save as type: and select text file (*.txt)
Click Save - by default the file will be saved to your Desktop, but you can change this if you wish.
**Note**
To optimize scanning time and produce a more sensible report for review: Close any open programs.
Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.
Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.
----------------------------------------------------------- -----------------------------------------------------------
Step 3
Logs/Information to Post in Reply
Please post the following logs/Information in your reply
Combofix Log
Kaspersky Log
ComboFix 08-11-09.01 - Owner 2008-11-09 17:37:24.1 - NTFSx86
Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.720 [GMT -8:00]
Running from: c:\documents and settings\Owner.ME\Desktop\ComboFix.exe
.
((((((((((((((((((((((((( Files Created from 2008-10-10 to 2008-11-10 )))))))))))))))))))))))))))))))
.
2008-11-09 09:56 . 2008-11-09 09:56 <DIR> d-------- c:\program files\Common Files\Adobe AIR
2008-11-09 07:51 . 2008-11-09 09:50 35,124,856 --a------ c:\program files\AdbeRdr90_en_US.exe
2008-11-09 07:30 . 2008-11-09 07:29 410,976 --a------ c:\windows2\system32\deploytk.dll
2008-11-09 07:30 . 2008-11-09 07:29 73,728 --a------ c:\windows2\system32\javacpl.cpl
2008-11-09 06:46 . 2008-11-09 06:47 607,640 --a------ c:\program files\jxpiinstall.exe
2008-11-09 06:42 . 2008-11-09 06:43 <DIR> d-------- c:\program files\SDM20
2008-11-09 05:56 . 2008-11-09 05:56 <DIR> d-------- c:\program files\Malwarebytes' Anti-Malware
2008-11-09 05:56 . 2008-11-09 05:56 <DIR> d-------- c:\documents and settings\Owner.ME\Application Data\Malwarebytes
2008-11-09 05:56 . 2008-11-09 05:56 <DIR> d-------- c:\documents and settings\All Users.WINDOWS2\Application Data\Malwarebytes
2008-11-09 05:56 . 2008-10-22 16:10 38,496 --a------ c:\windows2\system32\drivers\mbamswissarmy.sys
2008-11-09 05:56 . 2008-10-22 16:10 15,504 --a------ c:\windows2\system32\drivers\mbam.sys
2008-11-09 01:09 . 2008-11-09 01:09 32 --ahs---- c:\windows2\system32\{B4EB7123-973B-486B-97F4-4476319D4BE2}.dat
2008-11-09 01:09 . 2008-11-09 01:09 32 --ahs---- c:\windows2\{3B93F9C9-4DAF-45FE-A652-5923401C6D4C}.dat
2008-11-09 01:08 . 2008-11-09 01:08 <DIR> d-------- c:\program files\Symantec
2008-11-09 01:08 . 2008-11-09 01:13 <DIR> d-------- c:\program files\Norton Personal Firewall
2008-11-09 01:08 . 2008-11-09 01:08 14 --a------ c:\windows2\system32\SR2.dat
2008-11-09 01:06 . 2008-11-09 01:06 1,409 --a------ c:\windows2\system32\tmpF4AF3.FOT
2008-11-09 01:06 . 2008-11-09 01:06 1,409 --a------ c:\windows2\system32\tmpE7AF3.FOT
2008-11-08 17:39 . 2008-11-08 17:40 <DIR> d-------- C:\rsit
2008-11-07 00:53 . 2008-11-07 00:53 <DIR> d-------- c:\program files\Misc. Support Library (Spybot - Search & Destroy)
2008-11-07 00:53 . 2008-11-07 00:53 <DIR> d-------- c:\program files\File Scanner Library (Spybot - Search & Destroy)
2008-11-06 10:13 . 2008-08-14 02:11 2,189,184 -----c--- c:\windows2\system32\dllcache\ntoskrnl.exe
2008-11-06 10:13 . 2008-08-14 02:09 2,145,280 -----c--- c:\windows2\system32\dllcache\ntkrnlmp.exe
2008-11-06 10:13 . 2008-08-14 01:33 2,066,048 -----c--- c:\windows2\system32\dllcache\ntkrnlpa.exe
2008-11-06 10:13 . 2008-08-14 01:33 2,023,936 -----c--- c:\windows2\system32\dllcache\ntkrpamp.exe
2008-11-02 10:49 . 2008-11-02 10:51 <DIR> d-------- C:\New Folder
2008-11-02 09:51 . 2008-09-15 04:12 1,846,400 -----c--- c:\windows2\system32\dllcache\win32k.sys
2008-10-31 18:48 . 2008-10-31 18:48 1,409 --a------ c:\windows2\system32\tmp348C0.FOT
2008-10-31 18:48 . 2008-10-31 18:48 1,409 --a------ c:\windows2\system32\tmp0E8C0.FOT
2008-10-31 09:00 . 2008-11-05 12:21 25,773 --a------ c:\windows2\system32\drivers\regguard.sys
2008-10-31 08:55 . 2008-09-08 02:41 333,824 -----c--- c:\windows2\system32\dllcache\srv.sys
2008-10-31 04:02 . 2008-10-15 08:34 337,408 -----c--- c:\windows2\system32\dllcache\netapi32.dll
2008-10-31 03:33 . 2008-10-31 03:35 384,780 --a------ C:\regrunhowto.pdf
2008-10-31 02:15 . 2008-10-31 02:39 6,871,358 --a------ C:\regruns.zip
2008-10-28 10:33 . 2008-10-28 10:33 <DIR> d-------- C:\dellregfix
2008-10-27 08:52 . 2008-11-09 16:52 <DIR> d-------- c:\program files\Spyware Doctor
2008-10-27 08:52 . 2008-10-27 08:52 <DIR> d-------- c:\documents and settings\Owner.ME\Application Data\PC Tools
2008-10-27 08:52 . 2008-11-09 16:52 <DIR> d-a------ c:\documents and settings\All Users.WINDOWS2\Application Data\TEMP
2008-10-27 08:52 . 2008-08-25 11:36 81,288 --a------ c:\windows2\system32\drivers\iksyssec.sys
2008-10-27 08:52 . 2008-08-25 11:36 66,952 --a------ c:\windows2\system32\drivers\iksysflt.sys
2008-10-27 08:52 . 2008-08-25 11:36 40,840 --a------ c:\windows2\system32\drivers\ikfilesec.sys
2008-10-27 08:52 . 2008-06-02 15:19 29,576 --a------ c:\windows2\system32\drivers\kcom.sys
2008-10-27 03:27 . 2008-10-27 04:11 13,596,592 --a------ c:\program files\sdsetup.exe
2008-10-27 03:00 . 2008-10-27 03:00 <DIR> d-------- c:\program files\Autoruns
2008-10-27 02:58 . 2008-10-27 02:59 575,466 --a------ c:\program files\Autoruns.zip
2008-10-17 01:57 . 2008-10-24 05:03 <DIR> d-------- c:\documents and settings\All Users.WINDOWS2\Application Data\Spybot - Search & Destroy
2008-10-17 01:51 . 2008-10-17 01:52 335,291 --a------ c:\program files\inst_antispy.exe
2008-10-17 01:19 . 2008-11-02 05:22 <DIR> d-------- c:\documents and settings\Administrator
2008-10-14 15:55 . 2008-10-14 16:06 2,934,168 --a------ c:\program files\ccsetup212.exe
2008-10-13 23:15 . 2008-10-17 02:41 <DIR> d-------- c:\program files\Spybot - Search & Destroy
2008-10-13 23:14 . 2008-10-14 00:08 <DIR> d-------- c:\program files\FLVPlayer4Free
2008-10-12 10:32 . 2008-10-12 10:43 3,578,253 --a------ c:\program files\antikey.zip
2008-10-12 00:33 . 2008-10-13 23:14 <DIR> d-------- c:\documents and settings\All Users.WINDOWS2\Application Data\Spybot - Search & Destroy(2)
.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-11-10 01:32 --------- d-----w c:\documents and settings\Owner.ME\Application Data\DNA
2008-11-10 01:13 --------- d-----w c:\program files\Common Files\Symantec Shared
2008-11-09 17:54 --------- d-----w c:\program files\Common Files\Adobe
2008-11-09 15:29 --------- d-----w c:\program files\Java
2008-11-09 09:08 --------- d-----w c:\documents and settings\All Users.WINDOWS2\Application Data\Symantec
2008-11-09 09:07 --------- d-----w c:\program files\U.S. Robotics
2008-11-06 21:17 --------- d-----w c:\program files\Trend Micro
2008-11-06 21:13 5,616 ----a-w c:\program files\hijackthis.log
2008-11-06 21:13 401,720 ----a-w c:\program files\HijackThis.exe
2008-10-19 21:10 --------- d-----w c:\documents and settings\All Users.WINDOWS2\Application Data\Google Updater
2008-10-15 16:34 337,408 ----a-w c:\windows2\system32\netapi32(2).dll
2008-10-14 08:07 2,472,384 ----a-w c:\program files\flvplayer4free_setup.exe
2008-10-01 04:46 --------- d-----w c:\program files\DNA
2008-10-01 04:44 931,888 ----a-w c:\program files\BitTorrent-6.1.exe
2008-09-28 20:12 6,720,380 ----a-w c:\program files\speeditupFree.exe.part
2008-09-15 12:12 1,846,400 ----a-w c:\windows2\system32\win32k.sys
2008-09-07 09:21 182,726 ----a-w c:\program files\ccsetup211.exe.part
2008-08-20 05:30 666,112 ----a-w c:\windows2\system32\wininet.dll
2008-08-18 00:26 73,967,376 ----a-w c:\program files\TrendMicro_TIS_16.05_1015_x32.exe
2008-08-14 10:11 2,189,184 ----a-w c:\windows2\system32\ntoskrnl.exe
2008-08-14 09:33 2,066,048 ----a-w c:\windows2\system32\ntkrnlpa.exe
2008-07-20 21:53 2,919,360 ----a-w c:\program files\ccsetup209.exe
2008-06-12 19:01 906,960 ----a-w c:\program files\Google Updater.exe
2008-06-11 20:28 5,179,408 ----a-w c:\program files\DriverDetective.exe
2008-06-06 05:45 18,389,711 ----a-w c:\program files\a2AntiMalwareSetup.exe.part
2008-06-06 03:16 0 ----a-w c:\program files\a2AntiMalwareSetup.exe
2008-03-28 04:49 12,337,752 ----a-w c:\program files\rktools.exe
2008-03-13 07:10 866,703 ----a-w c:\program files\AutoStreamer.exe
2008-02-22 01:33 128,400 ----a-w c:\program files\Download_flv2video_converter-trial.exe
2008-02-07 01:04 357 ----a-w c:\documents and settings\Owner.ME\.cb_layout.bin
2008-02-02 10:16 15,070,144 ----a-w c:\program files\ssftrialsnrsetup1606_27405640.exe
2008-01-25 04:54 1,491,592 ----a-w c:\program files\install_flash_player.exe
2008-01-18 05:46 2,733,928 ----a-w c:\program files\ccsetup204.exe
2008-01-13 10:31 6,026,816 ----a-w c:\program files\Firefox Setup 2.0.0.11.exe
2008-01-10 10:31 13,597,181 ----a-w c:\program files\codeblocks-1.0rc2_mingw.exe
2008-01-10 09:41 1,852,833 ----a-w c:\program files\gdb-5.2.1-1.exe
2007-12-18 17:25 2,724,328 ----a-w c:\program files\ccsetup203.exe
2007-12-16 08:13 17,788,920 ----a-w c:\program files\antivir_workstation_win7u_en_h.exe
2007-12-16 04:32 3,480,968 ----a-w c:\program files\PCRegistryCleaner_setup.exe
2007-08-29 06:08 116,234 ----a-w c:\program files\not milk.htm
2007-08-29 06:07 116,234 ----a-w c:\program files\The NOTMILK Homepage! (MILK is a bad-news substance!).htm
2007-08-15 03:54 51,154 ----a-w c:\program files\regscanner.zip
2007-07-30 08:56 4,917,976 ----a-w c:\program files\Opera_9.22_Eng_Setup.exe
2007-07-10 00:19 1,075,704 ----a-w c:\program files\RegCureSetup_1_4.exe
2007-07-09 19:25 23,402,288 ----a-w c:\program files\AdbeRdr810_en_US.exe
2007-05-18 15:11 999,224 ----a-w c:\program files\optimize-setup-1051.exe
2007-05-17 19:08 6,343,313 ----a-w c:\program files\FBIde_0.4.6_FreeBASIC_0.15.exe
2007-05-17 18:32 1,941,726 ----a-w c:\program files\FBIde_0.4.6.exe
2007-05-16 23:00 4,909,922 ----a-w c:\program files\FreeBASIC-v0.16b-win32.exe
2007-05-16 19:54 1,157,586 ----a-w c:\program files\jpro_fb_172.zip
2007-05-11 10:45 1,033,661 ----a-w c:\program files\dvd_identifier_501.zip
2007-05-03 21:23 729,664 ----a-w c:\program files\leechget_browser_plug-in_2004_1.10.exe
2007-05-03 19:58 2,714,784 ----a-w c:\program files\ccsetup139.exe
2007-04-13 08:24 3,276,240 ----a-w c:\program files\python-2.5.1c1.msi.part
2007-04-13 08:12 0 ----a-w c:\program files\python-2.5.1c1.msi
2007-03-28 04:12 488,499 ----a-w c:\program files\keyscrambler_personal-1.2.0-firefox-windows.xpi
2007-02-08 00:05 452,608 ----a-w c:\program files\FreeSysInfo.exe
2007-02-03 05:22 5,971,432 ----a-w c:\program files\Firefox Setup 2.0.0.1.exe
2007-02-02 20:50 1,066,936 ----a-w c:\program files\Firefox Setup 2.0.0.1.exe.part
2007-01-04 06:10 878,896 ----a-w c:\program files\WGAPluginInstall.exe
2006-09-19 06:58 5,037,072 ----a-w c:\program files\spybotsd14.exe
2006-08-30 17:36 13,042,897 ----a-w c:\program files\simulator.exe
2006-05-03 08:35 4,856,576 ----a-w c:\program files\GoogleVideoPlayerSetup.exe
2006-02-14 19:37 749 ----a-w c:\program files\INSTALL.TXT
2006-02-14 19:37 730,744 ----a-w c:\program files\vxstream.ovl
2006-02-14 19:37 64,240 ----a-w c:\program files\VXS_MAN.txt
2006-02-14 19:37 596 ----a-w c:\program files\STATUS.PC
2006-02-14 19:37 415,744 ----a-w c:\program files\VXSTREAM.DLL
2006-02-14 19:37 4,776 ----a-w c:\program files\MARS.TXT
2006-02-14 19:37 138,752 ----a-w c:\program files\VXS_MAN.DOC
2006-02-14 19:37 1,096 ----a-w c:\program files\VXSTREAM.INI
2005-11-26 12:40 466,696 ----a-w c:\program files\GenuineCheck.exe
2005-11-26 08:37 315,624 ----a-w c:\program files\dxwebsetup.exe
2005-09-23 06:59 149 ----a-w c:\program files\smith3.ram
2005-09-12 08:44 700,120 ----a-w c:\program files\flashplayer7installer.exe
2005-05-17 03:25 2,100,277 ----a-w c:\program files\4xx-2005-05-16.zip
2005-05-13 23:55 285 ----a-w c:\program files\ClearBat.zip
.
((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"="c:\windows2\system32\ctfmon.exe" [2008-04-13 15360]
"BitTorrent DNA"="c:\program files\DNA\btdna.exe" [2008-09-30 289088]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"3c1807pd"="c:\windows2\SYSTEM32\3cmlink.exe" [2003-04-03 73728]
"IgfxTray"="c:\windows2\system32\igfxtray.exe" [2003-04-07 155648]
"HotKeysCmds"="c:\windows2\system32\hkcmd.exe" [2003-04-07 114688]
"SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2008-11-09 136600]
"NeroCheck"="c:\windows2\system32\\NeroCheck.exe" [2001-07-09 155648]
"Eraser1066"="c:\program files\Eraser\Eraserl.exe" [2003-07-25 184320]
"ccApp"="c:\program files\Common Files\Symantec Shared\ccApp.exe" [2002-11-14 54976]
"ccRegVfy"="c:\program files\Common Files\Symantec Shared\ccRegVfy.exe" [2002-11-14 59072]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2008-06-12 34672]
c:\documents and settings\All Users.WINDOWS2\Start Menu\Programs\Startup\
FlashPath Monitor.lnk - c:\program files\SmartDisk\FlashPath\sdstat.exe [2008-06-11 184320]
Instant Update Reminder.lnk - c:\program files\U.S. Robotics\ControlCenter\Reminder.exe [2008-03-13 851968]
U.S. Robotics Internet Call Notification.lnk - c:\program files\U.S. Robotics\U.S. Robotics Internet Call Notification\CallWaiting.exe [2008-03-13 454656]
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
"EnableFirewall"= 0 (0x0)
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"c:\\Program Files\\U.S. Robotics\\ControlCenter\\Temp\\ccftpclient.exe"=
"c:\\Program Files\\U.S. Robotics\\ControlCenter\\Reminder.exe"=
"c:\\Program Files\\U.S. Robotics\\ControlCenter\\ctrlcntr.exe"=
"c:\\WINDOWS2\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\WINDOWS2\\system32\\sessmgr.exe"=
"c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"%windir%\\system32\\sessmgr.exe"=
"c:\\Program Files\\DNA\\btdna.exe"=
R1 Myscope;Myscope;c:\program files\U.S. Robotics\U.S. Robotics Internet Call Notification\W2k\myscope.sys [2002-11-04 82920]
R2 FlashNT;FlashNT;c:\windows2\system32\drivers\FlashNT.sys [2001-02-06 72784]
R2 Sdselect;Sdselect;c:\windows2\system32\drivers\Sdselect.sys [2000-11-14 73296]
R3 Usrserft;Myscope Upper Filter Driver;c:\program files\U.S. Robotics\U.S. Robotics Internet Call Notification\W2k\usrserft.sys [2002-11-04 65592]
S0 Partizan;Partizan;c:\windows2\system32\drivers\Partizan.sys [ ]
S3 RegGuard;RegGuard;c:\windows2\system32\Drivers\regguard.sys [2008-11-05 25773]
*Newly Created Service* - PROCEXP90
.
Contents of the 'Scheduled Tasks' folder
2008-11-09 c:\windows2\Tasks\ErrorSmart Scheduled Scan.job
- c:\program files\ErrorSmart\ErrorSmart.exe []
2008-11-09 c:\windows2\Tasks\ErrorSmart Scheduled Scan.job
- c:\program files\ErrorSmart [2008-03-30 03:01]
2008-11-09 c:\windows2\Tasks\Symantec NetDetect.job
- c:\program files\Symantec\LiveUpdate\NDETECT.EXE [2002-08-07 09:04]
2008-11-02 c:\windows2\Tasks\Uniblue SpyEraser Nag.job
- c:\program files\Uniblue\SpyEraser\SpyEraser.exe []
2008-03-17 c:\windows2\Tasks\Uniblue SpyEraser.job
- c:\program files\Uniblue\SpyEraser\SpyEraser.exe []
.
- - - - ORPHANS REMOVED - - - -
HKLM-Run-avgnt - c:\program files\Avira\AntiVir PersonalEdition Classic\avgnt.exe
HKLM-Run-USRpdA - (no file)
ShellExecuteHooks-{F552DDE6-2090-4bf4-B924-6141E87789A5} - (no file)
.
------- Supplementary Scan -------
.
FireFox -: Profile - c:\documents and settings\Owner.ME\Application Data\Mozilla\Firefox\Profiles\ee135sqs.default\
FireFox -: prefs.js - STARTUP.HOMEPAGE - hxxp://en-us.www.mozilla.com/en-US/firefox/2.0.0.11/whatsnew/|http://www.google.com/firefox?client=firefox-a&rls=org.mozilla:en-US:official
FF -: plugin - c:\program files\DNA\plugins\npbtdna.dll
FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npdeploytk.dll
FF -: plugin - c:\program files\Java\jre6\bin\new_plugin\npjp2.dll
FF -: plugin - c:\program files\Mozilla Firefox\plugins\npdeploytk.dll
FF -: plugin - c:\program files\Yahoo!\Common\npyaxmpb.dll
.
**************************************************************************
catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-11-09 17:39:00
Windows 5.1.2600 Service Pack 3 NTFS
scanning hidden processes ...
scanning hidden autostart entries ...
scanning hidden files ...
scan completed successfully
hidden files: 0
**************************************************************************
.
Completion time: 2008-11-09 17:40:49
ComboFix-quarantined-files.txt 2008-11-10 01:40:44
Pre-Run: 15,622,311,936 bytes free
Post-Run: 15,723,417,600 bytes free
WindowsXP-KB310994-SP2-Home-BootDisk-ENU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(2)\WINDOWS2
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS2="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
multi(0)disk(0)rdisk(0)partition(2)\WINDOWS="Microsoft Windows XP Home Edition" /noexecute=optin /fastdetect
232 --- E O F --- 2008-11-06 18:22:42
-------------------------------------------------------------
KASPERSKY ONLINE SCANNER 7 REPORT
Monday, November 10, 2008
Operating System: Microsoft Windows XP Home Edition Service Pack 3 (build 2600)
Kaspersky Online Scanner 7 version: 7.0.25.0
Program database last update: Monday, November 10, 2008 03:16:24
Records in database: 1377662
Scan settings
Scan using the following database extended
Scan archives yes
Scan mail databases yes
Scan area My Computer
A:\
C:\
D:\
Scan statistics
Files scanned 91379
Threat name 8
Infected objects 18
Suspicious objects 3
Duration of the scan 01:43:36
File name Threat name Threats count
C:\Documents and Settings\me\Application Data\Thunderbird\Profiles\5le2wexo.default\Mail\Local Folders\Sent Suspicious: Trojan-Spy.HTML.Fraud.gen 1
C:\Documents and Settings\me\Local Settings\Application Data\Identities\{DFF16927-88E6-4EAA-A097-460B7E65289B}\Microsoft\Outlook Express\Sent Items.bak Suspicious: Trojan-Spy.HTML.Fraud.gen 1
C:\Documents and Settings\me\Local Settings\Application Data\Identities\{DFF16927-88E6-4EAA-A097-460B7E65289B}\Microsoft\Outlook Express\Sent Items.dbx Suspicious: Trojan-Spy.HTML.Fraud.gen 1
C:\Documents and Settings\Owner.ME\.housecall6.6\Quarantine\keyfinder.exe.bac_a03168 Infected: not-a-virus:PSWTool.Win32.RAS.g 1
C:\Documents and Settings\Owner.ME\.housecall6.6\Quarantine\keyfinder.exe.bac_a03168 Infected: not-a-virus:PSWTool.Win32.RAS.a 1
C:\My Downloads\TransAct.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4110 1
C:\My Downloads\TransAct.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 1
C:\Program Files\Genesis\Navigator Suite\Info\Remote\winvnc4.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4110 1
C:\Program Files\Genesis\Navigator Suite\Info\Remote\wm_hooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 1
C:\Program Files\Genesis\Navigator Suite\Info\RemoteNew\winvnc4.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4110 1
C:\Program Files\Genesis\Navigator Suite\Info\RemoteNew\wm_hooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 1
C:\UBCD4Win\plugin\Network\ipscan\ipscan.exe Infected: not-a-virus:NetTool.Win32.Portscan.c 1
C:\UBCD4Win\plugin\Network\ultravnc\files\vnchooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c 1
C:\UBCD4Win\plugin\Network\ultravnc\files\vncviewer.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.1102 1
C:\UBCD4Win\plugin\Network\ultravnc\files\winvnc.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.c 1
C:\UBCD4Win\plugin\Network\VNCServer\vncconfig.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 1
C:\UBCD4Win\plugin\Network\VNCServer\vncviewer.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 1
C:\UBCD4Win\plugin\Network\VNCServer\winvnc4.exe Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 1
C:\UBCD4Win\plugin\Network\VNCServer\wm_hooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC.4 1
C:\UBCD4Win\plugin\System-Info\Information\keyfinderpe\keyfinder.exe Infected: not-a-virus:PSWTool.Win32.RAS.g 1
C:\UBCD4Win\plugin\System-Info\Information\keyfinderpe\keyfinder.exe Infected: not-a-virus:PSWTool.Win32.RAS.a 1
The selected area was scanned.
There appear to be a lot of files saved directly in the Program Files folder, do you know why this is ?
Active Scan
Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
NOTE:- Vista users should start IE by Start(Vista Orb) >> Internet Explorer >> Right-Click Run As Admin
Please go to this site Link >> ActiveScan (http://www.pandasecurity.com/activescan/index/) << LINK
Click the Scan Now button
Follow the prompts to install the Active X if necessary
Go and make a cup of tea/coffee/beverage of your choice and watch some TV :)
When the scan is finished, a report will be generated
Next to Scan Details click the small Save button and save the report to your desktop.
Please post the report in your reply.
Due to inactivity, this thread will now be closed.
Note:If it has been five days or more since your last post, and the helper assisting you posted a response to that post to which you did not reply, your topic will not be reopened. At that point, if you still require help, please start a new topic and include a fresh HijackThis log and a link to your previous thread.
If it has been less than five days since your last response and you need the thread re-opened, please send me or MOD a private message (pm). A valid, working link to the closed topic is required.