Results 1 to 10 of 10

Thread: "command service"

  1. 2008-01-08, 14:12 #1
    Spywared
    Spywared is offline
    Junior Member
    Join Date
    Jan 2008
    Posts
    6

    Default "command service"

    Ok i've recently been infected with spyware that gives me pop ups from iexplorer, I've done a bit of searching and found it has been added to my services list on msconfig and several other entries have been created i'm a little unsure of how to procced and would greatly appreciate help.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 13:09:36, on 08/01/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Network Monitor\netmon.exe
    C:\WINDOWS\system32\?dobe\t?skmgr.exe
    C:\Program Files\kernel\kernel.exe
    C:\Program Files\Logitech\SetPoint\SetPoint.exe
    C:\Program Files\Hamachi\hamachi.exe
    C:\Program Files\Common Files\Logitech\KhalShared\KHALMNPR.EXE
    C:\Program Files\kernel\kernel .exe
    C:\Program Files\Opera\Opera.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\DOCUME~1\NOTADM~1\APPLIC~1\MANTEC~1\wucrtupd.exe
    C:\DOCUME~1\NOTADM~1\APPLIC~1\MANTEC~1\wucrtupd.exe
    C:\DOCUME~1\NOTADM~1\APPLIC~1\MANTEC~1\wucrtupd.exe
    C:\DOCUME~1\NOTADM~1\APPLIC~1\MANTEC~1\wucrtupd.exe
    C:\DOCUME~1\NOTADM~1\APPLIC~1\MANTEC~1\wucrtupd.exe
    C:\DOCUME~1\NOTADM~1\APPLIC~1\MANTEC~1\wucrtupd.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
    F3 - REG:win.ini: load=C:\WINDOWS\system32\mllji.exe
    O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares .exe" -h
    O4 - HKCU\..\Run: [Atqt] C:\WINDOWS\system32\?dobe\t?skmgr.exe
    O4 - HKCU\..\Run: [kernel] C:\Program Files\kernel\kernel.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll/206 (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: *.amaena.com
    O15 - Trusted Zone: *.avsystemcare.com
    O15 - Trusted Zone: *.gomyhit.com
    O15 - Trusted Zone: *.imageservr.com
    O15 - Trusted Zone: *.imagesrvr.com
    O15 - Trusted Zone: *.onerateld.com
    O15 - Trusted Zone: *.safetydownload.com
    O15 - Trusted Zone: *.storageguardsoft.com
    O15 - Trusted Zone: *.trustedantivirus.com
    O15 - Trusted Zone: *.virusschlacht.com
    O15 - Trusted Zone: *.amaena.com (HKLM)
    O15 - Trusted Zone: *.avsystemcare.com (HKLM)
    O15 - Trusted Zone: *.gomyhit.com (HKLM)
    O15 - Trusted Zone: *.imageservr.com (HKLM)
    O15 - Trusted Zone: *.imagesrvr.com (HKLM)
    O15 - Trusted Zone: *.onerateld.com (HKLM)
    O15 - Trusted Zone: *.safetydownload.com (HKLM)
    O15 - Trusted Zone: *.storageguardsoft.com (HKLM)
    O15 - Trusted Zone: *.trustedantivirus.com (HKLM)
    O15 - Trusted Zone: *.virusschlacht.com (HKLM)
    O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Network Monitor - Unknown owner - C:\Program Files\Network Monitor\netmon.exe
    O24 - Desktop Component 0: (no name) - C:\Program Files\MSN\progyvaprak.html

    --
    End of file - 4744 bytes
  2. 2008-01-08, 19:47 #2
    ken545
    ken545 is offline
    Emeritus-Security Expert
    Join Date
    Nov 2005
    Location
    Florida's SpaceCoast
    Posts
    15,208

    Default

    Spywared

    Welcome to Safer Networking.

    Please read Before You Post
    That said, All advice given by anyone volunteering here, is taken at own risk.
    While best efforts are made to assist in removing infections safely, unexpected stuff can happen.

    You have a host of malware on this system, this is what I suggest you do.

    Do this in order please

    Download OTMoveIt and save it to your desktop
    • Open OTMoveIt.exe.
    • In the left pane where it says: "Paste List of Files/Folders to be Moved", copy and paste the files in the quote box including the full path

      C:\Program Files\kernel
    • Then click the MoveIt button below.
    • In case you get a "Bad Image" error, just click OK at the promt. It will move the file anyway.
    • When done, it will create a log (********_******.log -- * stands for date and time) in next folder: C:\_OTMoveIt\MovedFiles.
    • Copy and paste this log in your next reply.





    Download VundoFix to your desktop

    • Double-click VundoFix.exe to run it.
    • Click the Scan for Vundo button.
    • Once it's done scanning, click the Remove Vundo button.
    • You will receive a prompt asking if you want to remove the files, click YES
    • Once you click yes, your desktop will go blank as it starts removing Vundo.
    • When completed, it will prompt that it will reboot your computer, click OK.
    • Please post the contents of C:\vundofix.txt and a new HiJackThis log in a reply to this thread.


    Note: It is possible that VundoFix encountered a file it could not remove. In this case, VundoFix will run on reboot, simply follow the above instructions starting from "Click the Scan for Vundo button" when VundoFix appears upon rebooting.







    Download ComboFix from Here or Here to your Desktop.
    • Double click combofix.exe and follow the prompts.
    • When finished, it shall produce a log for you. Post the Combofix log and a HiJackthis log in your next reply

    Note: Do not mouseclick combofix's window while its running. That may cause it to stall


    Download: DelDomains and save it to the desktop.
    • Close all open windows and your browser
    • Right Click DelDomains.inf and select > Install
    • Reboot your computer




    The thieves that have written Vundo have written it to evade a HJT scan so we need to rename it
    This is important, do this before you post a HJT log
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe<-- Right click on Hijackthis.exe ( looks like a man with a spyglass )and rename it to Safer.exe

    Let me see the following, you can take as many posts as you need to post it all.

    1. OtMoveIt log
    2. Vundofix log
    3. Combofix log
    4. New HJT log renamed to Safer.exe
    Microsoft MVP Consumer Security 2007-2008-2009-2010-2011-2012-2013-2014

    ERROR MESSAGE 386
    No KeyBoard Detected
    Press F1 To Continue

    Just a reminder that threads will be closed if no reply in 3 days.
  3. 2008-01-08, 21:40 #3
    Spywared
    Spywared is offline
    Junior Member
    Join Date
    Jan 2008
    Posts
    6

    Default

    Ok i've followed all of the instructions thus far and load time for start up is noticeably faster, I am very thankful of the help you have given, logs to follow

    OTmoveit log
    C:\Program Files\kernel moved successfully.

    Created on 01/08/2008 19:58:19

    Vundofix log

    VundoFix V6.7.7

    Checking Java version...

    Scan started at 20:01:35 08/01/2008

    Listing files found while scanning....

    C:\WINDOWS\mrofinu572.exe
    C:\WINDOWS\system32\iifgefd.dll
    C:\WINDOWS\system32\ijllm.ini
    C:\WINDOWS\system32\ijllm.ini2
    C:\WINDOWS\system32\jkkkjhh.dll
    C:\WINDOWS\system32\mllji.dll
    C:\WINDOWS\system32\mllji.exe
    C:\WINDOWS\system32\yayyxww.dll

    Beginning removal...

    Attempting to delete C:\WINDOWS\mrofinu572.exe
    C:\WINDOWS\mrofinu572.exe Has been deleted!

    Attempting to delete C:\WINDOWS\system32\iifgefd.dll
    C:\WINDOWS\system32\iifgefd.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\ijllm.ini
    C:\WINDOWS\system32\ijllm.ini Has been deleted!

    Attempting to delete C:\WINDOWS\system32\ijllm.ini2
    C:\WINDOWS\system32\ijllm.ini2 Has been deleted!

    Attempting to delete C:\WINDOWS\system32\jkkkjhh.dll
    C:\WINDOWS\system32\jkkkjhh.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\mllji.dll
    C:\WINDOWS\system32\mllji.dll Has been deleted!

    Attempting to delete C:\WINDOWS\system32\mllji.exe
    C:\WINDOWS\system32\mllji.exe Has been deleted!

    Attempting to delete C:\WINDOWS\system32\yayyxww.dll
    C:\WINDOWS\system32\yayyxww.dll Could not be deleted.

    Performing Repairs to the registry.
    Done!

    Beginning removal...

    Attempting to delete C:\WINDOWS\system32\yayyxww.dll
    C:\WINDOWS\system32\yayyxww.dll Could not be deleted.

    Performing Repairs to the registry.
    Done!

    Beginning removal...
    It would apear a file could not be deleted?

    and CC log

    ComboFix 08-01-07.5 - NotADMIN! 2008-01-08 20:30:12.1 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1708 [GMT 0:00]
    Running from: C:\Documents and Settings\NotADMIN!\Desktop\ComboFix.exe
    * Created a new restore point
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\_OTMoveIt\MovedFiles\Program Files\kernel\kernel .exe
    C:\Documents and Settings\NotADMIN!\Application Data\MANTEC~1
    C:\Documents and Settings\NotADMIN!\Application Data\MANTEC~1\??mantec\
    C:\Documents and Settings\NotADMIN!\Application Data\MANTEC~1\wucrtupd .exe
    C:\Documents and Settings\NotADMIN!\Application Data\MANTEC~1\wucrtupd.exe
    C:\Documents and Settings\NotADMIN!\Start Menu\Programs\Outerinfo
    C:\Documents and Settings\NotADMIN!\Start Menu\Programs\Outerinfo\Terms.lnk
    C:\Documents and Settings\NotADMIN!\Start Menu\Programs\Outerinfo\Uninstall.lnk
    C:\Program Files\Ares\Ares .exe
    C:\Program Files\Ares\Ares .exe
    C:\Program Files\Ares\Ares .exe
    C:\Program Files\Ares\Ares.exe
    C:\Program Files\Messenger\msmsgs .exe
    C:\Program Files\MSN\lawuhevol.dll
    C:\Program Files\MSN\lawuhevol825.dll
    C:\Program Files\MSN\lawuhevol878.dll
    C:\Program Files\MSN\progyvaprak.html
    C:\Program Files\Online Services\holenut4444.dll
    C:\Program Files\Online Services\holenut83122.dll
    C:\Program Files\outerinfo
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\Temp\1cb
    C:\Temp\1cb\syscheck.log
    C:\WINDOWS\b122.exe
    C:\WINDOWS\Downloaded Program Files\UGA6P_0001_N122M2210NetInstaller.exe
    C:\WINDOWS\mrofinu1000106.exe
    C:\WINDOWS\system32\dobe~1
    C:\WINDOWS\system32\dobe~1\t?skmgr.exe
    C:\WINDOWS\system32\ijllm.ini
    C:\WINDOWS\system32\ijllm.ini2
    C:\WINDOWS\system32\mllji.dll
    C:\WINDOWS\system32\mllji.exe
    C:\WINDOWS\system32\pac.txt
    C:\WINDOWS\system32\RCXA.tmp
    C:\WINDOWS\system32\wnsinticomsv32.exe
    C:\WINDOWS\system32\wnsxs~1
    C:\WINDOWS\system32\wnsxs~1\rotr.exe
    C:\WINDOWS\system32\wnsxs~1\W?nSxS\
    C:\WINDOWS\system32\xbc.dll
    C:\WINDOWS\system32\yayyxww.dll
    C:\WINDOWS\tk58.exe

    Code:
     <pre>
C:\Program Files\Messenger\msmsgs .exe ---> QooBox
C:\Program Files\Spybot - Search & Destroy\TeaTimer .exe ---> TeaTimer.exe
C:\_OTMoveIt\MovedFiles\Program Files\kernel\kernel .exe ---> QooBox
</pre>
    .
    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))

    .
    -------\LEGACY_CMDSERVICE
    -------\LEGACY_NETWORK_MONITOR


    ((((((((((((((((((((((((( Files Created from 2007-12-08 to 2008-01-08 )))))))))))))))))))))))))))))))
    .

    2008-01-08 20:29 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
    2008-01-08 20:01 . 2008-01-08 20:23 <DIR> d-------- C:\VundoFix Backups
    2008-01-08 18:06 . 2008-01-08 18:06 329,728 --a------ C:\WINDOWS\system32\RCX111.tmp
    2008-01-08 18:00 . 2008-01-08 18:00 <DIR> d-------- C:\Documents and Settings\Unawesomesauce\Application Data\Ventrilo
    2008-01-08 13:25 . 2008-01-08 13:25 <DIR> d-------- C:\Documents and Settings\Unawesomesauce\Application Data\Logitech
    2008-01-08 13:25 . 2004-08-04 00:56 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
    2008-01-08 13:14 . 2008-01-08 13:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-01-08 12:52 . 2008-01-08 12:52 4,958,588 --a------ C:\WINDOWS\{00000002-00000000-0000000C-00001102-00000004-10021102}.BAK
    2008-01-08 12:37 . 2008-01-08 12:37 <DIR> d-------- C:\Program Files\CCleaner
    2008-01-08 12:32 . 2008-01-08 12:32 <DIR> d-------- C:\Program Files\Trend Micro
    2008-01-08 12:29 . 2008-01-08 12:29 <DIR> d-------- C:\Program Files\SpywareBlaster
    2008-01-08 12:22 . 2008-01-08 12:22 <DIR> d-------- C:\WINDOWS\system32\mi54
    2008-01-08 12:22 . 2008-01-08 12:22 <DIR> d-------- C:\WINDOWS\system32\lo1
    2008-01-08 12:22 . 2008-01-08 12:22 <DIR> d-------- C:\WINDOWS\system32\ardCo01
    2008-01-08 12:22 . 2008-01-08 12:22 <DIR> d-------- C:\Temp\cEeer12
    2008-01-08 12:22 . 2008-01-08 20:31 <DIR> d-------- C:\Temp
    2008-01-08 12:22 . 2008-01-08 12:24 39,936 --a------ C:\WINDOWS\mrofinu572.exe.tmp
    2008-01-08 12:17 . 2008-01-08 12:17 <DIR> d-------- C:\WINDOWS\Sun
    2008-01-07 22:21 . 2008-01-07 22:21 <DIR> d-------- C:\Program Files\Miranda IM
    2008-01-07 22:21 . 2008-01-07 22:21 <DIR> d-------- C:\Documents and Settings\NotADMIN!\Application Data\Miranda
    2008-01-07 19:17 . 2008-01-07 19:17 <DIR> d-------- C:\Program Files\Ventrilo
    2008-01-07 19:17 . 2008-01-07 19:17 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
    2008-01-07 19:12 . 2008-01-07 19:12 <DIR> d-------- C:\Program Files\Java
    2008-01-07 19:12 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
    2008-01-07 19:11 . 2008-01-07 19:11 <DIR> d-------- C:\Program Files\Common Files\Java
    2008-01-07 02:07 . 2008-01-07 22:21 <DIR> d-------- C:\Downloads
    2008-01-07 02:07 . 2008-01-07 02:07 2,560 --a------ C:\WINDOWS\system32\bitcometres.dll
    2008-01-07 02:06 . 2008-01-06 13:52 <DIR> d-------- C:\Program Files\BitComet
    2008-01-06 16:11 . 2004-08-03 23:14 359,040 --a------ C:\WINDOWS\system32\drivers\tcpip.sys.ORIGINAL
    2008-01-06 16:11 . 2008-01-06 16:11 359,040 --a--c--- C:\WINDOWS\system32\dllcache\tcpip.sys.ORIGINAL
    2008-01-06 16:11 . 2008-01-06 16:11 359,040 --a--c--- C:\WINDOWS\system32\dllcache\tcpip.sys
    2007-12-31 22:08 . 2007-12-31 22:08 <DIR> d-------- C:\Program Files\GCFScape
    2007-12-31 20:39 . 2008-01-08 20:31 30,888 --a------ C:\WINDOWS\system32\BMXStateBkp-{00000002-00000000-0000000C-00001102-00000004-10021102}.rfx
    2007-12-31 20:39 . 2008-01-08 20:31 30,888 --a------ C:\WINDOWS\system32\BMXState-{00000002-00000000-0000000C-00001102-00000004-10021102}.rfx
    2007-12-31 20:39 . 2008-01-08 20:31 30,528 --a------ C:\WINDOWS\system32\BMXCtrlState-{00000002-00000000-0000000C-00001102-00000004-10021102}.rfx
    2007-12-31 20:39 . 2008-01-08 20:31 30,528 --a------ C:\WINDOWS\system32\BMXBkpCtrlState-{00000002-00000000-0000000C-00001102-00000004-10021102}.rfx
    2007-12-31 20:39 . 2008-01-08 20:31 11,564 --a------ C:\WINDOWS\system32\DVCState-{00000002-00000000-0000000C-00001102-00000004-10021102}.rfx
    2007-12-31 20:39 . 2008-01-08 20:31 1,080 --a------ C:\WINDOWS\system32\settingsbkup.sfm
    2007-12-31 20:39 . 2008-01-08 20:31 1,080 --a------ C:\WINDOWS\system32\settings.sfm
    2007-12-31 20:38 . 2008-01-08 12:52 4,958,588 --a------ C:\WINDOWS\{00000002-00000000-0000000C-00001102-00000004-10021102}.CDF
    2007-12-31 20:38 . 2000-12-05 09:11 4,174,814 --------- C:\WINDOWS\system32\CT4MGM.SF2
    2007-12-31 20:38 . 2007-12-31 20:38 409,600 --a------ C:\WINDOWS\system32\wrap_oal.dll
    2007-12-31 20:38 . 2006-08-11 15:14 86,446 --a------ C:\WINDOWS\system32\instwdm.ini
    2007-12-31 20:38 . 2006-08-11 14:55 10,240 --a------ C:\WINDOWS\CTDCRES.DLL
    2007-12-31 20:38 . 2006-08-11 14:56 3,072 --a------ C:\WINDOWS\CTXFIRES.DLL
    2007-12-31 10:27 . 2008-01-01 00:31 <DIR> d-------- C:\Program Files\Cheat Engine
    2007-12-31 10:27 . 2006-09-04 19:16 1,970,176 --a------ C:\WINDOWS\system32\d3dx9.dll
    2007-12-31 10:27 . 2006-09-04 19:16 679,936 --a------ C:\WINDOWS\system32\D3DX81ab.dll
    2007-12-29 00:23 . 2007-12-29 00:23 <DIR> d-------- C:\Program Files\Common Files\Adobe
    2007-12-29 00:23 . 2007-12-29 00:23 <DIR> d-------- C:\Documents and Settings\NotADMIN!\Application Data\AdobeUM
    2007-12-29 00:22 . 2007-12-29 00:22 <DIR> d-------- C:\WINDOWS\Cache
    2007-12-29 00:18 . 2007-12-29 00:18 <DIR> d-------- C:\Program Files\Stardock
    2007-12-29 00:18 . 2007-12-29 00:18 <DIR> d-------- C:\Program Files\Common Files\Stardock
    2007-12-29 00:18 . 2002-01-05 06:40 487,424 --a------ C:\WINDOWS\system32\msvcp70.dll
    2007-12-29 00:18 . 2002-01-05 07:37 344,064 --a------ C:\WINDOWS\system32\msvcr70.dll
    2007-12-29 00:18 . 2002-01-05 06:38 54,784 --a------ C:\WINDOWS\system32\msvci70.dll
    2007-12-29 00:18 . 2000-10-20 00:05 25,088 --a------ C:\WINDOWS\system32\msxml3a.dll
    2007-12-21 16:47 . 2007-10-22 16:47 32 -ra------ C:\Documents and Settings\All Users\hash.dat
    2007-12-21 16:39 . 2007-12-21 16:39 <DIR> d-------- C:\Program Files\Three Rings Design
    2007-12-21 11:05 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
    2007-12-21 11:05 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
    2007-12-19 14:13 . 2007-12-19 14:13 <DIR> d-------- C:\Documents and Settings\NotADMIN!\Application Data\uqm
    2007-12-18 21:19 . 2007-12-18 21:30 <DIR> d-------- C:\wankstain
    2007-12-18 21:13 . 2007-12-18 21:13 <DIR> d---s---- C:\Documents and Settings\NotADMIN!\UserData
    2007-12-18 21:11 . 2007-07-19 18:14 3,727,720 --a------ C:\WINDOWS\system32\d3dx9_35.dll
    2007-12-18 20:50 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
    2007-12-18 16:10 . 2007-12-18 16:10 <DIR> d-------- C:\Program Files\Hamachi
    2007-12-18 16:10 . 2008-01-08 20:32 <DIR> d-------- C:\Documents and Settings\NotADMIN!\Application Data\Hamachi
    2007-12-18 16:10 . 2007-12-18 16:10 25,280 --a------ C:\WINDOWS\system32\drivers\hamachi.sys
    2007-12-18 00:17 . 2008-01-06 19:08 38 --a------ C:\WINDOWS\avisplitter.INI
    2007-12-17 23:39 . 2007-12-17 23:39 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
    2007-12-17 23:33 . 2007-12-17 23:33 <DIR> d-------- C:\Documents and Settings\NotADMIN!\Application Data\vlc
    2007-12-17 23:32 . 2007-12-17 23:32 <DIR> d-------- C:\Program Files\VideoLAN
    2007-12-17 23:30 . 2008-01-08 20:31 <DIR> d-------- C:\Program Files\Ares
    2007-12-17 20:56 . 2007-12-17 20:56 <DIR> d-------- C:\Program Files\Opera
    2007-12-17 20:42 . 2007-12-17 20:42 <DIR> d-------- C:\Program Files\DAEMON Tools
    2007-12-17 20:38 . 2007-12-17 20:38 646,392 --a------ C:\WINDOWS\system32\drivers\sptd.sys
    2007-12-17 20:32 . 2007-12-17 20:32 <DIR> d-------- C:\Program Files\Winamp
    2007-12-17 20:32 . 2008-01-08 12:37 1,065 --a------ C:\WINDOWS\winamp.ini
    2007-12-17 20:24 . 2007-12-17 20:24 <DIR> d-------- C:\Documents and Settings\NotADMIN!\Application Data\Ventrilo

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-01-06 16:11 359,040 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
    2007-12-31 20:38 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2007-12-31 20:38 --------- d-----w C:\Program Files\Creative
    2007-12-31 20:38 --------- d-----w C:\Documents and Settings\NotADMIN!\Application Data\Creative
    2007-12-31 20:36 --------- d-----w C:\Program Files\Common Files\InstallShield
    2007-12-17 18:32 --------- d-----w C:\Documents and Settings\NotADMIN!\Application Data\Logitech
    2007-12-17 18:31 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
    2007-12-17 18:31 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf
    2007-12-17 18:31 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
    2007-12-17 18:31 --------- d-----w C:\Program Files\Common Files\Logitech
    2007-12-17 18:31 --------- d-----w C:\Program Files\Common Files\LogiShared
    2007-12-17 18:31 --------- d-----w C:\Documents and Settings\NotADMIN!\Application Data\Leadertech
    2007-12-17 18:30 --------- d-----w C:\Program Files\Logitech
    2007-12-17 18:30 --------- d-----w C:\Documents and Settings\NotADMIN!\Application Data\InstallShield
    2007-12-17 18:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Logitech
    2007-12-17 18:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\LogiShrd
    2007-12-17 18:28 --------- d-----w C:\Program Files\Microsoft ActiveSync
    2007-12-17 18:12 --------- d-----w C:\Program Files\ATI Technologies
    2007-12-17 18:08 --------- d-----w C:\Program Files\Intel
    2007-12-17 17:30 --------- d-----w C:\Program Files\microsoft frontpage
    2003-07-17 10:26 448,640 ----a-w C:\WINDOWS\inf\EL2K_N64.sys
    2003-07-17 10:22 147,328 ----a-w C:\WINDOWS\inf\EL2K_XP.sys
    2003-06-03 15:47 147,328 ----a-w C:\WINDOWS\inf\EL2K_2K.sys
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ares"="C:\Program Files\Ares\Ares .exe" [ ]
    "Atqt"="C:\WINDOWS\system32\?dobe\t?skmgr.exe" [ ]
    "kernel"="C:\Program Files\kernel\kernel.exe" [ ]
    "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-08 20:27 1460560]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:56 15360]

    C:\Documents and Settings\NotADMIN!\Start Menu\Programs\Startup\
    hamachi.lnk - C:\Program Files\Hamachi\hamachi.exe [2007-12-18 16:10:06]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-12-17 18:30:52]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
    @=""

    [HKLM\~\startupfolder\C:^Documents and Settings^NotADMIN!^Start Menu^Programs^Startup^Product Registration.lnk]
    path=C:\Documents and Settings\NotADMIN!\Start Menu\Programs\Startup\Product Registration.lnk
    backup=C:\WINDOWS\pss\Product Registration.lnkStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares]
    C:\Program Files\Ares\Ares.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
    --a------ 2006-11-12 10:48 157592 C:\Program Files\DAEMON Tools\daemon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "cmdService"=2 (0x2)

    R3 ctgame;Game Port;C:\WINDOWS\system32\DRIVERS\ctgame.sys [2002-12-30 10:53]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{63ba4b42-b4e4-11dc-bf50-000ea60716d8}]
    \Shell\AutoRun\command - I:\NoAutoRun.exe

    .
    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-01-08 20:32:31
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-01-08 20:33:13 - machine was rebooted
    ComboFix-quarantined-files.txt 2008-01-08 20:33:04
  4. 2008-01-08, 21:41 #4
    Spywared
    Spywared is offline
    Junior Member
    Join Date
    Jan 2008
    Posts
    6

    Default

    and hijackthis log after renamed the executable

    And the hijack this log
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 20:37:13, on 08/01/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Opera\Opera.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\Program Files\Trend Micro\HijackThis\safer.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares .exe" -h
    O4 - HKCU\..\Run: [Atqt] C:\WINDOWS\system32\?dobe\t?skmgr.exe
    O4 - HKCU\..\Run: [kernel] C:\Program Files\kernel\kernel.exe
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll/206 (file missing)
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O15 - Trusted Zone: *.amaena.com (HKLM)
    O15 - Trusted Zone: *.avsystemcare.com (HKLM)
    O15 - Trusted Zone: *.gomyhit.com (HKLM)
    O15 - Trusted Zone: *.imageservr.com (HKLM)
    O15 - Trusted Zone: *.imagesrvr.com (HKLM)
    O15 - Trusted Zone: *.onerateld.com (HKLM)
    O15 - Trusted Zone: *.safetydownload.com (HKLM)
    O15 - Trusted Zone: *.storageguardsoft.com (HKLM)
    O15 - Trusted Zone: *.trustedantivirus.com (HKLM)
    O15 - Trusted Zone: *.virusschlacht.com (HKLM)
    O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

    --
    End of file - 4383 bytes
  5. 2008-01-09, 00:33 #5
    ken545
    ken545 is offline
    Emeritus-Security Expert
    Join Date
    Nov 2005
    Location
    Florida's SpaceCoast
    Posts
    15,208

    Default

    Hello,

    One of the infections you have is a Vundo File Infector, this infection infects legitimate files on your system, this is what we need to do.

    Spybot Search and Destroy is infected so uninstall the program via the Add Remove Programs in the Control Panel.

    Reboot after you uninstall it.

    Some of the entries where not removed so run this again.

    Download: DelDomains and save it to the desktop.
    • Close all open windows and your browser
    • Right Click DelDomains.inf and select > Install
    • Reboot your computer


    Internet Explorer is needed to run this properly.



    Open HijackThis > Do a System Scan Only, close your browser and all open windows including this one, the only program or window you should have open is HijackThis, check the following entries and click on Fix Checked.

    O4 - HKCU\..\Run: [Atqt] C:\WINDOWS\system32\?dobe\t?skmgr.exe
    O4 - HKCU\..\Run: [kernel] C:\Program Files\kernel\kernel.exe

    Open Notepad and copy all the text inside the quote box by highlighting it all and pressing CTRL C on your keyboard, then paste it into Notepad, make sure there is no space before and above File::

    File::
    C:\WINDOWS\mrofinu572.exe.tmp

    Folder::
    C:\VundoFix Backups
    C:\Program Files\kernel

    RenV::
    C:\Program Files\Messenger\msmsgs .exe ---> QooBox
    C:\Program Files\Spybot - Search & Destroy\TeaTimer .exe ---> TeaTimer.exe
    C:\_OTMoveIt\MovedFiles\Program Files\kernel\kernel .exe ---> QooBox
    Save this as CFScript to your desktop.

    Then drag the CFScript into ComboFix.exe as you see in the screenshot below.




    This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.
    Microsoft MVP Consumer Security 2007-2008-2009-2010-2011-2012-2013-2014

    ERROR MESSAGE 386
    No KeyBoard Detected
    Press F1 To Continue

    Just a reminder that threads will be closed if no reply in 3 days.
  6. 2008-01-09, 02:04 #6
    Spywared
    Spywared is offline
    Junior Member
    Join Date
    Jan 2008
    Posts
    6

    Default

    ComboFix 08-01-09.2 - NotADMIN! 2008-01-09 0:59:12.2 - NTFSx86
    Microsoft Windows XP Professional 5.1.2600.2.1252.1.1033.18.1706 [GMT 0:00]
    Running from: C:\Documents and Settings\NotADMIN!\Desktop\ComboFix.exe
    Command switches used :: C:\Documents and Settings\NotADMIN!\Desktop\CFScript.txt
    * Created a new restore point

    FILE
    C:\WINDOWS\mrofinu572.exe.tmp
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\VundoFix Backups
    C:\VundoFix Backups\iifgefd.dll.bad
    C:\VundoFix Backups\ijllm.ini.bad
    C:\VundoFix Backups\ijllm.ini2.bad
    C:\VundoFix Backups\jkkkjhh.dll.bad
    C:\VundoFix Backups\mllji.dll.bad
    C:\VundoFix Backups\mllji.exe.bad
    C:\VundoFix Backups\mrofinu572.exe.bad
    C:\VundoFix Backups\yayyxww.dll.bad
    C:\WINDOWS\mrofinu572.exe.tmp

    .
    ((((((((((((((((((((((((( Files Created from 2007-12-09 to 2008-01-09 )))))))))))))))))))))))))))))))
    .

    2008-01-08 22:15 . 2008-01-08 22:15 <DIR> d--h----- C:\WINDOWS\PIF
    2008-01-08 20:29 . 2000-08-31 08:00 51,200 --a------ C:\WINDOWS\NirCmd.exe
    2008-01-08 18:06 . 2008-01-08 18:06 329,728 --a------ C:\WINDOWS\system32\RCX111.tmp
    2008-01-08 18:00 . 2008-01-08 18:00 <DIR> d-------- C:\Documents and Settings\Unawesomesauce\Application Data\Ventrilo
    2008-01-08 13:25 . 2008-01-08 13:25 <DIR> d-------- C:\Documents and Settings\Unawesomesauce\Application Data\Logitech
    2008-01-08 13:25 . 2004-08-04 00:56 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
    2008-01-08 13:14 . 2008-01-09 00:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-01-08 12:52 . 2008-01-08 12:52 4,958,588 --a------ C:\WINDOWS\{00000002-00000000-0000000C-00001102-00000004-10021102}.BAK
    2008-01-08 12:37 . 2008-01-08 12:37 <DIR> d-------- C:\Program Files\CCleaner
    2008-01-08 12:32 . 2008-01-08 12:32 <DIR> d-------- C:\Program Files\Trend Micro
    2008-01-08 12:29 . 2008-01-08 12:29 <DIR> d-------- C:\Program Files\SpywareBlaster
    2008-01-08 12:22 . 2008-01-08 12:22 <DIR> d-------- C:\WINDOWS\system32\mi54
    2008-01-08 12:22 . 2008-01-08 12:22 <DIR> d-------- C:\WINDOWS\system32\lo1
    2008-01-08 12:22 . 2008-01-08 12:22 <DIR> d-------- C:\WINDOWS\system32\ardCo01
    2008-01-08 12:22 . 2008-01-08 12:22 <DIR> d-------- C:\Temp\cEeer12
    2008-01-08 12:22 . 2008-01-08 20:31 <DIR> d-------- C:\Temp
    2008-01-08 12:17 . 2008-01-08 12:17 <DIR> d-------- C:\WINDOWS\Sun
    2008-01-07 22:21 . 2008-01-07 22:21 <DIR> d-------- C:\Program Files\Miranda IM
    2008-01-07 22:21 . 2008-01-08 21:46 <DIR> d-------- C:\Documents and Settings\NotADMIN!\Application Data\Miranda
    2008-01-07 19:17 . 2008-01-07 19:17 <DIR> d-------- C:\Program Files\Ventrilo
    2008-01-07 19:17 . 2008-01-07 19:17 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
    2008-01-07 19:12 . 2008-01-07 19:12 <DIR> d-------- C:\Program Files\Java
    2008-01-07 19:12 . 2007-09-24 23:31 69,632 --a------ C:\WINDOWS\system32\javacpl.cpl
    2008-01-07 19:11 . 2008-01-07 19:11 <DIR> d-------- C:\Program Files\Common Files\Java
    2008-01-07 02:07 . 2008-01-07 22:21 <DIR> d-------- C:\Downloads
    2008-01-07 02:07 . 2008-01-07 02:07 2,560 --a------ C:\WINDOWS\system32\bitcometres.dll
    2008-01-07 02:06 . 2008-01-06 13:52 <DIR> d-------- C:\Program Files\BitComet
    2008-01-06 16:11 . 2004-08-03 23:14 359,040 --a------ C:\WINDOWS\system32\drivers\tcpip.sys.ORIGINAL
    2008-01-06 16:11 . 2008-01-06 16:11 359,040 --a--c--- C:\WINDOWS\system32\dllcache\tcpip.sys.ORIGINAL
    2008-01-06 16:11 . 2008-01-06 16:11 359,040 --a--c--- C:\WINDOWS\system32\dllcache\tcpip.sys
    2007-12-31 22:08 . 2007-12-31 22:08 <DIR> d-------- C:\Program Files\GCFScape
    2007-12-31 20:39 . 2008-01-09 00:55 31,056 --a------ C:\WINDOWS\system32\BMXStateBkp-{00000002-00000000-0000000C-00001102-00000004-10021102}.rfx
    2007-12-31 20:39 . 2008-01-09 00:55 31,056 --a------ C:\WINDOWS\system32\BMXState-{00000002-00000000-0000000C-00001102-00000004-10021102}.rfx
    2007-12-31 20:39 . 2008-01-09 00:55 30,528 --a------ C:\WINDOWS\system32\BMXCtrlState-{00000002-00000000-0000000C-00001102-00000004-10021102}.rfx
    2007-12-31 20:39 . 2008-01-09 00:55 30,528 --a------ C:\WINDOWS\system32\BMXBkpCtrlState-{00000002-00000000-0000000C-00001102-00000004-10021102}.rfx
    2007-12-31 20:39 . 2008-01-09 00:55 11,564 --a------ C:\WINDOWS\system32\DVCState-{00000002-00000000-0000000C-00001102-00000004-10021102}.rfx
    2007-12-31 20:39 . 2008-01-09 00:55 1,080 --a------ C:\WINDOWS\system32\settingsbkup.sfm
    2007-12-31 20:39 . 2008-01-09 00:55 1,080 --a------ C:\WINDOWS\system32\settings.sfm
    2007-12-31 20:38 . 2008-01-08 12:52 4,958,588 --a------ C:\WINDOWS\{00000002-00000000-0000000C-00001102-00000004-10021102}.CDF
    2007-12-31 20:38 . 2000-12-05 09:11 4,174,814 --------- C:\WINDOWS\system32\CT4MGM.SF2
    2007-12-31 20:38 . 2007-12-31 20:38 409,600 --a------ C:\WINDOWS\system32\wrap_oal.dll
    2007-12-31 20:38 . 2006-08-11 15:14 86,446 --a------ C:\WINDOWS\system32\instwdm.ini
    2007-12-31 20:38 . 2006-08-11 14:55 10,240 --a------ C:\WINDOWS\CTDCRES.DLL
    2007-12-31 20:38 . 2006-08-11 14:56 3,072 --a------ C:\WINDOWS\CTXFIRES.DLL
    2007-12-31 10:27 . 2008-01-01 00:31 <DIR> d-------- C:\Program Files\Cheat Engine
    2007-12-31 10:27 . 2006-09-04 19:16 1,970,176 --a------ C:\WINDOWS\system32\d3dx9.dll
    2007-12-31 10:27 . 2006-09-04 19:16 679,936 --a------ C:\WINDOWS\system32\D3DX81ab.dll
    2007-12-29 00:23 . 2007-12-29 00:23 <DIR> d-------- C:\Program Files\Common Files\Adobe
    2007-12-29 00:23 . 2007-12-29 00:23 <DIR> d-------- C:\Documents and Settings\NotADMIN!\Application Data\AdobeUM
    2007-12-29 00:22 . 2007-12-29 00:22 <DIR> d-------- C:\WINDOWS\Cache
    2007-12-29 00:18 . 2007-12-29 00:18 <DIR> d-------- C:\Program Files\Stardock
    2007-12-29 00:18 . 2007-12-29 00:18 <DIR> d-------- C:\Program Files\Common Files\Stardock
    2007-12-29 00:18 . 2002-01-05 06:40 487,424 --a------ C:\WINDOWS\system32\msvcp70.dll
    2007-12-29 00:18 . 2002-01-05 07:37 344,064 --a------ C:\WINDOWS\system32\msvcr70.dll
    2007-12-29 00:18 . 2002-01-05 06:38 54,784 --a------ C:\WINDOWS\system32\msvci70.dll
    2007-12-29 00:18 . 2000-10-20 00:05 25,088 --a------ C:\WINDOWS\system32\msxml3a.dll
    2007-12-21 16:47 . 2007-10-22 16:47 32 -ra------ C:\Documents and Settings\All Users\hash.dat
    2007-12-21 16:39 . 2007-12-21 16:39 <DIR> d-------- C:\Program Files\Three Rings Design
    2007-12-21 11:05 . 2004-08-03 23:01 25,856 --a------ C:\WINDOWS\system32\drivers\usbprint.sys
    2007-12-21 11:05 . 2004-08-03 23:01 25,856 --a--c--- C:\WINDOWS\system32\dllcache\usbprint.sys
    2007-12-19 14:13 . 2007-12-19 14:13 <DIR> d-------- C:\Documents and Settings\NotADMIN!\Application Data\uqm
    2007-12-18 21:19 . 2007-12-18 21:30 <DIR> d-------- C:\wankstain
    2007-12-18 21:13 . 2007-12-18 21:13 <DIR> d---s---- C:\Documents and Settings\NotADMIN!\UserData
    2007-12-18 21:11 . 2007-07-19 18:14 3,727,720 --a------ C:\WINDOWS\system32\d3dx9_35.dll
    2007-12-18 20:50 . 2004-08-03 23:08 26,496 --a--c--- C:\WINDOWS\system32\dllcache\usbstor.sys
    2007-12-18 16:10 . 2007-12-18 16:10 <DIR> d-------- C:\Program Files\Hamachi
    2007-12-18 16:10 . 2008-01-09 00:57 <DIR> d-------- C:\Documents and Settings\NotADMIN!\Application Data\Hamachi
    2007-12-18 16:10 . 2007-12-18 16:10 25,280 --a------ C:\WINDOWS\system32\drivers\hamachi.sys
    2007-12-18 00:17 . 2008-01-06 19:08 38 --a------ C:\WINDOWS\avisplitter.INI
    2007-12-17 23:39 . 2007-12-17 23:39 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
    2007-12-17 23:33 . 2007-12-17 23:33 <DIR> d-------- C:\Documents and Settings\NotADMIN!\Application Data\vlc
    2007-12-17 23:32 . 2007-12-17 23:32 <DIR> d-------- C:\Program Files\VideoLAN
    2007-12-17 23:30 . 2008-01-08 20:31 <DIR> d-------- C:\Program Files\Ares
    2007-12-17 20:56 . 2007-12-17 20:56 <DIR> d-------- C:\Program Files\Opera
    2007-12-17 20:42 . 2007-12-17 20:42 <DIR> d-------- C:\Program Files\DAEMON Tools
    2007-12-17 20:38 . 2007-12-17 20:38 646,392 --a------ C:\WINDOWS\system32\drivers\sptd.sys
    2007-12-17 20:32 . 2007-12-17 20:32 <DIR> d-------- C:\Program Files\Winamp
    2007-12-17 20:32 . 2008-01-08 12:37 1,065 --a------ C:\WINDOWS\winamp.ini
    2007-12-17 20:24 . 2007-12-17 20:24 <DIR> d-------- C:\Documents and Settings\NotADMIN!\Application Data\Ventrilo

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-01-06 16:11 359,040 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
    2007-12-31 20:38 86,016 ----a-w C:\WINDOWS\system32\OpenAL32.dll
    2007-12-31 20:38 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2007-12-31 20:38 --------- d-----w C:\Program Files\Creative
    2007-12-31 20:38 --------- d-----w C:\Documents and Settings\NotADMIN!\Application Data\Creative
    2007-12-31 20:36 --------- d-----w C:\Program Files\Common Files\InstallShield
    2007-12-17 18:32 --------- d-----w C:\Documents and Settings\NotADMIN!\Application Data\Logitech
    2007-12-17 18:31 0 ---ha-w C:\WINDOWS\system32\drivers\MsftWdf_Kernel_01005_Coinstaller_Critical.Wdf
    2007-12-17 18:31 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LUsbFilt_01005.Wdf
    2007-12-17 18:31 0 ---ha-w C:\WINDOWS\system32\drivers\Msft_Kernel_LMouFilt_01005.Wdf
    2007-12-17 18:31 --------- d-----w C:\Program Files\Common Files\Logitech
    2007-12-17 18:31 --------- d-----w C:\Program Files\Common Files\LogiShared
    2007-12-17 18:31 --------- d-----w C:\Documents and Settings\NotADMIN!\Application Data\Leadertech
    2007-12-17 18:30 --------- d-----w C:\Program Files\Logitech
    2007-12-17 18:30 --------- d-----w C:\Documents and Settings\NotADMIN!\Application Data\InstallShield
    2007-12-17 18:30 --------- d-----w C:\Documents and Settings\All Users\Application Data\Logitech
    2007-12-17 18:29 --------- d-----w C:\Documents and Settings\All Users\Application Data\LogiShrd
    2007-12-17 18:28 --------- d-----w C:\Program Files\Microsoft ActiveSync
    2007-12-17 18:12 --------- d-----w C:\Program Files\ATI Technologies
    2007-12-17 18:08 --------- d-----w C:\Program Files\Intel
    2007-12-17 17:30 --------- d-----w C:\Program Files\microsoft frontpage
    2007-11-02 04:57 9,314,304 ----a-w C:\WINDOWS\system32\atioglx2.dll
    2007-11-02 04:24 176,128 ----a-w C:\WINDOWS\system32\atiok3x2.dll
    2007-11-02 04:10 364,544 ----a-w C:\WINDOWS\system32\ATIDEMGX.dll
    2007-11-02 04:09 268,288 ----a-w C:\WINDOWS\system32\ati2dvag.dll
    2007-11-02 04:01 26,112 ----a-w C:\WINDOWS\system32\Ati2mdxx.exe
    2007-11-02 04:01 143,360 ----a-w C:\WINDOWS\system32\atipdlxx.dll
    2007-11-02 04:01 122,880 ----a-w C:\WINDOWS\system32\Oemdspif.dll
    2007-11-02 04:00 43,520 ----a-w C:\WINDOWS\system32\ati2edxx.dll
    2007-11-02 04:00 122,880 ----a-w C:\WINDOWS\system32\ati2evxx.dll
    2007-11-02 03:59 495,616 ----a-w C:\WINDOWS\system32\ati2evxx.exe
    2007-11-02 03:58 53,248 ----a-w C:\WINDOWS\system32\ATIDDC.DLL
    2007-11-02 03:50 3,133,728 ----a-w C:\WINDOWS\system32\ati3duag.dll
    2007-11-02 03:39 1,602,176 ----a-w C:\WINDOWS\system32\ativvaxx.dll
    2007-11-02 03:35 307,200 ----a-w C:\WINDOWS\system32\atiiiexx.dll
    2007-11-02 03:26 5,435,392 ----a-w C:\WINDOWS\system32\atioglxx.dll
    2007-11-02 03:24 376,832 ----a-w C:\WINDOWS\system32\atikvmag.dll
    2007-11-02 03:22 17,408 ----a-w C:\WINDOWS\system32\atitvo32.dll
    2007-11-02 03:16 499,712 ----a-w C:\WINDOWS\system32\ati2cqag.dll
    2007-11-01 21:05 593,920 ------w C:\WINDOWS\system32\ati2sgag.exe
    2007-10-22 03:39 267,272 ----a-w C:\WINDOWS\system32\xactengine2_10.dll
    2007-10-22 03:37 17,928 ----a-w C:\WINDOWS\system32\X3DAudio1_2.dll
    2007-10-12 15:14 3,734,536 ----a-w C:\WINDOWS\system32\d3dx9_36.dll
    2007-10-12 15:14 1,374,232 ----a-w C:\WINDOWS\system32\D3DCompiler_36.dll
    2003-07-17 10:26 448,640 ----a-w C:\WINDOWS\inf\EL2K_N64.sys
    2003-07-17 10:22 147,328 ----a-w C:\WINDOWS\inf\EL2K_XP.sys
    2003-06-03 15:47 147,328 ----a-w C:\WINDOWS\inf\EL2K_2K.sys
    .

    ((((((((((((((((((((((((((((( snapshot@2008-01-08_20.32.55.65 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2000-08-31 08:00:00 163,328 ----a-w C:\WINDOWS\erdnt\Hiv-backup\ERDNT.EXE
    + 2008-01-09 00:59:05 237,568 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000001\NTUSER.DAT
    + 2008-01-09 00:59:05 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000002\UsrClass.dat
    + 2008-01-09 00:59:05 233,472 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000003\NTUSER.DAT
    + 2008-01-09 00:59:05 8,192 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000004\UsrClass.dat
    + 2008-01-09 00:59:06 4,644,864 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000005\NTUSER.DAT
    + 2008-01-09 00:59:06 151,552 ----a-w C:\WINDOWS\erdnt\Hiv-backup\Users\00000006\UsrClass.dat
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ares"="C:\Program Files\Ares\Ares .exe" [ ]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2004-08-04 00:56 15360]

    C:\Documents and Settings\NotADMIN!\Start Menu\Programs\Startup\
    hamachi.lnk - C:\Program Files\Hamachi\hamachi.exe [2007-12-18 16:10:06]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Logitech SetPoint.lnk - C:\Program Files\Logitech\SetPoint\SetPoint.exe [2007-12-17 18:30:52]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WdfLoadGroup]
    @=""

    [HKLM\~\startupfolder\C:^Documents and Settings^NotADMIN!^Start Menu^Programs^Startup^Product Registration.lnk]
    path=C:\Documents and Settings\NotADMIN!\Start Menu\Programs\Startup\Product Registration.lnk
    backup=C:\WINDOWS\pss\Product Registration.lnkStartup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ares]
    C:\Program Files\Ares\Ares.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools]
    --a------ 2006-11-12 10:48 157592 C:\Program Files\DAEMON Tools\daemon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
    "cmdService"=2 (0x2)

    R3 ctgame;Game Port;C:\WINDOWS\system32\DRIVERS\ctgame.sys [2002-12-30 10:53]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{63ba4b42-b4e4-11dc-bf50-000ea60716d8}]
    \Shell\AutoRun\command - I:\NoAutoRun.exe

    .
    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-01-09 00:59:53
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    Completion time: 2008-01-09 1:00:12
    ComboFix-quarantined-files.txt 2008-01-09 01:00:04
    ComboFix2.txt 2008-01-08 20:33:14


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 01:02:11, on 09/01/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Hamachi\hamachi.exe
    C:\Program Files\Opera\Opera.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Trend Micro\HijackThis\safer.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: BitComet ClickCapture - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O4 - HKCU\..\Run: [ares] "C:\Program Files\Ares\Ares .exe" -h
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Startup: hamachi.lnk = C:\Program Files\Hamachi\hamachi.exe
    O4 - Global Startup: Logitech SetPoint.lnk = C:\Program Files\Logitech\SetPoint\SetPoint.exe
    O8 - Extra context menu item: &D&ownload &with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddLink.htm
    O8 - Extra context menu item: &D&ownload all video with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddVideo.htm
    O8 - Extra context menu item: &D&ownload all with BitComet - res://C:\Program Files\BitComet\BitComet.exe/AddAllLink.htm
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - res://C:\Program Files\BitComet\tools\BitCometBHO_1.1.11.30.dll/206 (file missing)
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O23 - Service: Ares Chatroom server (AresChatServer) - Ares Development Group - C:\Program Files\Ares\chatServer.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe

    --
    End of file - 3337 bytes
  7. 2008-01-09, 02:05 #7
    Spywared
    Spywared is offline
    Junior Member
    Join Date
    Jan 2008
    Posts
    6

    Default

    My sincere thanks for the help that has been given I truly apreciate it
  8. 2008-01-09, 03:01 #8
    ken545
    ken545 is offline
    Emeritus-Security Expert
    Join Date
    Nov 2005
    Location
    Florida's SpaceCoast
    Posts
    15,208

    Default

    My sincere thanks for the help that has been given I truly apreciate it
    Not a problem, that's why where here.


    Your log looks fine , how are things running now ??
    Last edited by ken545; 2008-01-09 at 03:22.
    Microsoft MVP Consumer Security 2007-2008-2009-2010-2011-2012-2013-2014

    ERROR MESSAGE 386
    No KeyBoard Detected
    Press F1 To Continue

    Just a reminder that threads will be closed if no reply in 3 days.
  9. 2008-01-09, 12:44 #9
    Spywared
    Spywared is offline
    Junior Member
    Join Date
    Jan 2008
    Posts
    6

    Default

    appears to be running fine no pop ups, and it's running at it's old speed again once again thanks for the help
  10. 2008-01-09, 13:04 #10
    ken545
    ken545 is offline
    Emeritus-Security Expert
    Join Date
    Nov 2005
    Location
    Florida's SpaceCoast
    Posts
    15,208

    Default

    Thats great

    • ComboFix /u <-- Highlight this with your mouse and right click and select Copy
    • Go to start > run and paste in the field:
    • Then hit enter.

    This will uninstall Combofix, delete its related folders and files, reset your clock settings, hide file extensions, hide the system/hidden files and resets System Restore again.



    Here is some reading for you with tips and free tools to help keep you more secure in the future.



    If you install Spyware Blaster and Spyware Guard, do not enable the Tea Timer in Spybot Search and Destroy or they will conflict.
    Here are some free programs to install, don't leave home without them
    • Spybot Search and Destroy 1.5
      Check for Updates/ Immunize and run a Full System Scan on a regular basis.
    • Spyware Blaster It will prevent most spyware from ever being installed.
    • Spyware Guard It offers realtime protection from spyware installation attempts.
    • Win Patrol This program will warn you when any changes are being made to your system and give
      you the option to deny the change.
    • IE-Spyad
      IE-Spyad places over 4000 web sites and domains in the IE Restricted list which will severely impair attempts to infect your system. It basically prevents any downloads
      (cookies etc) from the sites listed, although you will still be able to connect to the sites.
    • Firefox 2.0 It has more features and is a lot more secure than IE. It is a very easy and
      painless download and install, it will no way interfere with IE, you can use them both.
    • Zone Alarm Here is a free Firewall from Zone Labs, I
      wouldn't access the internet without it.


    Glad we could help. Stay well.

    Safe Surfn
    Ken
    Microsoft MVP Consumer Security 2007-2008-2009-2010-2011-2012-2013-2014

    ERROR MESSAGE 386
    No KeyBoard Detected
    Press F1 To Continue

    Just a reminder that threads will be closed if no reply in 3 days.
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules