I Cannot Remove Smitfraud

[mcguiret]

-------------------------------------------------------------------------------
KASPERSKY ONLINE SCANNER REPORT
2008-02-26 09:05
Operating System: Microsoft Windows XP Professional, Service Pack 2 (Build 2600)
Kaspersky Online Scanner version: 5.0.98.0
Kaspersky Anti-Virus database last update: 26/02/2008
Kaspersky Anti-Virus database records: 581221
-------------------------------------------------------------------------------

Scan Settings:
Scan using the following antivirus database: extended
Scan Archives: true
Scan Mail Bases: true

Scan Target - My Computer:
C:\
D:\


Scan Statistics:
Total number of scanned objects: 48868
Number of viruses found: 8
Number of infected objects: 15
Number of suspicious objects: 0
Duration of the scan process: 01:15:00

Infected Object Name / Virus Name / Last Action
C:\Documents and Settings\All Users\Application Data\eFax Messenger 4.3 Output\tmcguire\~Running.ping Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
C:\Documents and Settings\All Users\Application Data\QSLLPSVCShare Object is locked skipped
C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\LocalService\NTUSER.DAT.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\NetworkService\NTUSER.DAT.LOG Object is locked skipped
C:\Documents and Settings\SMSCliSvcAcct&.EXT2501049D620\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\SMSCliSvcAcct&.EXT2501049D620\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\SMSCliSvcAcct&.EXT2501049D620\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\SMSCliSvcAcct&.EXT2501049D620\NTUSER.DAT.LOG Object is locked skipped
C:\Documents and Settings\tmcguire\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-550b5a0-402ffcaf.zip/vmain.class Infected: Exploit.Java.Gimsh.a skipped
C:\Documents and Settings\tmcguire\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-550b5a0-402ffcaf.zip ZIP: infected - 1 skipped
C:\Documents and Settings\tmcguire\Cookies\index.dat Object is locked skipped
C:\Documents and Settings\tmcguire\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
C:\Documents and Settings\tmcguire\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
C:\Documents and Settings\tmcguire\Local Settings\History\History.IE5\index.dat Object is locked skipped
C:\Documents and Settings\tmcguire\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
C:\Documents and Settings\tmcguire\NTUSER.DAT Object is locked skipped
C:\Documents and Settings\tmcguire\NTUSER.DAT.LOG Object is locked skipped
C:\Program Files\Remote Services\WENGINE\dbgtrace.log Object is locked skipped
C:\Program Files\Trend Micro\OfficeScan Client\ConnLog\Conn_20080225.log Object is locked skipped
C:\QooBox\Quarantine\C\Documents and Settings\tmcguire\p4ck.exe.vir Infected: Trojan.Win32.Agent.fxi skipped
C:\QooBox\Quarantine\catchme2008-02-24_205814.92.zip/tosdvdd.sys Infected: Rootkit.Win32.Agent.to skipped
C:\QooBox\Quarantine\catchme2008-02-24_205814.92.zip ZIP: infected - 1 skipped
C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
C:\System Volume Information\_restore{A99B2E5C-29C8-4BA9-A09B-2D03C5AF17F3}\RP1\A0000069.exe Infected: not-a-virus:RiskTool.Win32.Reboot.f skipped
C:\System Volume Information\_restore{A99B2E5C-29C8-4BA9-A09B-2D03C5AF17F3}\RP1\A0000279.exe Infected: Trojan.Win32.Agent.fxi skipped
C:\System Volume Information\_restore{A99B2E5C-29C8-4BA9-A09B-2D03C5AF17F3}\RP2\change.log Object is locked skipped
C:\TEMP\oldprofile\tmcguire\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-6b44b06f-47a712ef.zip/vmain.class Infected: Exploit.Java.Gimsh.b skipped
C:\TEMP\oldprofile\tmcguire\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-6b44b06f-47a712ef.zip ZIP: infected - 1 skipped
C:\TEMP\oldprofile\tmcguire\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-6b44b06f-4de34aa1.zip/vmain.class Infected: Exploit.Java.Gimsh.b skipped
C:\TEMP\oldprofile\tmcguire\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-6b44b06f-4de34aa1.zip ZIP: infected - 1 skipped
C:\TEMP\oldprofile\tmcguire\Local Settings\Temp\nsr1A.tmp/mobjchku.exe Infected: not-a-virus:AdWare.Win32.BHO.xv skipped
C:\TEMP\oldprofile\tmcguire\Local Settings\Temp\nsr1A.tmp ZIP: infected - 1 skipped
C:\TEMP\oldprofile\tmcguire\Local Settings\Temporary Internet Files\Content.IE5\6LAT0HKZ\wavvsnet[1].exe Infected: Trojan-Downloader.Win32.Small.hcu skipped
C:\VNCTEMP\VNCHooks.dll Infected: not-a-virus:RemoteAdmin.Win32.WinVNC-based.b skipped
C:\WINDOWS\CSC\00000001 Object is locked skipped
C:\WINDOWS\Debug\Netlogon.log Object is locked skipped
C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
C:\WINDOWS\Internet Logs\tvDebug.log Object is locked skipped
C:\WINDOWS\SchedLgU.Txt Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\edbtmp.log Object is locked skipped
C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\default Object is locked skipped
C:\WINDOWS\system32\config\default.LOG Object is locked skipped
C:\WINDOWS\system32\config\SAM Object is locked skipped
C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\SECURITY Object is locked skipped
C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
C:\WINDOWS\system32\config\software Object is locked skipped
C:\WINDOWS\system32\config\software.LOG Object is locked skipped
C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
C:\WINDOWS\system32\config\system Object is locked skipped
C:\WINDOWS\system32\config\system.LOG Object is locked skipped
C:\WINDOWS\Temp\Perflib_Perfdata_b30.dat Object is locked skipped
C:\WINDOWS\WindowsUpdate.log Object is locked skipped

Scan process completed.

[katana]

Custom CFScript

• Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:
  
  

  File::
  C:\WINDOWS\system32\msvcrit.dll
  C:\WINDOWS\wininit.ini
  C:\Documents and Settings\tmcguire\Application Data\msvcrit.dll
  C:\Documents and Settings\tmcguire\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-550b5a0-402ffcaf.zip
  C:\TEMP\oldprofile\tmcguire\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-6b44b06f-47a712ef.zip
  C:\TEMP\oldprofile\tmcguire\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-6b44b06f-4de34aa1.zip
  C:\TEMP\oldprofile\tmcguire\Local Settings\Temp\nsr1A.tmp
  C:\TEMP\oldprofile\tmcguire\Local Settings\Temporary Internet Files\Content.IE5\6LAT0HKZ\wavvsnet[1].exe
  
  Folder::
  C:\WINDOWS\system32\bm1
  C:\WINDOWS\system32\cz6
  C:\WINDOWS\system32\ps5
  C:\WINDOWS\system32\ps5
  C:\WINDOWS\system32\rp4
  Driver::
  Registry::
  [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
  "internat"=-
  "mssdbsrv"=-

• Save this as CFScript.txt and place it on your desktop.
  
  
  
  
  
• Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
• ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
• When finished, it will produce a log for you. Copy and paste the contents of the log in your next reply.

CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.



TotalScan
Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
Please go to this site Link >> TotalScan << LINK

• Under Scan Now click the Full Scan button
• Follow the prompts to install the Active X if necessary
• Go and make a cup of tea/coffee/beverage of your choice and watch some TV
• When the scan is finished, a report will be generated
• Next to Scan Details click the small Save button and save the report to your desktop.
• Please post the report in your reply.

[mcguiret]

ComboFix 08-02-25.2 - tmcguire 2008-02-27 9:31:24.3 - NTFSx86

Running from: C:\Documents and Settings\tmcguire\Desktop\ComboFix.exe
Command switches used :: C:\Documents and Settings\tmcguire\Desktop\CFScript.txt

FILE ::
C:\Documents and Settings\tmcguire\Application Data\msvcrit.dll
C:\Documents and Settings\tmcguire\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-550b5a0-402ffcaf.zip
C:\TEMP\oldprofile\tmcguire\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-6b44b06f-47a712ef.zip
C:\TEMP\oldprofile\tmcguire\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-6b44b06f-4de34aa1.zip
C:\TEMP\oldprofile\tmcguire\Local Settings\Temp\nsr1A.tmp
C:\TEMP\oldprofile\tmcguire\Local Settings\Temporary Internet Files\Content.IE5\6LAT0HKZ\wavvsnet[1].exe
C:\WINDOWS\system32\msvcrit.dll
C:\WINDOWS\wininit.ini
.

((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
.

C:\Documents and Settings\tmcguire\Application Data\msvcrit.dll
C:\Documents and Settings\tmcguire\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-550b5a0-402ffcaf.zip
C:\TEMP\oldprofile\tmcguire\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-6b44b06f-47a712ef.zip
C:\TEMP\oldprofile\tmcguire\Application Data\Sun\Java\Deployment\cache\javapi\v1.0\jar\jvmimpro.jar-6b44b06f-4de34aa1.zip
C:\TEMP\oldprofile\tmcguire\Local Settings\Temp\nsr1A.tmp
C:\TEMP\oldprofile\tmcguire\Local Settings\Temporary Internet Files\Content.IE5\6LAT0HKZ\wavvsnet[1].exe
C:\WINDOWS\system32\bm1
C:\WINDOWS\system32\cz6
C:\WINDOWS\system32\msvcrit.dll
C:\WINDOWS\system32\ps5
C:\WINDOWS\system32\ps5\advcomms3.exe
C:\WINDOWS\system32\rp4
C:\WINDOWS\wininit.ini

.
((((((((((((((((((((((((( Files Created from 2008-01-27 to 2008-02-27 )))))))))))))))))))))))))))))))
.

2008-02-26 13:10 . 2008-02-26 13:10 <DIR> d-------- C:\Program Files\MSXML 4.0
2008-02-25 23:03 . 2008-02-26 14:20 <DIR> d--h----- C:\WINDOWS\$hf_mig$
2008-02-25 17:01 . 2008-02-25 17:01 <DIR> d-------- C:\WINDOWS\ERUNT
2008-02-25 13:35 . 2008-02-25 13:35 <DIR> d-------- C:\Program Files\Microsoft IntelliPoint
2008-02-25 12:10 . 2008-02-25 17:04 <DIR> d-------- C:\SDFix
2008-02-22 18:20 . 2008-02-22 18:20 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
2008-02-22 17:34 . 2007-09-05 23:22 289,144 --a------ C:\WINDOWS\system32\VCCLSID.exe
2008-02-22 17:34 . 2006-04-27 16:49 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2008-02-22 17:34 . 2008-02-06 00:03 85,504 --a------ C:\WINDOWS\system32\VACFix.exe
2008-02-22 17:34 . 2008-01-27 14:37 81,920 --a------ C:\WINDOWS\system32\IEDFix.exe
2008-02-22 17:34 . 2003-06-05 20:13 53,248 --a------ C:\WINDOWS\system32\Process.exe
2008-02-22 17:34 . 2004-07-31 17:50 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2008-02-22 17:34 . 2007-10-03 23:36 25,600 --a------ C:\WINDOWS\system32\WS2Fix.exe
2008-02-21 23:50 . 2008-02-21 23:50 <DIR> d-------- C:\WINDOWS\system32\LogFiles
2008-02-21 14:23 . 2008-02-21 14:23 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2008-02-20 17:20 . 2008-02-22 16:01 <DIR> d-------- C:\Program Files\SUPERAntiSpyware
2008-02-20 17:19 . 2008-02-20 17:19 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
2008-02-19 08:15 . 2001-03-08 18:30 24,064 --a------ C:\WINDOWS\system32\msxml3a.dll
2008-02-15 15:44 . 2008-02-15 15:44 <DIR> d-------- C:\Documents and Settings\tmcguire\Application Data\PC Tools
2008-02-15 15:05 . 2008-02-14 21:24 610 --a------ C:\WINDOWS\wininit.sd
2008-02-15 15:05 . 2006-10-25 02:51 573 --a------ C:\WINDOWS\win.tmp
2008-02-15 15:05 . 2008-02-25 17:18 227 --a------ C:\WINDOWS\system.tmp
2008-02-15 14:46 . 2008-02-19 08:26 <DIR> d-------- C:\Program Files\Spyware Doctor
2008-02-15 14:46 . 2008-02-27 08:21 <DIR> d-a------ C:\Documents and Settings\All Users\Application Data\TEMP
2008-02-15 14:46 . 2008-02-15 14:46 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\PC Tools
2008-02-15 14:46 . 2006-08-24 12:40 51,072 --a------ C:\WINDOWS\system32\drivers\ikhlayer.sys
2008-02-15 14:46 . 2006-07-10 17:38 30,592 --a------ C:\WINDOWS\system32\drivers\ikhfile.sys
2008-02-15 14:31 . 2008-02-15 14:42 <DIR> d-------- C:\TEMP\smitRem
2008-02-15 14:14 . 2008-02-15 14:14 <DIR> d-------- C:\Program Files\SwiftView
2008-02-15 14:13 . 2008-02-15 14:14 <DIR> d-------- C:\JavaSoft
2008-02-15 14:09 . 2003-02-23 02:05 60,448 --a------ C:\WINDOWS\system32\smsrc.cpl
2008-02-15 14:08 . 2006-10-24 05:42 <DIR> d-------- C:\Documents and Settings\SMSCliToknLocalAcct&\WINDOWS
2008-02-15 14:08 . 2006-10-25 12:39 <DIR> d-------- C:\Documents and Settings\SMSCliToknLocalAcct&\SapWorkDir
2008-02-15 14:08 . 2006-10-25 12:48 <DIR> d-------- C:\Documents and Settings\SMSCliToknLocalAcct&\Application Data\Intel
2008-02-15 14:08 . 2006-10-24 10:56 <DIR> d-------- C:\Documents and Settings\SMSCliToknLocalAcct&\Application Data\Citrix
2008-02-15 14:08 . 2003-02-23 02:05 38,944 --a------ C:\WINDOWS\system32\SMSCPL32.cpl
2008-02-15 14:07 . 2006-10-24 05:42 <DIR> d-------- C:\Documents and Settings\SMSCliSvcAcct&.EXT2501049D620\WINDOWS
2008-02-15 14:07 . 2006-10-25 12:39 <DIR> d-------- C:\Documents and Settings\SMSCliSvcAcct&.EXT2501049D620\SapWorkDir
2008-02-15 14:07 . 2006-10-25 12:48 <DIR> d-------- C:\Documents and Settings\SMSCliSvcAcct&.EXT2501049D620\Application Data\Intel
2008-02-15 14:07 . 2006-10-24 10:56 <DIR> d-------- C:\Documents and Settings\SMSCliSvcAcct&.EXT2501049D620\Application Data\Citrix
2008-02-15 14:07 . 2003-02-23 02:05 16,560 --a------ C:\WINDOWS\ISMIF16.dll
2008-02-15 14:07 . 2003-02-23 02:05 12,128 --a------ C:\WINDOWS\ISMIF32.dll
2008-02-15 14:05 . 2003-02-23 02:05 65,584 --a------ C:\WINDOWS\system32\SMSCfg.cpl
2008-02-15 13:58 . 2008-02-15 14:08 <DIR> d-------- C:\VNCTEMP
2008-02-14 10:00 . 2004-11-18 16:12 1,129,472 --a------ C:\WINDOWS\system32\msxml3.tmp
2008-02-14 10:00 . 2004-11-18 16:12 44,032 --a------ C:\WINDOWS\system32\msxml3r.tmp
2008-02-14 10:00 . 2004-11-18 16:12 24,576 --a------ C:\WINDOWS\system32\msxml3a.tmp
2008-02-14 09:02 . 2008-02-14 09:02 <DIR> d-------- C:\Documents and Settings\tmcguire\Application Data\Stamps.com Internet Postage
2008-02-14 09:00 . 2008-02-14 09:02 36 --ah----- C:\WINDOWS\system32\f9t.dat
2008-02-08 15:25 . 2008-02-08 15:25 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
2008-02-07 16:37 . 2008-02-22 17:34 3,898 --a------ C:\WINDOWS\system32\tmp.reg
2008-02-07 09:32 . 2008-02-20 17:20 <DIR> d-------- C:\Documents and Settings\tmcguire\Application Data\SUPERAntiSpyware.com
2008-02-07 09:32 . 2008-02-07 09:32 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\SUPERAntiSpyware.com
2008-02-06 12:36 . 2008-02-21 14:23 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2008-02-06 10:52 . 2008-02-06 10:52 <DIR> d-------- C:\WINDOWS\Sun
2008-01-28 10:18 . 2008-01-28 10:18 7,303 --a------ C:\WINDOWS\saplogonold.ini
2008-01-28 08:26 . 2008-01-28 08:26 <DIR> d-------- C:\Program Files\Common Files\ArchestrA
2008-01-28 08:26 . 2008-01-28 08:26 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ArchestrA

.
(((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2008-02-26 18:12 --------- d-----w C:\Documents and Settings\tmcguire\Application Data\U3
2008-02-23 00:19 --------- d-----w C:\Program Files\Trend Micro
2008-01-31 22:17 --------- d-----w C:\Program Files\Common Files\Adobe
2008-01-17 16:52 --------- d-----w C:\Program Files\eFax Messenger 4.3
2008-01-17 16:52 --------- d-----w C:\Documents and Settings\All Users\Application Data\eFax Messenger 4.3 Output
2008-01-17 16:51 --------- d-----w C:\Documents and Settings\tmcguire\Application Data\eFax Messenger
2008-01-17 14:20 --------- d-----w C:\Program Files\Srs
2008-01-17 14:20 --------- d-----w C:\Program Files\Microsoft SQL Server
2008-01-17 14:20 --------- d-----w C:\Program Files\Borland
2008-01-17 14:19 --------- d-----w C:\Program Files\JavaSoft
2008-01-17 13:14 --------- d-----w C:\Program Files\Common Files\SAP Shared
2008-01-17 13:14 --------- d-----w C:\Program Files\Common Files\ESRI
2008-01-17 13:12 --------- d-----w C:\Program Files\SAP
2008-01-16 22:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\eFax Messenger 4.3 Setup
2008-01-16 22:17 --------- d-----w C:\Documents and Settings\Administrator\Application Data\eFax Messenger
2008-01-16 22:16 --------- d-----w C:\Program Files\TechSmith
2008-01-16 21:44 --------- d--h--w C:\Program Files\InstallShield Installation Information
2008-01-16 21:44 --------- d-----w C:\Program Files\Wave Systems Corp
2007-12-07 01:07 659,456 ----a-w C:\WINDOWS\system32\wininet.dll
2007-12-04 18:38 550,912 ----a-w C:\WINDOWS\system32\oleaut32.dll
2006-12-29 20:15 626,688 ----a-w C:\Program Files\Common Files\sapconsaccess.dll
2006-12-29 20:15 40,960 ----a-w C:\Program Files\Common Files\DigitalSignature.ocx
2006-12-29 20:15 3,100,672 ----a-w C:\Program Files\Common Files\sapxlhelper.dll
2006-12-29 20:15 192,512 ----a-w C:\Program Files\Common Files\sapconsr3.dll
2006-12-07 15:26 1,129,984 ----a-w C:\Program Files\Common Files\SAPActiveXL.xlt
2006-12-07 15:26 1,124,864 ----a-w C:\Program Files\Common Files\SAPActiveXL_nosig.xlt
.

((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
*Note* empty entries & legit default entries are not shown
REGEDIT4

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 07:00 15360]
"Spyware Doctor"="C:\Program Files\Spyware Doctor\swdoctor.exe" [2006-12-19 15:14 2136208]
"SUPERAntiSpyware"="C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2007-06-21 14:06 1318912]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"o2klang"="c:\windows\langver.exe" [2003-01-28 11:38 163435]
"Synchronization Manager"="C:\WINDOWS\system32\mobsync.exe" [2004-08-04 07:00 143360]
"Broadcom Wireless Manager UI"="C:\WINDOWS\system32\WLTRAY.exe" [2005-12-19 03:08 1347584]
"DVDLauncher"="C:\Program Files\CyberLink\PowerDVD\DVDLauncher.exe" [2004-04-26 02:04 53248]
"Apoint"="C:\Program Files\Apoint\Apoint.exe" [2004-09-13 13:33 155648]
"Dell QuickSet"="C:\Program Files\Dell\QuickSet\quickset.exe" [2006-04-06 08:58 1032192]
"Trend OfficeScan ImageSetup"="C:\WINDOWS\OEM\TRENDM\ImgSetup.exe" [ ]
"OfficeScanNT Monitor"="C:\Program Files\Trend Micro\OfficeScan Client\pccntmon.exe" [2005-03-15 19:55 335872]
"SigmatelSysTrayApp"="stsystra.exe" [2006-03-24 11:30 282624 C:\WINDOWS\stsystra.exe]
"Logitech Hardware Abstraction Layer"="KHALMNPR.EXE" [2005-12-20 17:38 28160 C:\WINDOWS\KHALMNPR.Exe]
"igfxtray"="C:\WINDOWS\system32\igfxtray.exe" [2006-03-23 21:17 94208]
"igfxhkcmd"="C:\WINDOWS\system32\hkcmd.exe" [2006-03-23 21:13 77824]
"igfxpers"="C:\WINDOWS\system32\igfxpers.exe" [2006-03-23 21:17 118784]
"eFax 4.3"="C:\Program Files\eFax Messenger 4.3\J2GDllCmd.exe" [2007-03-06 12:21 116224]
"Acrobat Assistant 7.0"="C:\Program Files\Adobe\Distillr\Acrotray.exe" [2004-12-14 03:12 483328]
"Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2007-10-10 19:51 39792]
"SMS Application Launcher"="C:\WINDOWS\MS\SMS\CORE\BIN\LAUNCH32.EXE" [2003-02-23 02:05 73584]
"IntelliPoint"="C:\Program Files\Microsoft IntelliPoint\ipoint.exe" [2007-02-05 18:52 849280]

[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="C:\WINDOWS\system32\CTFMON.EXE" [2004-08-04 07:00 15360]
"Spyware Doctor"="C:\Program Files\Spyware Doctor\swdoctor.exe" [2006-12-19 15:14 2136208]

C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
Adobe Acrobat Speed Launcher.lnk - C:\WINDOWS\Installer\{AC76BA86-1033-0000-BA7E-100000000002}\SC_Acrobat.exe [2008-01-31 17:08:49 25214]
Cisco Systems VPN Client.lnk - C:\Program Files\cisco systems\vpn client\vpngui.exe [2006-10-25 12:27:25 1445904]
Program Neighborhood Agent.lnk - C:\Program Files\Citrix\ICA Client\pnagent.exe [2004-10-12 20:33:08 213264]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"ForceStartMenuLogOff"= 1 (0x1)
"Intellimenus"= 1 (0x1)
"NoInstrumentation"= 1 (0x1)
"NoResolveSearch"= 1 (0x1)
"NoWelcomeScreen"= 1 (0x1)

[hkey_local_machine\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{5AE067D3-9AFB-48E0-853A-EBB7F4A000DA}"= C:\Program Files\SUPERAntiSpyware\SASSEH.DLL [2006-12-20 13:55 77824]

[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\!SASWinLogon]
C:\Program Files\SUPERAntiSpyware\SASWINLO.dll 2007-04-19 13:41 294912 C:\Program Files\SUPERAntiSpyware\SASWINLO.dll

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\Machine\Scripts\Startup\0\0]
"Script"=c:\winnt\system32\setadmin.exe

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-484763869-606747145-725345543-44281\Scripts\Logon\0\0]
"Script"=folder_redirect.EXE

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\group policy\state\S-1-5-21-484763869-606747145-725345543-44281\Scripts\Logon\1\0]
"Script"=us.EXE

[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=


[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\E]
\Shell\AutoRun\command - E:\LaunchU3.exe -a

.
**************************************************************************

catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2008-02-27 09:33:27
Windows 5.1.2600 Service Pack 2 NTFS

scanning hidden processes ...

scanning hidden autostart entries ...

scanning hidden files ...

scan completed successfully
hidden files: 0

**************************************************************************
.
--------------------- DLLs Loaded Under Running Processes ---------------------

PROCESS: C:\WINDOWS\system32\lsass.exe [5.01.2600.2180]
-> C:\Program Files\Citrix\ICA Client\pnsson.dll
.
Completion time: 2008-02-27 9:34:25
ComboFix-quarantined-files.txt 2008-02-27 14:34:22
ComboFix2.txt 2008-02-25 22:19:55
.
2008-02-26 23:46:53 --- E O F ---

[mcguiret]

;***********************************************************************************************************************************************************************************
ANALYSIS: 2008-02-27 10:22:16
PROTECTIONS: 1
MALWARE: 13
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================================================
Trend Officescan Corporate Edition 7.0 No Yes
;===================================================================================================================================================================================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===================================================================================================================================================================================
00139535 Application/Processor HackTools No 0 Yes No C:\WINDOWS\system32\Process.exe
00139535 Application/Processor HackTools No 0 Yes No C:\TEMP\smitRem\Process.exe
00139535 Application/Processor HackTools No 0 Yes No C:\System Volume Information\_restore{A99B2E5C-29C8-4BA9-A09B-2D03C5AF17F3}\RP1\A0000068.exe
00139535 Application/Processor HackTools No 0 No No C:\Documents and Settings\tmcguire\Desktop\SDFix.exe[SDFix\apps\Process.exe]
00139535 Application/Processor HackTools No 0 Yes No C:\SDFix\apps\Process.exe
00167642 Cookie/Com.com TrackingCookie No 0 Yes No C:\TEMP\oldprofile\tmcguire\Local Settings\Temp\Cookies\tmcguire@com[1].txt
00167726 Cookie/Tickle TrackingCookie No 0 Yes No C:\TEMP\oldprofile\tmcguire\Local Settings\Temp\Cookies\tmcguire@tickle[1].txt
00168108 Cookie/Tickle TrackingCookie No 0 Yes No C:\TEMP\oldprofile\tmcguire\Local Settings\Temp\Cookies\tmcguire@web.tickle[1].txt
00199984 Cookie/Searchportal TrackingCookie No 0 Yes No C:\Documents and Settings\tmcguire\Cookies\tmcguire@searchportal.information[2].txt
00207338 Cookie/Target TrackingCookie No 0 Yes No C:\Documents and Settings\tmcguire\Cookies\tmcguire@target[2].txt
00517584 Application/SuperFast HackTools No 0 Yes No C:\System Volume Information\_restore{A99B2E5C-29C8-4BA9-A09B-2D03C5AF17F3}\RP1\A0000070.exe
01185375 Application/Psexec.A HackTools No 0 Yes No C:\System Volume Information\_restore{A99B2E5C-29C8-4BA9-A09B-2D03C5AF17F3}\RP1\A0000034.EXE
01185375 Application/Psexec.A HackTools No 0 Yes No C:\System Volume Information\_restore{A99B2E5C-29C8-4BA9-A09B-2D03C5AF17F3}\RP1\A0000054.EXE
01262593 Application/NirCmd.A HackTools No 0 Yes No C:\System Volume Information\_restore{A99B2E5C-29C8-4BA9-A09B-2D03C5AF17F3}\RP1\A0000037.exe
01262593 Application/NirCmd.A HackTools No 0 No No C:\Documents and Settings\tmcguire\Desktop\ComboFix.exe[327882R2FWJFW\nircmd.com]
01262593 Application/NirCmd.A HackTools No 0 No No C:\Documents and Settings\tmcguire\Desktop\ComboFix.exe[327882R2FWJFW\nircmd.cfexe]
01262593 Application/NirCmd.A HackTools No 0 Yes No C:\System Volume Information\_restore{A99B2E5C-29C8-4BA9-A09B-2D03C5AF17F3}\RP1\A0000021.com
01262593 Application/NirCmd.A HackTools No 0 Yes No C:\WINDOWS\Nircmd.exe
01262593 Application/NirCmd.A HackTools No 0 Yes No C:\System Volume Information\_restore{A99B2E5C-29C8-4BA9-A09B-2D03C5AF17F3}\RP4\A0001237.com
01262593 Application/NirCmd.A HackTools No 0 Yes No C:\System Volume Information\_restore{A99B2E5C-29C8-4BA9-A09B-2D03C5AF17F3}\RP4\A0001208.exe
01262593 Application/NirCmd.A HackTools No 0 Yes No C:\System Volume Information\_restore{A99B2E5C-29C8-4BA9-A09B-2D03C5AF17F3}\RP1\A0000259.com
01262593 Application/NirCmd.A HackTools No 0 Yes No C:\System Volume Information\_restore{A99B2E5C-29C8-4BA9-A09B-2D03C5AF17F3}\RP1\A0000273.exe
01262593 Application/NirCmd.A HackTools No 0 Yes No C:\System Volume Information\_restore{A99B2E5C-29C8-4BA9-A09B-2D03C5AF17F3}\RP1\A0000305.com
02197130 Trj/Rebooter.J Virus/Trojan No 1 Yes No C:\System Volume Information\_restore{A99B2E5C-29C8-4BA9-A09B-2D03C5AF17F3}\RP1\A0000069.exe
02885963 Rootkit/Booto.C Virus/Worm No 0 Yes No C:\System Volume Information\_restore{A99B2E5C-29C8-4BA9-A09B-2D03C5AF17F3}\RP1\A0000047.sys
02887379 Trj/Agent.HLS Virus/Trojan No 1 Yes No C:\QooBox\Quarantine\C\TEMP\oldprofile\tmcguire\Local Settings\Temporary Internet Files\Content.IE5\6LAT0HKZ\wavvsnet[1].exe.vir
02903181 Trj/Agent.IDR Virus/Trojan No 0 Yes No C:\QooBox\Quarantine\C\Documents and Settings\tmcguire\Application Data\msvcrit.dll.vir
02903181 Trj/Agent.IDR Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{A99B2E5C-29C8-4BA9-A09B-2D03C5AF17F3}\RP4\A0001216.dll
02903181 Trj/Agent.IDR Virus/Trojan No 0 Yes No C:\QooBox\Quarantine\C\WINDOWS\system32\msvcrit.dll.vir
02903181 Trj/Agent.IDR Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{A99B2E5C-29C8-4BA9-A09B-2D03C5AF17F3}\RP1\A0000055.dll
02903181 Trj/Agent.IDR Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{A99B2E5C-29C8-4BA9-A09B-2D03C5AF17F3}\RP4\A0001215.dll
02903181 Trj/Agent.IDR Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{A99B2E5C-29C8-4BA9-A09B-2D03C5AF17F3}\RP1\A0000232.dll
02903181 Trj/Agent.IDR Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{A99B2E5C-29C8-4BA9-A09B-2D03C5AF17F3}\RP1\A0000100.dll
;===================================================================================================================================================================================
SUSPECTS
Location
;===================================================================================================================================================================================
;===================================================================================================================================================================================

[katana]

Your Java is out of date. Older versions have vulnerabilities that malware can use to infect your system.

Please follow these steps to remove older version Java components and update.

Updating Java:
Download the latest version of Java Runtime Environment (JRE) 6u4
http://java.sun.com/javase/downloads/index.jsp
Scroll down to where it says "The Java Runtime Environment (JRE) 6 update 4 allows end-users to run Java applications".
Click the "Download" button to the right.
Check the box that says: "Accept License Agreement".
The page will refresh.
Click on the link to download Windows Offline Installation with or without Multi-language and save to your desktop.
Close any programs you may have running - especially your web browser.
Go to Start > Control Panel double-click on Add/Remove programs and remove all older versions of Java.
Check for any item with Java Runtime Environment (JRE or J2SE) in the name.

• Java 2 Runtime Environment, SE v1.4.2_06

Click the Remove or Change/Remove button.
Repeat as many times as necessary to remove each Java version.

Reboot your computer once all Java components are removed.
Then from your desktop double-click on the download to install the newest version.


Congratulations your logs look clean

Let's see if I can help you keep it that way

First lets tidy up

• Click START then RUN
• Now type Combofix /u in the runbox and click OK. Note the space between the X and the U, it needs to be there.
  
  • 

You can also delete any logs we have produced, and empty your Recycle bin.

The following is some info to help you stay safe and clean.
( Vista users must ensure that any programs are Vista compatible BEFORE installing )

Online Scanners
I would recommend a scan at one or more of the following sites at least once a month.

http://www.nanoscan.com
http://www.pandasoftware.com/actives..._principal.htm
http://www.kaspersky.com/kos/eng/par...avwebscan.html

!!! Make sure that all your programs are updated !!!
Secunia Software Inspector does all the work for you, .... see HERE for details

AntiSpyware

• AntiSpyware is not the same thing as Antivirus.
  Different AntiSpyware programs detect different things, so in this case it is recommended that you have more than one.
  You should only have one running all the time, the other/s should be used "on demand" on a regular basis.
  Most of the programs in this list have a free (for Home Users ) and paid versions,
  it is worth paying for one and having "realtime" protection, unless you intend to do a manual scan often.
• Spybot - Search & Destroy <<< A must have program
  • It includes host protection and registry protection
  • A hosts file is a bit like a phone book, it points to the actual numeric address (i.e. the IP address) from the human friendly name of a website. This feature can be used to block malicious websites
• MalwareBytes Anti-malware <<< A New and effective program
• a-squared Free <<< A good "realtime" or "on demand" scanner
• AVG Anti-Spyware 7.5 <<< A good "on demand" scanner
• superantispyware <<< A good "realtime" or "on demand" scanner

Prevention

• These programs don't detect malware, they help stop it getting on your machine in the first place.
  Each does a different job, so you can have more than one
• Winpatrol
  • An excellent startup manager and then some !!
  • Notifies you if programs are added to startup
  • Allows delayed startup
  • A must have addition
• SpywareBlaster 3.5.1
  • SpywareBlaster sets killbits in the registry to prevent known malicious activex controls from installing themselves on your computer.
• SpywareGuard 2.2
  • SpywareGuard provides real-time protection against spyware.
  • Not required if you have other "realtime" antispyware or Winpatrol
• ZonedOut
  • Formerly known as IE-SPYAD, adds a long list of sites and domains associated with known advertisers and marketers to the Restricted sites zone of Internet Explorer.
• MVPS HOSTS
  • This little program packs a powerful punch as it blocks ads, banners, 3rd party Cookies, 3rd party page counters, web bugs, and many hijackers.
  • For information on how to download and install, please read this tutorial by WinHelp2002.
  • Not required if you are using other host file protections

Internet Browsers

• Microsoft has worked hard to make IE.7 a more secure browser, unfortunately whilst it is still the leading browser of choice it will always be under attack from the bad guys.
  Using a different web browser can help stop malware getting on your machine.
  
  • Make your Internet Explorer more secure - This can be done by following these simple instructions:
    1. From within Internet Explorer click on the Tools menu and then click on Options.
    2. Click once on the Security tab
    3. Click once on the Internet icon so it becomes highlighted.
    4. Click once on the Custom Level button.
       
       • Change the Download signed ActiveX controls to Prompt
       • Change the Download unsigned ActiveX controls to Disable
       • Change the Initialise and script ActiveX controls not marked as safe to Disable
       • Change the Installation of desktop items to Prompt
       • Change the Launching programs and files in an IFRAME to Prompt
       • Change the Navigate sub-frames across different domains to Prompt
       • When all these settings have been made, click on the OK button.
       • If it prompts you as to whether or not you want to save the settings, press the Yes button.
    5. Next press the Apply button and then the OK to exit the Internet Properties page.
  
  If you are still using IE6 then either update, or get one of the following.
  • FireFox
    • With many addons available that make customization easy this is a very popular choice
    • NoScript and AdBlockPlus addons are essential
  • Opera
    • Another popular alternative
  • Netscape
    • Another popular alternative
    • Also has Addons available

Cleaning Temporary Internet Files and Tracking Cookies

• Temporary Internet Files are mainly the files that are downloaded when you open a web page.
  Unfortunately, if the site you visit is of a dubious nature or has been hacked, they can also be an entry point for malware.
  It is a good idea to empty the Temporary Internet Files folder on a regular basis.
  
  Tracking Cookies are files that websites use to monitor which sites you visit and how often.
  A lot of Antispyware scanners pick up these tracking cookies and flag them as unwanted.
  CAUTION :- If you delete all your cookies you will lose any autologin information for sites that you visit, and will need your passwords
  
  Both of these can be cleaned manually, but a quicker option is to use a program
• ATF Cleaner
  • Free and very simple to use
• CCleaner
  • Free and very flexible, you can chose which cookies to keep

Also PLEASE read this article.......So How Did I Get Infected In The First Place

The last and most important thing I can tell you is UPDATE.
If you don't update your security programs (Antivirus, Antispyware even Windows) then you are at risk.
Malware changes on a day to day basis. You should update every week at the very least.

If you follow this advice then (with a bit of luck) you will never have to hear from me again :D


If you could post back one more time to let me know everything is OK, then I can have this thread archived.

Happy surfing K'

[mcguiret]

Thank you SO much for all your help!

I ran a final scan with Spybot S&D and nothing was detected!

Your service is invaluable. Thank you again.