Page 1 of 2 12 LastLast
Results 1 to 10 of 13

Thread: Facebook wont load and other viruses found

  1. 2008-03-08, 06:41 #1
    ginsoakedboy
    ginsoakedboy is offline
    Junior Member
    Join Date
    Mar 2008
    Posts
    8

    Default Facebook wont load and other viruses found

    Hi,

    I am facing problem in opening facebook. Facebook will not load and the IE remains blank. I am able to browse all other websites with no problem. I have run the Hijackthis and kaspersky online system checker. Pls advise.

    Thanks

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:03:07 AM, on 3/8/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Program Files\Airtel\NetXpert\bin\sprtsvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\PowerISO\PWRISOVM.EXE
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\system32\Rundll32.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Microsoft ActiveSync\wcescomm.exe
    C:\PROGRA~1\MI3AA1~1\rapimgr.exe
    C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: (no name) - {784F0668-80F3-4A17-8897-33ACB97A7184} - C:\WINDOWS\system32\ssttu.dll (file missing)
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: (no name) - {AD64CE0E-AC07-42DF-A21B-DF30A6334476} - C:\Program Files\Microsoft Money 2005\savefoku455101.dll (file missing)
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [PWRISOVM.EXE] C:\Program Files\PowerISO\PWRISOVM.EXE
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [24bc6bad] rundll32.exe "C:\WINDOWS\system32\wlyeonop.dll",b
    O4 - HKLM\..\Run: [BM278f5831] Rundll32.exe "C:\WINDOWS\system32\dvbvtpqx.dll",s
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
    O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
    O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
    O9 - Extra 'Tools' menuitem: Yahoo! Messenger - {E5D12C4E-7B4F-11D3-B5C9-0050045C3C96} - C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_SG&c=Q306&bd=pavilion&pf=laptop
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
    O16 - DPF: {14C1B87C-3342-445F-9B5E-365FF330A3AC} (Hewlett-Packard Online Support Services) - http://h20278.www2.hp.com/HPISWeb/Cu...ataManager.CAB
    O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) - http://chat.yahoo.com/cab/yuplapp.cab
    O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAV...oadManager.ocx
    O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://flashcasino.ladbrokes.com/in...en/FlashAX.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{2342FB3A-0E36-4B49-A28C-9432A9195AC9}: NameServer = 202.56.215.55,202.56.215.54
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: SupportSoft Sprocket Service (nxpclient) (sprtsvc_nxpclient) - SupportSoft, Inc. - C:\Program Files\Airtel\NetXpert\bin\sprtsvc.exe
    O23 - Service: SupportSoft RemoteAssist - SupportSoft, Inc. - C:\Program Files\Common Files\SupportSoft\bin\ssrc.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O24 - Desktop Component 0: (no name) - C:\Program Files\Intel\baqy.html

    --
    End of file - 10396 bytes
  2. 2008-03-08, 11:05 #2
    Markka
    Markka is offline
    Guest
    Join Date
    Jul 2007
    Location
    Finland
    Posts
    260

    Default

    Hi and welcome to the forums.
    I'm Markka and I will be helping you with your malware issues.

    I'll check your HijackThis log. Right now I'm MRU Undergrad, everything that I post to you must be checked by
    teachers of Malware Removal University.
    Please be patient.
  3. 2008-03-09, 11:04 #3
    Markka
    Markka is offline
    Guest
    Join Date
    Jul 2007
    Location
    Finland
    Posts
    260

    Default

    Hello

    Disable Teatimer:

    1) Run Spybot-S&D
    2) Go to the Mode menu, and make sure "Advanced Mode" is selected
    3) On the left hand side, choose Tools -> Resident
    4) Uncheck "Resident TeaTimer" and OK any prompts
    5) Restart your computer.
    __________________

    1. Download this file - combofix.exe
    2. Double click combofix.exe & follow the prompts.
    3. When finished, it shall produce a log for you. Post that log in your next reply

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall!
    ____________________

    Post:
    - A fresh HijackThis log
    - Contents of C:\ComboFix.txt
  4. 2008-03-09, 21:43 #4
    ginsoakedboy
    ginsoakedboy is offline
    Junior Member
    Join Date
    Mar 2008
    Posts
    8

    Default HijackThis log

    Hi Marrka,

    Thanks for your help. below is the Hijackthis log

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 2:08:20 AM, on 3/10/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Program Files\Airtel\NetXpert\bin\sprtsvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Microsoft ActiveSync\wcescomm.exe
    C:\PROGRA~1\MI3AA1~1\rapimgr.exe
    C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: (no name) - {784F0668-80F3-4A17-8897-33ACB97A7184} - C:\WINDOWS\system32\ssttu.dll (file missing)
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: (no name) - {AD64CE0E-AC07-42DF-A21B-DF30A6334476} - C:\Program Files\Microsoft Money 2005\savefoku455101.dll (file missing)
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
    O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
    O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_SG&c=Q306&bd=pavilion&pf=laptop
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
    O16 - DPF: {14C1B87C-3342-445F-9B5E-365FF330A3AC} (Hewlett-Packard Online Support Services) - http://h20278.www2.hp.com/HPISWeb/Cu...ataManager.CAB
    O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) - http://chat.yahoo.com/cab/yuplapp.cab
    O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAV...oadManager.ocx
    O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://flashcasino.ladbrokes.com/in...en/FlashAX.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{2342FB3A-0E36-4B49-A28C-9432A9195AC9}: NameServer = 202.56.215.55,202.56.215.54
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: SupportSoft Sprocket Service (nxpclient) (sprtsvc_nxpclient) - SupportSoft, Inc. - C:\Program Files\Airtel\NetXpert\bin\sprtsvc.exe
    O23 - Service: SupportSoft RemoteAssist - SupportSoft, Inc. - C:\Program Files\Common Files\SupportSoft\bin\ssrc.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O24 - Desktop Component 0: (no name) - C:\Program Files\Intel\baqy.html

    --
    End of file - 9791 bytes
  5. 2008-03-09, 21:48 #5
    ginsoakedboy
    ginsoakedboy is offline
    Junior Member
    Join Date
    Mar 2008
    Posts
    8

    Default Combofix log

    ComboFix 08-03-09.1 - Prashant Bisht 2008-03-10 1:51:14.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.140 [GMT 5.5:30]
    Running from: C:\Documents and Settings\Prashant Bisht\Desktop\ComboFix.exe
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat
    C:\Documents and Settings\Prashant Bisht\Application Data\AntiSpywareBot
    C:\Documents and Settings\Prashant Bisht\Application Data\macromedia\Flash Player\#SharedObjects\2V4YW58L\iforex.com
    C:\Documents and Settings\Prashant Bisht\Application Data\macromedia\Flash Player\#SharedObjects\2V4YW58L\iforex.com\Emerp\Events\flash_object.swf\user_data.sol
    C:\Documents and Settings\Prashant Bisht\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com
    C:\Documents and Settings\Prashant Bisht\Application Data\macromedia\Flash Player\macromedia.com\support\flashplayer\sys\#iforex.com\settings.sol
    C:\Documents and Settings\Prashant Bisht\Application Data\WinTouch
    C:\Documents and Settings\Prashant Bisht\Application Data\WinTouch\wintouch.cfg
    C:\Documents and Settings\Prashant Bisht\Application Data\WinTouch\WinTouch.exe
    C:\Documents and Settings\Prashant Bisht\Application Data\WinTouch\WTUninstaller.exe
    C:\Program Files\Drmupgds
    C:\Program Files\Intel\baqy.html
    C:\Program Files\ISM2
    C:\Program Files\ISM2\adhydraupd.exe
    C:\Program Files\Router
    C:\Program Files\Temporary
    C:\Program Files\Temporary\InsiDERInst.exe
    C:\WINDOWS\BM278f5831.xml
    C:\WINDOWS\cookies.ini
    C:\WINDOWS\pskt.ini
    C:\WINDOWS\system32\ajioqtoh.dll
    C:\WINDOWS\system32\avmecsse.ini
    C:\WINDOWS\system32\bdegojbb.dll
    C:\WINDOWS\system32\bdpchyqa.dll
    C:\WINDOWS\system32\begcfups.dll
    C:\WINDOWS\system32\belaqcmo.dll
    C:\WINDOWS\system32\bfuafsho.ini
    C:\WINDOWS\system32\biessyrp.dll
    C:\WINDOWS\system32\bjjskdjr.ini
    C:\WINDOWS\system32\bwhyyciv.ini
    C:\WINDOWS\system32\csyumjwa.ini
    C:\WINDOWS\system32\cwowqjxa.ini
    C:\WINDOWS\system32\cybrifgy.dll
    C:\WINDOWS\system32\dbgxhmqc.ini
    C:\WINDOWS\system32\dirwtlhc.dll
    C:\WINDOWS\system32\dnifwdsc.dll
    C:\WINDOWS\system32\doujmsnr.dll
    C:\WINDOWS\system32\drrboqqb.ini
    C:\WINDOWS\system32\drtyiuuo.ini
    C:\WINDOWS\system32\dvbvtpqx.dll
    C:\WINDOWS\system32\edadctki.dll
    C:\WINDOWS\system32\edkxccks.dll
    C:\WINDOWS\system32\esscemva.dll
    C:\WINDOWS\system32\euuwdrdg.dll
    C:\WINDOWS\system32\fborylyp.dll
    C:\WINDOWS\system32\fjbsbggq.ini
    C:\WINDOWS\system32\frwrudhq.dll
    C:\WINDOWS\system32\fvjxnugl.ini
    C:\WINDOWS\system32\fwefrytk.ini
    C:\WINDOWS\system32\gcqcfdjp.dll
    C:\WINDOWS\system32\gcqsuljb.dll
    C:\WINDOWS\system32\gftcryty.dll
    C:\WINDOWS\system32\ghhrsnsa.ini
    C:\WINDOWS\system32\gjqpkmvv.dll
    C:\WINDOWS\system32\goxrgomo.dll
    C:\WINDOWS\system32\gwbjqplp.ini
    C:\WINDOWS\system32\hcmhuofj.dll
    C:\WINDOWS\system32\hfltkkxu.ini
    C:\WINDOWS\system32\hgufaefy.ini
    C:\WINDOWS\system32\hhqebayv.dll
    C:\WINDOWS\system32\hjrmdqtk.dll
    C:\WINDOWS\system32\hlawyntn.dll
    C:\WINDOWS\system32\hrtustmp.ini
    C:\WINDOWS\system32\hvrhpukx.ini
    C:\WINDOWS\system32\ijndpweo.dll
    C:\WINDOWS\system32\iosjdpdj.ini
    C:\WINDOWS\system32\isqfvada.ini
    C:\WINDOWS\system32\iubweldw.dll
    C:\WINDOWS\system32\iuxovvpq.dll
    C:\WINDOWS\system32\jawptpeo.dll
    C:\WINDOWS\system32\jbfvepor.dll
    C:\WINDOWS\system32\jelgtalo.dll
    C:\WINDOWS\system32\jiujryou.dll
    C:\WINDOWS\system32\jmcuwpup.ini
    C:\WINDOWS\system32\jngedjhq.dll
    C:\WINDOWS\system32\jngsblol.dll
    C:\WINDOWS\system32\jnkdktvu.ini
    C:\WINDOWS\system32\jtgjacwj.dll
    C:\WINDOWS\system32\juehpxob.dll
    C:\WINDOWS\system32\jwlowylh.dll
    C:\WINDOWS\system32\kagxojno.dll
    C:\WINDOWS\system32\khhrjete.ini
    C:\WINDOWS\system32\kjytlapm.dll
    C:\WINDOWS\system32\kklgmnjy.dll
    C:\WINDOWS\system32\kkpnqagi.ini
    C:\WINDOWS\system32\kleuljga.ini
    C:\WINDOWS\system32\kqfusnmx.ini
    C:\WINDOWS\system32\krqpsxqs.dll
    C:\WINDOWS\system32\lbccciyo.dll
    C:\WINDOWS\system32\lcplywht.dll
    C:\WINDOWS\system32\ligapdbr.ini
    C:\WINDOWS\system32\lqcfkbua.dll
    C:\WINDOWS\system32\lscwhusa.dll
    C:\WINDOWS\system32\luwhhysw.ini
    C:\WINDOWS\system32\methoaay.ini
    C:\WINDOWS\system32\mgajdlsc.dll
    C:\WINDOWS\system32\mjdvfelk.dll
    C:\WINDOWS\system32\mmrwedhh.dll
    C:\WINDOWS\system32\mmxliiuv.ini
    C:\WINDOWS\system32\mpelsuap.dll
    C:\WINDOWS\system32\mpwpsnhy.ini
    C:\WINDOWS\system32\mualjnjy.ini
    C:\WINDOWS\system32\nhguxhew.dll
    C:\WINDOWS\system32\nhmpohgf.dll
    C:\WINDOWS\system32\ntkrfwdt.ini
    C:\WINDOWS\system32\ntnywalh.ini
    C:\WINDOWS\system32\ntpvywvh.dll
    C:\WINDOWS\system32\onlhbusm.ini
    C:\WINDOWS\system32\oqbcryll.dll
    C:\WINDOWS\system32\ouuiytrd.dll
    C:\WINDOWS\system32\ovvnattv.dll
    C:\WINDOWS\system32\oxcrmoxb.dll
    C:\WINDOWS\system32\oyxxcrjv.ini
    C:\WINDOWS\system32\pdhdkkuu.ini
    C:\WINDOWS\system32\pjhmtxxe.ini
    C:\WINDOWS\system32\plpqjbwg.dll
    C:\WINDOWS\system32\ponoeylw.ini
    C:\WINDOWS\system32\prysseib.ini
    C:\WINDOWS\system32\psyixfoe.dll
    C:\WINDOWS\system32\pxymwbyk.dll
    C:\WINDOWS\system32\pylyrobf.ini
    C:\WINDOWS\system32\qggbsbjf.dll
    C:\WINDOWS\system32\qgsvvooc.dll
    C:\WINDOWS\system32\qkksnttn.dll
    C:\WINDOWS\system32\qmryffnq.dll
    C:\WINDOWS\system32\qnbagvys.dll
    C:\WINDOWS\system32\qrccnxji.dll
    C:\WINDOWS\system32\qtyacpff.dll
    C:\WINDOWS\system32\qxqwcqil.dll
    C:\WINDOWS\system32\rdttqusy.ini
    C:\WINDOWS\system32\rljnlrqu.dll
    C:\WINDOWS\system32\rrbnojky.ini
    C:\WINDOWS\system32\rrbwlysi.dll
    C:\WINDOWS\system32\rswkmcqa.dll
    C:\WINDOWS\system32\scutxjhc.dll
    C:\WINDOWS\system32\sfjtfeuc.dll
    C:\WINDOWS\system32\silkqesx.dll
    C:\WINDOWS\system32\spsichqy.ini
    C:\WINDOWS\system32\ssknostk.ini
    C:\WINDOWS\system32\swukanpw.dll
    C:\WINDOWS\system32\tasaqwig.dll
    C:\WINDOWS\system32\thedofic.dll
    C:\WINDOWS\system32\twuvkseg.dll
    C:\WINDOWS\system32\ublxfgal.dll
    C:\WINDOWS\system32\ubnulpon.dll
    C:\WINDOWS\system32\ucvuvfvr.ini
    C:\WINDOWS\system32\uftcefcc.ini
    C:\WINDOWS\system32\uhdmqlkj.ini
    C:\WINDOWS\system32\uklfldlm.dll
    C:\WINDOWS\system32\ullotbqm.ini
    C:\WINDOWS\system32\umdsoqgd.ini
    C:\WINDOWS\system32\unujvtni.dll
    C:\WINDOWS\system32\uphukajy.ini
    C:\WINDOWS\system32\uqnrpssw.dll
    C:\WINDOWS\system32\urfroqvb.dll
    C:\WINDOWS\system32\utquwabi.dll
    C:\WINDOWS\system32\uttss.bak1
    C:\WINDOWS\system32\uttss.bak2
    C:\WINDOWS\system32\uttss.ini
    C:\WINDOWS\system32\uttss.ini2
    C:\WINDOWS\system32\uttss.tmp
    C:\WINDOWS\system32\uukkdhdp.dll
    C:\WINDOWS\system32\uxkeohpb.dll
    C:\WINDOWS\system32\vihxadfk.ini
    C:\WINDOWS\system32\vivoftfn.ini
    C:\WINDOWS\system32\voplyggg.ini
    C:\WINDOWS\system32\voypkouh.ini
    C:\WINDOWS\system32\vteypmay.dll
    C:\WINDOWS\system32\wavgiqnu.dll
    C:\WINDOWS\system32\wjvjetvg.ini
    C:\WINDOWS\system32\wlyeonop.dll
    C:\WINDOWS\system32\wmxaacqw.dll
    C:\WINDOWS\system32\wniyjnvb.ini
    C:\WINDOWS\system32\wrmcmqga.dll
    C:\WINDOWS\system32\wtyexxed.dll
    C:\WINDOWS\system32\wyanqgwm.ini
    C:\WINDOWS\system32\xcsepvdp.ini
    C:\WINDOWS\system32\xmryjxpq.dll
    C:\WINDOWS\system32\xobkhatr.ini
    C:\WINDOWS\system32\xtcdtinp.dll
    C:\WINDOWS\system32\xutyjvhh.dll
    C:\WINDOWS\system32\xxevdcxm.dll
    C:\WINDOWS\system32\xygwwofw.dll
    C:\WINDOWS\system32\yaskqifc.ini
    C:\WINDOWS\system32\ycwmilnv.dll
    C:\WINDOWS\system32\ygghkbed.ini
    C:\WINDOWS\system32\yrhqqurl.dll
    D:\Autorun.inf

    ----- BITS: Possible infected sites -----

    hxxp://nxpagent.airtelbroadband.in
    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\LEGACY_DOMAINSERVICE


    ((((((((((((((((((((((((( Files Created from 2008-02-09 to 2008-03-09 )))))))))))))))))))))))))))))))
    .

    2008-03-07 19:45 . 2008-03-07 19:45 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
    2008-03-07 19:45 . 2008-03-07 19:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
    2008-03-07 17:08 . 2008-03-07 16:40 691,545 --a------ C:\WINDOWS\unins000.exe
    2008-03-07 17:08 . 2008-03-07 17:08 2,559 --a------ C:\WINDOWS\unins000.dat
    2008-03-06 15:53 . 2008-03-07 11:47 1,307,069 --ahs---- C:\WINDOWS\system32\nlrqbsmf.ini
    2008-03-06 13:23 . 2008-03-06 15:52 1,308,414 --ahs---- C:\WINDOWS\system32\cpxgjqyh.ini
    2008-03-06 10:45 . 2008-03-06 10:45 <DIR> d-------- C:\Program Files\Common Files\xing shared
    2008-03-05 23:46 . 2008-03-05 23:46 <DIR> d-------- C:\Program Files\Windows Defender
    2008-03-05 23:31 . 2008-03-05 23:34 1,301,146 --ahs---- C:\WINDOWS\system32\bbmkbdsx.ini
    2008-03-05 00:20 . 2008-03-05 00:20 <DIR> d-------- C:\Program Files\PowerISO
    2008-03-03 20:57 . 2008-03-05 00:07 1,304,193 --ahs---- C:\WINDOWS\system32\nidhlwne.ini
    2008-03-03 19:55 . 2008-03-03 19:55 <DIR> d-------- C:\Program Files\ToniArts
    2008-03-03 09:07 . 2008-03-03 09:07 <DIR> d-------- C:\Documents and Settings\Prashant Bisht\Application Data\Grisoft
    2008-03-03 08:24 . 2008-03-03 08:24 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg(3)
    2008-03-03 08:23 . 2008-03-03 09:07 <DIR> d-------- C:\Program Files\AVG(3)
    2008-03-03 08:23 . 2008-03-03 09:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8(3)
    2008-02-29 21:58 . 2008-02-29 21:58 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg(2)
    2008-02-29 21:57 . 2008-02-29 22:33 <DIR> d-------- C:\Program Files\AVG(2)
    2008-02-29 21:57 . 2008-02-29 22:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8(2)
    2008-02-27 16:19 . 2008-02-27 21:01 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
    2008-02-26 06:10 . 2008-02-26 06:10 <DIR> d-------- C:\Program Files\Trend Micro
    2008-02-26 03:11 . 2008-02-26 03:11 268 --a------ C:\ez_log.htm
    2008-02-25 05:17 . 2008-02-25 05:17 1,253,894 --ahs---- C:\WINDOWS\system32\bjjskdjr.tmp
    2008-02-22 16:57 . 2008-02-22 23:57 <DIR> d-------- C:\Program Files\Common Files\Scanner
    2008-02-18 09:40 . 2008-02-18 09:40 <DIR> d-------- C:\Program Files\Lavasoft
    2008-02-18 09:40 . 2008-02-18 09:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-02-18 09:39 . 2008-02-18 09:39 <DIR> d-------- C:\Program Files\Avanquest update
    2008-02-18 02:17 . 2008-02-18 09:38 <DIR> d----c--- C:\WINDOWS\ie7(2)
    2008-02-15 22:33 . 2008-02-15 22:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2008-02-15 22:33 . 2007-05-30 17:40 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys
    2008-02-15 16:11 . 2008-02-15 16:11 94,272 --a------ C:\WINDOWS\system32\dghoamio.dll
    2008-02-15 12:38 . 2008-02-15 12:38 91,712 --a------ C:\WINDOWS\system32\ykjonbrr.dll
    2008-02-15 12:37 . 2008-02-15 12:37 91,200 --a------ C:\WINDOWS\system32\suamuncj.dll
    2008-02-15 08:07 . 2008-02-15 08:07 91,712 --a------ C:\WINDOWS\system32\huokpyov.dll
    2008-02-15 08:05 . 2008-02-15 08:05 91,200 --a------ C:\WINDOWS\system32\bgdotytc.dll
    2008-02-14 11:25 . 2008-02-14 11:26 98,368 --a------ C:\WINDOWS\system32\vttqdynj.dll
    2008-02-13 22:59 . 2008-02-13 22:59 98,368 --a------ C:\WINDOWS\system32\yjkrfwqv.dll
    2008-02-13 19:43 . 2008-02-13 17:43 51,200 --------- C:\WINDOWS\b153.exe_old
    2008-02-13 12:03 . 2008-02-13 12:03 93,248 --a------ C:\WINDOWS\system32\mwtkrtfp.dll
    2008-02-13 01:02 . 2008-02-13 01:02 93,248 --a------ C:\WINDOWS\system32\xlmnfgcu.dll
    2008-02-12 01:04 . 2008-02-12 01:04 93,248 --a------ C:\WINDOWS\system32\opsiukvi.dll
    2008-02-11 03:03 . 2008-02-11 03:03 93,248 --a------ C:\WINDOWS\system32\akicwaft.dll
  6. 2008-03-09, 21:52 #6
    ginsoakedboy
    ginsoakedboy is offline
    Junior Member
    Join Date
    Mar 2008
    Posts
    8

    Default Combofix log continued..

    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-03-09 20:26 --------- d-----w C:\Program Files\Intel
    2008-03-09 12:22 --------- d-----w C:\Documents and Settings\Prashant Bisht\Application Data\Azureus
    2008-03-08 07:18 --------- d-----w C:\Program Files\Azureus
    2008-03-07 11:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-03-07 10:59 --------- d-----w C:\Program Files\Spybot - Search & Destroy
    2008-03-06 05:14 --------- d-----w C:\Program Files\Common Files\Real
    2008-03-03 14:25 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-03-03 14:22 --------- d-----w C:\Program Files\Common Files\Symantec Shared
    2008-03-03 14:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
    2008-03-03 14:20 --------- d-----w C:\Program Files\Symantec
    2008-02-29 17:20 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2008-02-27 11:19 --------- d-----w C:\Program Files\SopCast
    2008-02-27 10:56 --------- d-----w C:\Program Files\Google
    2008-02-27 10:50 --------- d-----w C:\Program Files\Microsoft ActiveSync
    2008-02-25 13:31 --------- d-----w C:\Documents and Settings\Prashant Bisht\Application Data\BearShare
    2008-02-22 11:26 --------- d-----w C:\Documents and Settings\Prashant Bisht\Application Data\Netscape
    2008-02-15 16:36 --------- d-----w C:\Program Files\Microsoft Money 2005
    2008-02-06 10:10 --------- d-----w C:\Documents and Settings\Prashant Bisht\Application Data\PrevxCSI
    2008-02-06 07:56 --------- d-----w C:\Program Files\Java
    2008-02-06 07:41 --------- d-----w C:\Program Files\SealedMedia
    2008-02-06 06:34 --------- d-----w C:\Documents and Settings\Prashant Bisht\Application Data\TuneUp Software
    2008-02-04 09:20 --------- d-----w C:\Program Files\Common Files\SupportSoft
    2008-02-04 09:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\SupportSoft
    2008-02-04 09:19 --------- d-----w C:\Program Files\Airtel
    2008-01-27 04:37 --------- d-----w C:\Documents and Settings\Prashant Bisht\Application Data\dvdcss
    2008-01-20 07:07 33,292 ----a-w C:\WINDOWS\system32\drivers\scdemu.sys
    2008-01-17 19:04 --------- d-----w C:\Documents and Settings\Prashant Bisht\Application Data\U3
    2008-01-16 19:38 --------- d-----w C:\Documents and Settings\Prashant Bisht\Application Data\DVD Flick
    2008-01-14 15:13 367,616 ----a-w C:\WINDOWS\b149.exe
    2008-01-09 09:46 --------- d-----w C:\Documents and Settings\Prashant Bisht\Application Data\Skype
    2008-01-08 15:15 24,192 ----a-w C:\Documents and Settings\Prashant Bisht\usbsermptxp.sys
    2008-01-08 15:15 22,768 ----a-w C:\Documents and Settings\Prashant Bisht\usbsermpt.sys
    2007-12-04 02:22 72,296 ----a-w C:\Documents and Settings\Prashant Bisht\Application Data\GDIPFONTCACHEV1.DAT
    2007-11-05 18:35 41,724 --sh--w C:\Program Files\Common Files\Yazzle1560OinUninstaller.exe
    2007-10-29 20:21 145,920 --sh--w C:\Program Files\Common Files\Yazzle1560OinAdmin.exe
    2006-12-28 20:38 486 ----a-w C:\Documents and Settings\Prashant Bisht\Application Data\wklnhst.dat
    2006-09-07 11:17 22 --sha-w C:\WINDOWS\SMINST\HPCD.sys
    2007-07-16 22:59 1,160 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{784F0668-80F3-4A17-8897-33ACB97A7184}]
    C:\WINDOWS\system32\ssttu.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{AD64CE0E-AC07-42DF-A21B-DF30A6334476}]
    C:\Program Files\Microsoft Money 2005\savefoku455101.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-05 02:30 15360]
    "swg"="C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2007-03-31 10:38 68856]
    "H/PC Connection Agent"="C:\Program Files\Microsoft ActiveSync\wcescomm.exe" [2006-06-26 16:13 1207080]
    "Yahoo! Pager"="C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" [2007-03-27 15:22 4670968]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "SynTPEnh"="C:\Program Files\Synaptics\SynTP\SynTPEnh.exe" [2006-06-16 16:22 794713]
    "!AVG Anti-Spyware"="C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" [2007-06-11 14:55 6731312]
    "Windows Defender"="C:\Program Files\Windows Defender\MSASCui.exe" [2006-11-03 19:20 866584]
    "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2008-03-06 10:44 185896]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\system]
    "DisableRegistryTools"= 0 (0x0)

    [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
    Source= C:\Program Files\Intel\baqy.html
    FriendlyName=

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Adobe Reader Speed Launch.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Adobe Reader Speed Launch.lnk
    backup=C:\WINDOWS\pss\Adobe Reader Speed Launch.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Bluetooth.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Bluetooth.lnk
    backup=C:\WINDOWS\pss\Bluetooth.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Google Updater.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Google Updater.lnk
    backup=C:\WINDOWS\pss\Google Updater.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Pavilion Webcam Tray Icon.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Pavilion Webcam Tray Icon.lnk
    backup=C:\WINDOWS\pss\HP Pavilion Webcam Tray Icon.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^HP Photosmart Premier Fast Start.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\HP Photosmart Premier Fast Start.lnk
    backup=C:\WINDOWS\pss\HP Photosmart Premier Fast Start.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Kodak EasyShare software.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Kodak EasyShare software.lnk
    backup=C:\WINDOWS\pss\Kodak EasyShare software.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^KODAK Software Updater.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\KODAK Software Updater.lnk
    backup=C:\WINDOWS\pss\KODAK Software Updater.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech Desktop Messenger.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech Desktop Messenger.lnk
    backup=C:\WINDOWS\pss\Logitech Desktop Messenger.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Logitech SetPoint.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Logitech SetPoint.lnk
    backup=C:\WINDOWS\pss\Logitech SetPoint.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^Microsoft Office.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\Microsoft Office.lnk
    backup=C:\WINDOWS\pss\Microsoft Office.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^TabUserW.exe.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\TabUserW.exe.lnk
    backup=C:\WINDOWS\pss\TabUserW.exe.lnkCommon Startup

    [HKLM\~\startupfolder\C:^Documents and Settings^All Users^Start Menu^Programs^Startup^WinZip Quick Pick.lnk]
    path=C:\Documents and Settings\All Users\Start Menu\Programs\Startup\WinZip Quick Pick.lnk
    backup=C:\WINDOWS\pss\WinZip Quick Pick.lnkCommon Startup

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\!AVG Anti-Spyware]
    --a------ 2007-06-11 14:55 6731312 C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\24bc6bad]
    C:\WINDOWS\system32\biessyrp.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\A3A9ACA8AFAEAAAC]


    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
    --a------ 2007-03-09 11:09 63712 C:\Program Files\Adobe\Photoshop Album Starter Edition\3.2\Apps\apdproxy.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
    --a------ 2007-10-10 19:51 39792 C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BM278f5831]
    C:\WINDOWS\system32\mjdvfelk.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ccApp]
    c:\Program Files\Common Files\Symantec Shared\ccApp.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cpqset]
    --a------ 2006-01-26 13:48 40960 C:\Program Files\HPQ\Default Settings\cpqset.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\ctfmon.exe]
    --a------ 2004-08-05 02:30 15360 C:\WINDOWS\system32\ctfmon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DataLayer]
    --a------ 2004-09-23 10:33 1019392 C:\PROGRA~1\COMMON~1\PCSuite\DATALA~1\DATALA~1.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dot1XCfg]
    C:\Program Files\Dot1XCfg\Dot1XCfg.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Drmupgds]
    C:\Program Files\Drmupgds\Drmupgds.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\googletalk]
    C:\Program Files\Google\Google Talk\googletalk.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\H/PC Connection Agent]
    --a------ 2006-06-26 16:13 1207080 C:\Program Files\Microsoft ActiveSync\wcescomm.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\High Definition Audio Property Page Shortcut]
    --a------ 2006-04-18 01:59 61952 C:\WINDOWS\system32\CHDAudPropShortcut.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HotKeysCmds]
    --a------ 2006-08-14 14:41 114688 C:\WINDOWS\system32\hkcmd.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HP Software Update]
    --a------ 2005-02-16 23:11 49152 C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\hpWirelessAssistant]
    --a------ 2006-08-12 07:25 380928 C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IgfxTray]
    --a------ 2006-08-14 14:39 98304 C:\WINDOWS\system32\igfxtray.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMEKRMIG6.1]
    --a------ 2004-08-04 18:30 44032 C:\WINDOWS\ime\imkr6_1\IMEKRMIG.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
    --a------ 2004-08-04 18:30 208952 C:\WINDOWS\IME\imjp8_1\IMJPMIG.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Insider]
    C:\Program Files\Insider\Insider.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\iTunesHelper]
    --a------ 2007-07-31 18:44 271672 C:\Program Files\iTunes\iTunesHelper.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Kernel and Hardware Abstraction Layer]
    --a------ 2007-01-23 15:44 101136 C:\WINDOWS\KHALMNPR.Exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\LDM]
    --a------ 2007-02-20 10:48 67128 C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LogitechDesktopMessenger.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Logitech Hardware Abstraction Layer]
    --a------ 2007-01-23 15:44 101136 C:\WINDOWS\KHALMNPR.Exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\MSPY2002]
    --a------ 2004-08-04 18:30 59392 C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NeroFilterCheck]
    --a------ 2001-07-09 10:50 155648 C:\WINDOWS\system32\NeroCheck.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nxpclient]
    --a------ 2007-11-26 16:22 202016 C:\Program Files\Airtel\NetXpert\bin\sprtcmd.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PCSuiteTrayApplication]
    --a------ 2004-09-15 15:36 148992 C:\PROGRA~1\Nokia\NOKIAP~1\TRAYAP~1.EXE

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Persistence]
    --a------ 2006-08-14 14:38 94208 C:\WINDOWS\system32\igfxpers.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
    --a------ 2004-08-04 18:30 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
    --a------ 2004-08-04 18:30 455168 C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QdrPack9]
    C:\Program Files\QdrPack\QdrPack9.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QlbCtrl]
    --a------ 2006-06-19 11:33 163840 C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QPService]
    --a------ 2006-04-11 19:24 102400 C:\Program Files\HP\QuickPlay\QPService.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
    --a------ 2007-06-29 06:24 286720 C:\Program Files\QuickTime\qttask.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RecGuard]
    --------- 2005-10-11 07:53 1187840 C:\Windows\SMINST\RecGuard.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Router]
    C:\Program Files\Router\Router.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sadyty]
    C:\Program Files\Symantec\sadyty77798.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sealmon]
    C:\Program Files\SealedMedia\sealmon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SfKg6w]
    C:\Documents and Settings\Prashant Bisht\Application Data\Microsoft\Windows\kyqeihy.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
    -ra------ 2007-08-23 00:19 23120680 C:\Program Files\Skype\Phone\Skype.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SunJavaUpdateSched]
    --a------ 2007-09-25 01:11 132496 C:\Program Files\Java\jre1.6.0_03\bin\jusched.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
    --a------ 2007-03-31 10:38 68856 C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TkBellExe]
    --a------ 2008-03-06 10:44 185896 C:\Program Files\Common Files\Real\Update_OB\realsched.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\updateMgr]
    C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinAble]
    C:\Program Files\WinAble\winable.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinTouch]
    C:\Documents and Settings\Prashant Bisht\Application Data\WinTouch\WinTouch.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\xInsIDE]
    C:\Program Files\xInsIDE\xInsIDE.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\XLMonitor]
    C:\Program Files\Perfect Information\Perfect Analysis\XLMon.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Yahoo! Pager]
    --a------ 2007-03-27 15:22 4670968 C:\PROGRA~1\Yahoo!\MESSEN~1\YAHOOM~1.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\security center]
    "AntiVirusDisableNotify"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\Yahoo!\\Messenger\\YahooMessenger.exe"=
    "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "C:\Program Files\Microsoft ActiveSync\rapimgr.exe"= C:\Program Files\Microsoft ActiveSync\rapimgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync RAPI Manager
    "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"= C:\Program Files\Microsoft ActiveSync\wcescomm.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Connection Manager
    "C:\Program Files\Microsoft ActiveSync\WCESMgr.exe"= C:\Program Files\Microsoft ActiveSync\WCESMgr.exe:169.254.2.0/255.255.255.0:Enabled:ActiveSync Application
    "C:\\Program Files\\Logitech\\Desktop Messenger\\8876480\\Program\\LogitechDesktopMessenger.exe"=
    "C:\\Program Files\\iTunes\\iTunes.exe"=
    "C:\\Program Files\\Kodak\\Kodak EasyShare software\\bin\\EasyShare.exe"=
    "C:\\Program Files\\Skype\\Phone\\Skype.exe"=
    "C:\\Program Files\\Azureus\\Azureus.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "26675:TCP"= 26675:TCP:169.254.2.0/255.255.255.0:Enabled:ActiveSync Service
    "3283:UDP"= 3283:UDP:Windows Media Format SDK (iexplore.exe)
    "3282:UDP"= 3282:UDP:Windows Media Format SDK (iexplore.exe)

    R2 LBeepKE;LBeepKE;C:\WINDOWS\system32\Drivers\LBeepKE.sys [2006-06-30 00:53]
    R2 sprtsvc_nxpclient;SupportSoft Sprocket Service (nxpclient);C:\Program Files\Airtel\NetXpert\bin\sprtsvc.exe [2007-11-26 16:22]
    S3 SupportSoft RemoteAssist;SupportSoft RemoteAssist;C:\Program Files\Common Files\SupportSoft\bin\ssrc.exe [2007-11-01 15:20]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
    \Shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL Info.exe protect.ed 480 480

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{acb73d84-ad09-11db-a041-0016d309d3c8}]
    \Shell\AutoRun\command - H:\LaunchU3.exe

    .
    Contents of the 'Scheduled Tasks' folder
    "2008-03-09 20:32:45 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
    - C:\Program Files\Windows Defender\MpCmdRun.exe
    .
    **************************************************************************
  7. 2008-03-09, 21:56 #7
    ginsoakedboy
    ginsoakedboy is offline
    Junior Member
    Join Date
    Mar 2008
    Posts
    8

    Default combofix log continued 2

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-03-10 02:00:53
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************

    The log was too big so has been broken up. Pls let me know if you require anything else.

    cheers!!
    ------------------------ Other Running Processes ------------------------
    .
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
    C:\PROGRA~1\MI3AA1~1\rapimgr.exe
    C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
    C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    **************************************************************************
    Completion time: 2008-03-10 2:05:54 - machine was rebooted
    ComboFix-quarantined-files.txt 2008-03-09 20:35:50
    .
    2008-03-07 06:20:48 --- E O F ---
  8. 2008-03-11, 14:53 #8
    Markka
    Markka is offline
    Guest
    Join Date
    Jul 2007
    Location
    Finland
    Posts
    260

    Default

    Hello

    Disable Windows Defender:

    We need to disable your Windows Defender Real-time Protection as it may interfere with the fixes that we need to make.

    Open Windows Defender.
    Click on Tools, General Settings.
    Scroll down and uncheck Turn on real-time protection (recommended).
    After you uncheck this, click on the Save button and close Windows Defender.

    After all of the fixes are complete it is very important that you enable Real-time Protection again.
    _____________________

    Open HijackThis, Click Do a system scan only, checkmark these. Then close all other windows except HijackThis and press fix checked.

    O2 - BHO: (no name) - {784F0668-80F3-4A17-8897-33ACB97A7184} - C:\WINDOWS\system32\ssttu.dll (file missing)
    O2 - BHO: (no name) - {AD64CE0E-AC07-42DF-A21B-DF30A6334476} - C:\Program Files\Microsoft Money 2005\savefoku455101.dll (file missing)
    O24 - Desktop Component 0: (no name) - C:\Program Files\Intel\baqy.html
    ____________________

    Open notepad and copy/paste the text in the quotebox below into it:

    File::
    C:\WINDOWS\system32\nlrqbsmf.ini
    C:\WINDOWS\system32\cpxgjqyh.ini
    C:\WINDOWS\system32\bbmkbdsx.ini
    C:\WINDOWS\system32\nidhlwne.ini
    C:\WINDOWS\system32\bjjskdjr.tmp
    C:\WINDOWS\system32\dghoamio.dll
    C:\WINDOWS\system32\ykjonbrr.dll
    C:\WINDOWS\system32\suamuncj.dll
    C:\WINDOWS\system32\huokpyov.dll
    C:\WINDOWS\system32\bgdotytc.dll
    C:\WINDOWS\system32\vttqdynj.dll
    C:\WINDOWS\system32\yjkrfwqv.dll
    C:\WINDOWS\b153.exe_old
    C:\WINDOWS\system32\mwtkrtfp.dll
    C:\WINDOWS\system32\xlmnfgcu.dll
    C:\WINDOWS\system32\opsiukvi.dll
    C:\WINDOWS\system32\akicwaft.dll
    C:\Program Files\Symantec\sadyty77798.exe
    C:\Documents and Settings\Prashant Bisht\Application Data\Microsoft\Windows\kyqeihy.exe

    Folder::
    C:\Program Files\Dot1XCfg
    C:\Program Files\Drmupgds
    C:\Program Files\Insider
    C:\Program Files\QdrPack
    C:\Program Files\Router
    C:\Program Files\WinAble
    C:\Documents and Settings\Prashant Bisht\Application Data\WinTouch
    C:\Program Files\Perfect Information

    Registry::
    [-HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
    [HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
    "Source"="About:Home"
    "SubscribedURL"="About:Home"
    "FriendlyName"="My Current Home Page"
    "Flags"=dword:00000002
    [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\24bc6bad]
    [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\A3A9ACA8AFAEAAAC]
    [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BM278f5831]
    [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dot1XCfg]
    [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Drmupgds]
    [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Insider]
    [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QdrPack9]
    [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Router]
    [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinAble]
    [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinTouch]
    [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\XLMonitor]
    [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\sadyty]
    [-HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\SfKg6w]
    [-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\D]
    Save this as CFScript.txt

    Then drag the CFScript.txt into ComboFix.exe as you see in the screenshot below.



    This will start ComboFix again. After reboot, (in case it asks to reboot).
    __________________

    Post:
    - A fresh HijackThis log
    - Logfile of ComboFix
  9. 2008-03-14, 12:45 #9
    ginsoakedboy
    ginsoakedboy is offline
    Junior Member
    Join Date
    Mar 2008
    Posts
    8

    Default Fresh HijackThis Log

    Hi Marrka,

    Thanks for your instructions...
    below is the the HijackThis log

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 5:08:20 PM, on 3/14/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    C:\Program Files\Airtel\NetXpert\bin\sprtsvc.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
    C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    C:\Program Files\Microsoft ActiveSync\wcescomm.exe
    C:\PROGRA~1\MI3AA1~1\rapimgr.exe
    C:\Program Files\Yahoo!\Messenger\ymsgr_tray.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe
    C:\WINDOWS\system32\wuauclt.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.co.uk/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://us.rd.yahoo.com/customize/ie/...ch/search.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://us.rd.yahoo.com/customize/ie/.../www.yahoo.com
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Local Page =
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: RealPlayer Download and Record Plugin for Internet Explorer - {3049C3E9-B461-4BC5-8870-4C09146192CA} - C:\Program Files\Real\RealPlayer\rpbrowserrecordplugin.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\2.1.615.5858\swg.dll
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn0\yt.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [!AVG Anti-Spyware] "C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\avgas.exe" /minimized
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [swg] C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
    O4 - HKCU\..\Run: [H/PC Connection Agent] "C:\Program Files\Microsoft ActiveSync\wcescomm.exe"
    O4 - HKCU\..\Run: [Yahoo! Pager] "C:\Program Files\Yahoo!\Messenger\YahooMessenger.exe" -quiet
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_03\bin\ssv.dll
    O9 - Extra button: Create Mobile Favorite - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
    O9 - Extra button: (no name) - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
    O9 - Extra 'Tools' menuitem: Create Mobile Favorite... - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\PROGRA~1\MI3AA1~1\INetRepl.dll
    O9 - Extra button: Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\Program Files\Yahoo!\Common\yiesrvc.dll
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_SG&c=Q306&bd=pavilion&pf=laptop
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
    O16 - DPF: {14C1B87C-3342-445F-9B5E-365FF330A3AC} (Hewlett-Packard Online Support Services) - http://h20278.www2.hp.com/HPISWeb/Cu...ataManager.CAB
    O16 - DPF: {193C772A-87BE-4B19-A7BB-445B226FE9A1} (ewidoOnlineScan Control) - http://downloads.ewido.net/ewidoOnlineScan.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (YInstStarter Class) - C:\Program Files\Yahoo!\Common\yinsthelper.dll
    O16 - DPF: {8714912E-380D-11D5-B8AA-00D0B78F3D48} (Yahoo! Webcam Upload Wrapper) - http://chat.yahoo.com/cab/yuplapp.cab
    O16 - DPF: {AB86CE53-AC9F-449F-9399-D8ABCA09EC09} (Get_ActiveX Control) - https://h17000.www1.hp.com/ewfrf-JAV...oadManager.ocx
    O16 - DPF: {D8089245-3211-40F6-819B-9E5E92CD61A2} (FlashXControl Object) - https://flashcasino.ladbrokes.com/in...en/FlashAX.cab
    O17 - HKLM\System\CCS\Services\Tcpip\..\{2342FB3A-0E36-4B49-A28C-9432A9195AC9}: NameServer = 202.56.215.55,202.56.215.54
    O18 - Protocol: bwfile-8876480 - {9462A756-7B47-47BC-8C80-C34B9B80B32B} - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\GAPlugProtocol-8876480.dll
    O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft AB - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Automatic LiveUpdate Scheduler - Symantec Corporation - C:\Program Files\Symantec\LiveUpdate\ALUSchedulerSvc.exe
    O23 - Service: AVG Anti-Spyware Guard - GRISOFT s.r.o. - C:\Program Files\Grisoft\AVG Anti-Spyware 7.5\guard.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe
    O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: SupportSoft Sprocket Service (nxpclient) (sprtsvc_nxpclient) - SupportSoft, Inc. - C:\Program Files\Airtel\NetXpert\bin\sprtsvc.exe
    O23 - Service: SupportSoft RemoteAssist - SupportSoft, Inc. - C:\Program Files\Common Files\SupportSoft\bin\ssrc.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe

    --
    End of file - 9473 bytes
  10. 2008-03-14, 12:49 #10
    ginsoakedboy
    ginsoakedboy is offline
    Junior Member
    Join Date
    Mar 2008
    Posts
    8

    Default ComoFix Log

    ...and here is the Combofix log

    ComboFix 08-03-09.1 - Prashant Bisht 2008-03-14 16:59:28.2 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.188 [GMT 5.5:30]
    Running from: C:\Documents and Settings\Prashant Bisht\Desktop\ComboFix.exe
    Command switches used :: C:\Documents and Settings\Prashant Bisht\Desktop\CFScript.txt
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

    FILE ::
    C:\Documents and Settings\Prashant Bisht\Application Data\Microsoft\Windows\kyqeihy.exe
    C:\Program Files\Symantec\sadyty77798.exe
    C:\WINDOWS\b153.exe_old
    C:\WINDOWS\system32\akicwaft.dll
    C:\WINDOWS\system32\bbmkbdsx.ini
    C:\WINDOWS\system32\bgdotytc.dll
    C:\WINDOWS\system32\bjjskdjr.tmp
    C:\WINDOWS\system32\cpxgjqyh.ini
    C:\WINDOWS\system32\dghoamio.dll
    C:\WINDOWS\system32\huokpyov.dll
    C:\WINDOWS\system32\mwtkrtfp.dll
    C:\WINDOWS\system32\nidhlwne.ini
    C:\WINDOWS\system32\nlrqbsmf.ini
    C:\WINDOWS\system32\opsiukvi.dll
    C:\WINDOWS\system32\suamuncj.dll
    C:\WINDOWS\system32\vttqdynj.dll
    C:\WINDOWS\system32\xlmnfgcu.dll
    C:\WINDOWS\system32\yjkrfwqv.dll
    C:\WINDOWS\system32\ykjonbrr.dll
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Documents and Settings\Prashant Bisht\Favorites\Online Security Guide.lnk
    C:\Program Files\Common Files\Yazzle1560OinAdmin.exe
    C:\Program Files\Common Files\Yazzle1560OinUninstaller.exe
    C:\WINDOWS\b148.exe
    C:\WINDOWS\b149.exe
    C:\WINDOWS\b153.exe_old
    C:\WINDOWS\system32\akicwaft.dll
    C:\WINDOWS\system32\bbmkbdsx.ini
    C:\WINDOWS\system32\bgdotytc.dll
    C:\WINDOWS\system32\bjjskdjr.tmp
    C:\WINDOWS\system32\cpxgjqyh.ini
    C:\WINDOWS\system32\dghoamio.dll
    C:\WINDOWS\system32\huokpyov.dll
    C:\WINDOWS\system32\jzujspvd.dllbox
    C:\WINDOWS\system32\mwtkrtfp.dll
    C:\WINDOWS\system32\nidhlwne.ini
    C:\WINDOWS\system32\nlrqbsmf.ini
    C:\WINDOWS\system32\opsiukvi.dll
    C:\WINDOWS\system32\suamuncj.dll
    C:\WINDOWS\system32\vttqdynj.dll
    C:\WINDOWS\system32\xlmnfgcu.dll
    C:\WINDOWS\system32\yjkrfwqv.dll
    C:\WINDOWS\system32\ykjonbrr.dll
    C:\WINDOWS\system32\zevyjfwc.dllbox

    .
    ((((((((((((((((((((((((( Files Created from 2008-02-14 to 2008-03-14 )))))))))))))))))))))))))))))))
    .

    2008-03-11 15:26 . 2008-03-11 15:25 275,919 --a------ C:\1188744675130.jpg
    2008-03-11 15:26 . 2008-03-11 15:25 120,149 --a------ C:\1188744675182.jpg
    2008-03-10 18:22 . 2008-03-10 18:23 <DIR> d-------- C:\clever stuff
    2008-03-07 19:45 . 2008-03-07 19:45 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
    2008-03-07 19:45 . 2008-03-07 19:45 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
    2008-03-07 17:08 . 2008-03-07 16:40 691,545 --a------ C:\WINDOWS\unins000.exe
    2008-03-07 17:08 . 2008-03-07 17:08 2,559 --a------ C:\WINDOWS\unins000.dat
    2008-03-06 10:45 . 2008-03-06 10:45 <DIR> d-------- C:\Program Files\Common Files\xing shared
    2008-03-05 23:46 . 2008-03-05 23:46 <DIR> d-------- C:\Program Files\Windows Defender
    2008-03-05 00:20 . 2008-03-05 00:20 <DIR> d-------- C:\Program Files\PowerISO
    2008-03-03 19:55 . 2008-03-03 19:55 <DIR> d-------- C:\Program Files\ToniArts
    2008-03-03 09:07 . 2008-03-03 09:07 <DIR> d-------- C:\Documents and Settings\Prashant Bisht\Application Data\Grisoft
    2008-03-03 08:24 . 2008-03-03 08:24 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg(3)
    2008-03-03 08:23 . 2008-03-03 09:07 <DIR> d-------- C:\Program Files\AVG(3)
    2008-03-03 08:23 . 2008-03-03 09:07 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8(3)
    2008-02-29 21:58 . 2008-02-29 21:58 <DIR> d-------- C:\WINDOWS\system32\drivers\Avg(2)
    2008-02-29 21:57 . 2008-02-29 22:33 <DIR> d-------- C:\Program Files\AVG(2)
    2008-02-29 21:57 . 2008-02-29 22:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\avg8(2)
    2008-02-27 16:19 . 2008-02-27 21:01 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
    2008-02-26 06:10 . 2008-02-26 06:10 <DIR> d-------- C:\Program Files\Trend Micro
    2008-02-26 03:11 . 2008-02-26 03:11 268 --a------ C:\ez_log.htm
    2008-02-22 16:57 . 2008-02-22 23:57 <DIR> d-------- C:\Program Files\Common Files\Scanner
    2008-02-18 09:40 . 2008-02-18 09:40 <DIR> d-------- C:\Program Files\Lavasoft
    2008-02-18 09:40 . 2008-02-18 09:40 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-02-18 09:39 . 2008-02-18 09:39 <DIR> d-------- C:\Program Files\Avanquest update
    2008-02-18 02:17 . 2008-02-18 09:38 <DIR> d----c--- C:\WINDOWS\ie7(2)
    2008-02-15 22:33 . 2008-02-15 22:33 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Grisoft
    2008-02-15 22:33 . 2007-05-30 17:40 10,872 --a------ C:\WINDOWS\system32\drivers\AvgAsCln.sys

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-03-09 20:26 --------- d-----w C:\Program Files\Intel
    2008-03-09 12:22 --------- d-----w C:\Documents and Settings\Prashant Bisht\Application Data\Azureus
    2008-03-08 07:18 --------- d-----w C:\Program Files\Azureus
    2008-03-07 11:10 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-03-07 10:59 --------- d-----w C:\Program Files\Spybot - Search & Destroy
    2008-03-06 05:14 499,712 ----a-w C:\WINDOWS\system32\msvcp71.dll
    2008-03-06 05:14 --------- d-----w C:\Program Files\Common Files\Real
    2008-03-03 14:25 --------- d--h--w C:\Program Files\InstallShield Installation Information
    2008-03-03 14:22 --------- d-----w C:\Program Files\Common Files\Symantec Shared
    2008-03-03 14:22 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
    2008-03-03 14:20 --------- d-----w C:\Program Files\Symantec
    2008-02-29 17:20 --------- d-----w C:\Program Files\Common Files\Wise Installation Wizard
    2008-02-27 11:19 --------- d-----w C:\Program Files\SopCast
    2008-02-27 10:56 --------- d-----w C:\Program Files\Google
    2008-02-27 10:50 --------- d-----w C:\Program Files\Microsoft ActiveSync
    2008-02-25 13:31 --------- d-----w C:\Documents and Settings\Prashant Bisht\Application Data\BearShare
    2008-02-22 11:26 --------- d-----w C:\Documents and Settings\Prashant Bisht\Application Data\Netscape
    2008-02-15 16:36 --------- d-----w C:\Program Files\Microsoft Money 2005
    2008-02-08 13:13 68,160 ----a-w C:\WINDOWS\system32\fmiydmfe.dll
    2008-02-07 18:46 95,808 ----a-w C:\WINDOWS\system32\itvpqmjy.dll
    2008-02-06 10:37 94,272 ----a-w C:\WINDOWS\system32\hkvvhvse.dll
    2008-02-06 10:10 --------- d-----w C:\Documents and Settings\Prashant Bisht\Application Data\PrevxCSI
    2008-02-06 09:59 94,272 ----a-w C:\WINDOWS\system32\fsvaktoy.dll
    2008-02-06 09:38 94,272 ----a-w C:\WINDOWS\system32\apmcnrca.dll
    2008-02-06 09:29 94,272 ----a-w C:\WINDOWS\system32\mbnileph.dll
    2008-02-06 07:56 --------- d-----w C:\Program Files\Java
    2008-02-06 07:41 --------- d-----w C:\Program Files\SealedMedia
    2008-02-06 06:34 --------- d-----w C:\Documents and Settings\Prashant Bisht\Application Data\TuneUp Software
    2008-02-04 12:51 93,248 ----a-w C:\WINDOWS\system32\wmaqftea.dll
    2008-02-04 12:51 68,672 ----a-w C:\WINDOWS\system32\yaaknlvt.dll
    2008-02-04 09:20 --------- d-----w C:\Program Files\Common Files\SupportSoft
    2008-02-04 09:20 --------- d-----w C:\Documents and Settings\All Users\Application Data\SupportSoft
    2008-02-04 09:19 --------- d-----w C:\Program Files\Airtel
    2008-01-27 04:37 --------- d-----w C:\Documents and Settings\Prashant Bisht\Application Data\dvdcss
    2008-01-20 07:07 33,292 ----a-w C:\WINDOWS\system32\drivers\scdemu.sys
    2008-01-17 19:04 --------- d-----w C:\Documents and Settings\Prashant Bisht\Application Data\U3
    2008-01-16 19:38 --------- d-----w C:\Documents and Settings\Prashant Bisht\Application Data\DVD Flick
    2008-01-11 05:53 44,544 ----a-w C:\WINDOWS\system32\dllcache\pngfilt.dll
    2008-01-08 15:15 24,192 ----a-w C:\Documents and Settings\Prashant Bisht\usbsermptxp.sys
    2008-01-08 15:15 22,768 ----a-w C:\Documents and Settings\Prashant Bisht\usbsermpt.sys
    2008-01-05 13:13 967,308 --sha-w C:\WINDOWS\system32\lmgrpwks.tmp
    2007-12-19 23:01 347,136 ----a-w C:\WINDOWS\system32\dllcache\dxtmsft.dll
    2007-12-18 09:51 179,584 ------w C:\WINDOWS\system32\dllcache\mrxdav.sys
    2007-12-04 02:22 72,296 ----a-w C:\Documents and Settings\Prashant Bisht\Application Data\GDIPFONTCACHEV1.DAT
    2006-12-28 20:38 486 ----a-w C:\Documents and Settings\Prashant Bisht\Application Data\wklnhst.dat
    2005-09-24 16:49 12,288 ----a-w C:\WINDOWS\Fonts\RandFont.dll
    2006-09-07 11:17 22 --sha-w C:\WINDOWS\SMINST\HPCD.sys
    2007-07-16 22:59 1,160 --sha-w C:\WINDOWS\system32\KGyGaAvL.sys
    .

    ((((((((((((((((((((((((((((( snapshot@2008-03-10_ 2.05.29.53 )))))))))))))))))))))))))))))))))))))))))
    .
    - 2008-02-04 23:09:46 18,214,008 ----a-w C:\WINDOWS\system32\MRT.exe
    + 2008-03-05 16:30:54 19,148,408 ----a-w C:\WINDOWS\system32\MRT.exe
    .
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules