Page 1 of 2 12 LastLast
Results 1 to 10 of 16

Thread: Infection: Virtumonde et al

  1. 2008-03-25, 05:30 #1
    GaelicEarl
    GaelicEarl is offline
    Junior Member
    Join Date
    Mar 2008
    Posts
    22

    Default Infection: Virtumonde et al

    Hey there,

    Due to past problems on another computer, I generally use SPybot, Ad-Aware, and HijackThis for the more stubborn problems, so I've gone through the regular gamut of those in safe mode, but the problem persists.

    Looking through some of the other threads here, it does seem that Virtumonde is the root of my problems, but I suppose we'll see. I've gone through the general instructions, and have a HJT log and a Kaspersky log to paste below.

    Thanks in advance for the help I hope to receive!

    Mike

    -----------------------------------------------
    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:25:04 PM, on 3/24/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\ACS.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
    C:\Program Files\TOSHIBA\Power Management\CePMTray.exe
    C:\Program Files\EzButton\EzButton.EXE
    C:\Program Files\Apoint2K\Apoint.exe
    C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
    C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
    C:\Program Files\ltmoh\Ltmoh.exe
    C:\WINDOWS\AGRSMMSG.exe
    C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
    C:\Program Files\Winamp\winampa.exe
    C:\WINDOWS\system32\Rundll32.exe
    C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
    C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\WINDOWS\system32\RAMASST.exe
    C:\Program Files\Apoint2K\Apntex.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe
    C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
    C:\WINDOWS\System32\DVDRAMSV.exe
    C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
    O4 - HKLM\..\Run: [CeEPOWER] C:\Program Files\TOSHIBA\Power Management\CePMTray.exe
    O4 - HKLM\..\Run: [EzButton] C:\Program Files\EzButton\EzButton.EXE
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
    O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
    O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
    O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [BM931b8bdc] Rundll32.exe "C:\WINDOWS\system32\mgumbgqc.dll",s
    O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [HijackThis startup scan] C:\Documents and Settings\user\My Documents\source\spyware\hijackthis\HijackThis.exe /startupscan
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
    O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
    O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1199559210477
    O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\System32\ACS.exe
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: CeEPwrSvc - COMPAL ELECTRONIC INC. - C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe
    O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
    O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

    --
    End of file - 8170 bytes
  2. 2008-03-25, 05:33 #2
    GaelicEarl
    GaelicEarl is offline
    Junior Member
    Join Date
    Mar 2008
    Posts
    22

    Default Kaspersky followup pt 1

    -------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER REPORT
    Monday, March 24, 2008 9:18:35 PM
    Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
    Kaspersky Online Scanner version: 5.0.98.0
    Kaspersky Anti-Virus database last update: 24/03/2008
    Kaspersky Anti-Virus database records: 660250
    -------------------------------------------------------------------------------

    Scan Settings:
    Scan using the following antivirus database: extended
    Scan Archives: true
    Scan Mail Bases: true

    Scan Target - My Computer:
    C:\
    D:\

    Scan Statistics:
    Total number of scanned objects: 109919
    Number of viruses found: 16
    Number of infected objects: 94
    Number of suspicious objects: 0
    Duration of the scan process: 01:13:15

    Infected Object Name / Virus Name / Last Action
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\u6vm86y2.default\cert8.db Object is locked skipped
    C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\u6vm86y2.default\history.dat Object is locked skipped
    C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\u6vm86y2.default\key3.db Object is locked skipped
    C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\u6vm86y2.default\search.sqlite Object is locked skipped
    C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\u6vm86y2.default\urlclassifier2.sqlite Object is locked skipped
    C:\Documents and Settings\user\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Feeds Cache\index.dat Object is locked skipped
    C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Messenger\hauntedreality@hotmail.com\SharingMetadata\Logs\Dfsr00005.log Object is locked skipped
    C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Messenger\hauntedreality@hotmail.com\SharingMetadata\pending.dat Object is locked skipped
    C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Messenger\hauntedreality@hotmail.com\SharingMetadata\Working\database_1A04_761_9028_B8EF\dfsr.db Object is locked skipped
    C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Messenger\hauntedreality@hotmail.com\SharingMetadata\Working\database_1A04_761_9028_B8EF\fsr.log Object is locked skipped
    C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Messenger\hauntedreality@hotmail.com\SharingMetadata\Working\database_1A04_761_9028_B8EF\fsrtmp.log Object is locked skipped
    C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Messenger\hauntedreality@hotmail.com\SharingMetadata\Working\database_1A04_761_9028_B8EF\tmp.edb Object is locked skipped
    C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Windows Live Contacts\hauntedreality@hotmail.com\real\members.stg Object is locked skipped
    C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Windows Live Contacts\hauntedreality@hotmail.com\shadow\members.stg Object is locked skipped
    C:\Documents and Settings\user\Local Settings\Application Data\Mozilla\Firefox\Profiles\u6vm86y2.default\Cache\_CACHE_001_ Object is locked skipped
    C:\Documents and Settings\user\Local Settings\Application Data\Mozilla\Firefox\Profiles\u6vm86y2.default\Cache\_CACHE_002_ Object is locked skipped
    C:\Documents and Settings\user\Local Settings\Application Data\Mozilla\Firefox\Profiles\u6vm86y2.default\Cache\_CACHE_003_ Object is locked skipped
    C:\Documents and Settings\user\Local Settings\Application Data\Mozilla\Firefox\Profiles\u6vm86y2.default\Cache\_CACHE_MAP_ Object is locked skipped
    C:\Documents and Settings\user\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\user\Local Settings\History\History.IE5\MSHist012008032420080325\index.dat Object is locked skipped
    C:\Documents and Settings\user\Local Settings\Temp\!update.exe Infected: Trojan-Downloader.Win32.PurityScan.fk skipped
    C:\Documents and Settings\user\Local Settings\Temp\aklkuhdq.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\Documents and Settings\user\Local Settings\Temp\obptsiqv.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\Documents and Settings\user\Local Settings\Temp\pjbdqggw.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\Documents and Settings\user\Local Settings\Temp\vqxpqbjd.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\Documents and Settings\user\Local Settings\Temp\vwovtbhm.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\Documents and Settings\user\Local Settings\Temp\winvsnet.exe Infected: not-a-virus:Downloader.Win32.WinFixer.dz skipped
    C:\Documents and Settings\user\Local Settings\Temp\yazzsnet.exe/data0003 Infected: Trojan.Win32.Scapur.k skipped
    C:\Documents and Settings\user\Local Settings\Temp\yazzsnet.exe NSIS: infected - 1 skipped
    C:\Documents and Settings\user\Local Settings\Temp\yoiipyrd.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\Documents and Settings\user\Local Settings\Temp\~DF7F1C.tmp Object is locked skipped
    C:\Documents and Settings\user\Local Settings\Temp\~DF7F49.tmp Object is locked skipped
    C:\Documents and Settings\user\Local Settings\Temp\~DF9D6.tmp Object is locked skipped
    C:\Documents and Settings\user\Local Settings\Temp\~DF9E3.tmp Object is locked skipped
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\2ZRFF81H\css4[1] Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\3X1024JK\iddqd[1] Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\CV6PKH9N\hctp[1] Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\JI4G0GNB\css4[1] Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\KOEKQ1CN\css4[1] Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\ROIP6K4G\css4[1] Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\Documents and Settings\user\My Documents\source\spyware\hijackthis\backups\backup-20080319-140300-102.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\Documents and Settings\user\My Documents\source\spyware\hijackthis\backups\backup-20080319-140300-280.dll Infected: not-a-virus:AdWare.Win32.PurityScan.gv skipped
    C:\Documents and Settings\user\My Documents\source\spyware\hijackthis\backups\backup-20080319-140348-693.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\Documents and Settings\user\My Documents\source\spyware\hijackthis\backups\backup-20080319-162920-573.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\Documents and Settings\user\My Documents\source\spyware\hijackthis\backups\backup-20080319-163031-900.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\Documents and Settings\user\My Documents\source\spyware\hijackthis\backups\backup-20080319-163416-573.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\Documents and Settings\user\My Documents\source\spyware\hijackthis\backups\backup-20080319-191147-953.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\Documents and Settings\user\My Documents\source\spyware\hijackthis\backups\backup-20080320-093649-486.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\Documents and Settings\user\My Documents\source\spyware\hijackthis\backups\backup-20080320-094042-240.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\Documents and Settings\user\My Documents\source\spyware\hijackthis\backups\backup-20080324-003915-663.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\Documents and Settings\user\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\user\ntuser.dat.LOG Object is locked skipped
    C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP57\A0005991.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP57\A0006043.exe Infected: Trojan-Downloader.Win32.Agent.lak skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP61\A0006588.exe Infected: Trojan-Downloader.Win32.Agent.lbx skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP62\A0006594.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP62\A0006595.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP62\A0006608.exe Infected: Trojan-Downloader.Win32.Agent.lbx skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP62\A0006635.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP62\A0006685.dll Infected: not-a-virus:AdWare.Win32.Rabio.h skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006787.dll Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006788.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006789.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006790.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006791.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006792.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006793.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006794.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006795.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006796.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006797.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006798.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006799.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006800.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006801.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006802.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006803.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006804.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006805.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006807.exe Infected: Trojan.Win32.Scapur.k skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006808.exe/data0001 Infected: not-a-virus:AdWare.Win32.PurityScan.gp skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006808.exe NSIS: infected - 1 skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006809.exe Infected: Trojan-Downloader.Win32.Agent.lbx skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006810.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006811.dll Infected: not-a-virus:AdWare.Win32.TTC.d skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006819.dll Infected: not-a-virus:AdWare.Win32.PurityScan.gv skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006849.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006851.dll Infected: not-a-virus:AdWare.Win32.Agent.asj skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006852.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006853.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP65\A0006976.exe Infected: Trojan-Downloader.Win32.Small.buy skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP65\A0007016.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP65\A0007017.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP65\A0007018.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP65\A0007019.dll Infected: not-a-virus:AdWare.Win32.Agent.asj skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP65\A0007138.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP65\A0007139.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP65\A0007140.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP65\A0007141.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP66\A0007155.exe/data0002 Infected: not-a-virus:AdWare.Win32.TTC.d skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP66\A0007155.exe NSIS: infected - 1 skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP66\A0007310.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP66\A0007313.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP66\A0007314.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP66\A0007494.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP66\A0007495.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP67\change.log Object is locked skipped
  3. 2008-03-25, 05:34 #3
    GaelicEarl
    GaelicEarl is offline
    Junior Member
    Join Date
    Mar 2008
    Posts
    22

    Default Kaspersky followup pt 2

    C:\VundoFix Backups\awtss.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\VundoFix Backups\awvvs.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\VundoFix Backups\ddcyvst.dll.bad Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
    C:\WINDOWS\SchedLgU.Txt Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
    C:\WINDOWS\system32\byxyyay.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\default Object is locked skipped
    C:\WINDOWS\system32\config\default.LOG Object is locked skipped
    C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
    C:\WINDOWS\system32\config\SAM Object is locked skipped
    C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
    C:\WINDOWS\system32\config\software Object is locked skipped
    C:\WINDOWS\system32\config\software.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\system Object is locked skipped
    C:\WINDOWS\system32\config\system.LOG Object is locked skipped
    C:\WINDOWS\system32\coxonhxs.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\WINDOWS\system32\ddcyvst.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\WINDOWS\system32\ddwrrmob.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\WINDOWS\system32\geedd.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\WINDOWS\system32\h323log.txt Object is locked skipped
    C:\WINDOWS\system32\iDlo01\iDlo011065.exe Infected: Trojan-Downloader.Win32.VB.caw skipped
    C:\WINDOWS\system32\mgumbgqc.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\WINDOWS\system32\ssqropm.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
    C:\WINDOWS\system32\ylmuksne.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\WINDOWS\system32\Τasks\nοtepad.exe Infected: not-a-virus:AdWare.Win32.PurityScan.gw skipped
    C:\WINDOWS\WindowsUpdate.log Object is locked skipped
    C:\WINDOWS\WіnSxS\attrib.exe Infected: Trojan-Downloader.Win32.PurityScan.fj skipped

    Scan process completed.
  4. 2008-04-01, 06:46 #4
    Blade81
    Blade81 is offline
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hi Mike

    1. Download combofix from any of these links and save it to Desktop:
    Link 1
    Link 2
    Link 3

    **Note: It is important that it is saved directly to your desktop**

    2. Double click combofix.exe & follow the prompts.
    3. When finished, it shall produce a log for you (C:\ComboFix.txt). Post that log in your next reply

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall

    Combofix should never take more that 20 minutes including the reboot if malware is detected.
    If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
    If that happened we want to know, and also what process you had to end.

    If you have problems with Combofix usage, see here
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.
  5. 2008-04-01, 07:36 #5
    GaelicEarl
    GaelicEarl is offline
    Junior Member
    Join Date
    Mar 2008
    Posts
    22

    Default

    Blade81, thanks for the response!

    I ran ComboFix, and it generated the following log:
    ComboFix 08-03-30.5 - user 2008-03-31 22:23:58.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.501 [GMT -7:00]
    Running from: C:\Documents and Settings\user\Desktop\ComboFix.exe
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\Program Files\outerinfo
    C:\Temp\1cb
    C:\Temp\1cb\syscheck.log
    C:\Temp\sanR24
    C:\Temp\sanR24\lDii.log
    C:\WINDOWS\BM931b8bdc.xml
    C:\WINDOWS\pskt.ini
    C:\WINDOWS\system32\accdd.ini
    C:\WINDOWS\system32\accdd.ini2
    C:\WINDOWS\system32\asks~1
    C:\WINDOWS\system32\asks~1\n?tepad.exe
    C:\WINDOWS\system32\bcbeg.ini
    C:\WINDOWS\system32\bcbeg.ini2
    C:\WINDOWS\system32\bomrrwdd.ini
    C:\WINDOWS\system32\byxyyay.dll
    C:\WINDOWS\system32\ckeunpwi.ini
    C:\WINDOWS\system32\coxonhxs.dll
    C:\WINDOWS\system32\cybwirjg.dll
    C:\WINDOWS\system32\ddcyvst.dll
    C:\WINDOWS\system32\ddeeg.ini
    C:\WINDOWS\system32\ddeeg.ini2
    C:\WINDOWS\system32\ddwrrmob.dll
    C:\WINDOWS\system32\dgjlm.ini
    C:\WINDOWS\system32\dgjlm.ini2
    C:\WINDOWS\system32\geedd.dll
    C:\WINDOWS\system32\gelgxdjh.dll
    C:\WINDOWS\system32\ghkmp.ini
    C:\WINDOWS\system32\ghkmp.ini2
    C:\WINDOWS\system32\gjriwbyc.ini
    C:\WINDOWS\system32\hxxvbakr.dll
    C:\WINDOWS\system32\iDlo01
    C:\WINDOWS\system32\iDlo01\iDlo011065.exe
    C:\WINDOWS\system32\iwpnuekc.dll
    C:\WINDOWS\system32\iwwicneg.dll
    C:\WINDOWS\system32\kjkkj.ini
    C:\WINDOWS\system32\kjkkj.ini2
    C:\WINDOWS\system32\llnmp.ini
    C:\WINDOWS\system32\llnmp.ini2
    C:\WINDOWS\system32\mcrh.tmp
    C:\WINDOWS\system32\mgumbgqc.dll
    C:\WINDOWS\system32\moeernmf.dll
    C:\WINDOWS\system32\nvixwtqs.ini
    C:\WINDOWS\system32\ogirgluf.dll
    C:\WINDOWS\system32\okyjifaa.dll
    C:\WINDOWS\system32\onnmp.ini
    C:\WINDOWS\system32\onnmp.ini2
    C:\WINDOWS\system32\pac.txt
    C:\WINDOWS\system32\rtutv.ini
    C:\WINDOWS\system32\rtutv.ini2
    C:\WINDOWS\system32\sqtwxivn.dll
    C:\WINDOWS\system32\ssqropm.dll
    C:\WINDOWS\system32\sttss.ini
    C:\WINDOWS\system32\sttss.ini2
    C:\WINDOWS\system32\sxhnoxoc.ini
    C:\WINDOWS\system32\vdyjekch.dll
    C:\WINDOWS\system32\vrxmiail.dll
    C:\WINDOWS\system32\xknbjkmw.dll
    C:\WINDOWS\system32\xycdd.ini
    C:\WINDOWS\system32\xycdd.ini2
    C:\WINDOWS\system32\ylmuksne.dll
    C:\WINDOWS\wnsxs~1
    C:\WINDOWS\wnsxs~1\attrib.exe
    C:\WINDOWS\wnsxs~1\W?nSxS\

    .
    ((((((((((((((((((((((((( Files Created from 2008-03-01 to 2008-04-01 )))))))))))))))))))))))))))))))
    .

    2008-03-25 16:55 . 2008-03-26 16:55 354 ---hs---- C:\WINDOWS\system32\gbsedfqj.ini
    2008-03-24 19:58 . 2008-03-24 19:58 <DIR> d-------- C:\Program Files\Trend Micro
    2008-03-24 18:08 . 2008-03-24 18:08 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
    2008-03-24 18:08 . 2008-03-24 18:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
    2008-03-24 16:29 . 2008-03-24 16:58 <DIR> d-------- C:\VundoFix Backups
    2008-03-24 09:06 . 2008-03-24 09:06 294 --ahs---- C:\WINDOWS\system32\didvywpe.ini
    2008-03-23 21:42 . 2008-03-24 00:35 294 --ahs---- C:\WINDOWS\system32\necofxpg.ini
    2008-03-20 09:59 . 2008-03-20 09:59 294 --ahs---- C:\WINDOWS\system32\cowuxvwt.ini
    2008-03-19 21:10 . 2008-03-19 21:10 <DIR> d-------- C:\Program Files\Lavasoft
    2008-03-19 21:10 . 2008-03-19 21:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-03-19 20:51 . 2008-03-19 20:51 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
    2008-03-19 20:50 . 2008-03-19 20:50 294 --ahs---- C:\WINDOWS\system32\vxujysve.ini
    2008-03-19 19:15 . 2008-03-19 20:24 294 --ahs---- C:\WINDOWS\system32\hqjeumwt.ini
    2008-03-19 16:41 . 2008-03-19 16:41 294 --ahs---- C:\WINDOWS\system32\lvfkqopg.ini
    2008-03-19 14:11 . 2008-03-19 14:11 294 --ahs---- C:\WINDOWS\system32\aodyancv.ini
    2008-03-19 09:30 . 2008-03-27 11:38 <DIR> d-------- C:\Program Files\SpeedFan
    2008-03-19 09:29 . 2008-03-19 09:30 45 --a------ C:\WINDOWS\system32\initdebug.nfo
    2008-03-18 15:18 . 2008-03-19 11:49 294 --ahs---- C:\WINDOWS\system32\kxtqchhc.ini
    2008-03-17 15:21 . 2008-03-17 15:28 594 --ahs---- C:\WINDOWS\system32\eykvfioe.ini
    2008-03-16 15:48 . 2008-03-19 11:48 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Rabio
    2008-03-16 15:44 . 2008-03-23 22:07 <DIR> d-------- C:\WINDOWS\system32\yp9
    2008-03-16 15:44 . 2008-03-23 22:07 <DIR> d-------- C:\WINDOWS\system32\ps4
    2008-03-16 15:44 . 2008-03-19 23:08 <DIR> d-------- C:\WINDOWS\system32\or2
    2008-03-16 15:44 . 2008-03-31 22:24 <DIR> d-------- C:\Temp
    2008-03-16 14:45 . 2008-03-17 15:15 474 --ahs---- C:\WINDOWS\system32\ylvjfjpw.ini
    2008-03-15 14:39 . 2008-03-16 14:39 354 --ahs---- C:\WINDOWS\system32\xoppdiri.ini
    2008-03-13 23:09 . 2008-03-15 14:37 294 --ahs---- C:\WINDOWS\system32\jkvghcfb.ini
    2008-03-13 22:09 . 2008-03-13 22:09 294 --ahs---- C:\WINDOWS\system32\vkmytusl.ini
    2008-03-12 22:08 . 2008-03-12 22:08 294 --ahs---- C:\WINDOWS\system32\qqjawhed.ini
    2008-03-11 21:05 . 2008-03-11 21:05 294 --ahs---- C:\WINDOWS\system32\tbslpwgt.ini
    2008-03-10 21:39 . 2008-03-10 21:39 <DIR> d-------- C:\Program Files\InterMute
    2008-03-10 18:17 . 2008-03-10 18:07 691,545 --a------ C:\WINDOWS\unins000.exe
    2008-03-10 18:17 . 2008-03-10 18:17 2,540 --a------ C:\WINDOWS\unins000.dat
    2008-03-06 12:25 . 2008-03-06 12:25 <DIR> d-------- C:\WINDOWS\Sun

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-04-01 05:17 --------- d-----w C:\Documents and Settings\user\Application Data\uTorrent
    2008-03-11 02:06 --------- d-----w C:\Program Files\Spybot - Search & Destroy
    2008-03-11 02:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-02-29 07:47 --------- d-----w C:\Documents and Settings\user\Application Data\CopyTransManager
    2008-02-15 22:20 --------- d-----w C:\Documents and Settings\user\Application Data\U3
    2008-02-14 22:49 --------- d-----w C:\Program Files\CDisplay
    2008-02-10 08:49 --------- d-----w C:\Program Files\Common Files\Ahead
    2008-02-10 08:49 --------- d-----w C:\Program Files\Ahead
    2008-02-06 05:48 --------- d-----w C:\Program Files\FLAC
    2008-02-05 22:25 --------- d-----w C:\Documents and Settings\user\Application Data\Winamp
    2008-02-05 22:24 --------- d-----w C:\Program Files\Winamp
    2008-02-01 17:53 --------- d-----w C:\Program Files\uTorrent
    2007-08-09 21:08 8,784 ----a-w C:\Program Files\mozilla firefox\plugins\ractrlkeyhook.dll
    2007-08-09 21:10 245,408 ----a-w C:\Program Files\mozilla firefox\plugins\unicows.dll
    2006-05-03 10:06 163,328 --sha-r C:\WINDOWS\system32\flvDX.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{13e7b564-af87-45e4-822c-c0e81016fb51}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1C2E5D27-A17C-4D89-85DD-3553C189380D}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1C6AAC9B-9C50-4505-98A5-6BE5D11AA8C2}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1FCE7B68-B217-4828-86BB-A49C6382243A}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{29862701-01AE-48AF-B29D-78A529FE4EB3}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{32822054-77A7-4C8E-9E67-FD7DCBB1814B}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3CD6360F-2F54-4FCE-AE97-97A17A220D26}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{40BA3487-BB80-4ED2-A9DE-743E84ACC8FB}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5961EB99-2974-4E72-BD74-D8312F4C66D2}]
    C:\WINDOWS\system32\vtutr.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5B61149A-7AA8-4953-91B1-77BC82635951}]
    C:\WINDOWS\system32\awvvs.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{66F872BE-67E3-43F6-B402-60004092FBCC}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6C3EC9C8-5A00-7FAD-0010-5F00B6C38E9C}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6CC3C597-7580-4452-BC54-2D9F5E3C514F}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{79B2A01A-3936-4BCC-A292-3CCEEC97BF64}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{94F858FB-CBFE-405E-91B8-BE63E7988723}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9979A0CF-0ABE-4E82-911B-05BA1200AB10}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A5A1D31E-39DE-48F1-BA19-600B9A34DE5F}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BA6F4A04-B93B-4C9B-9DB2-FB3C4860380E}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C172A143-D922-4A84-B599-EEF122337290}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C2D455A4-34D4-4E7A-BA63-072AE821B0B2}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D8431E9F-54A5-4D9D-8258-97EBEC301A92}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F1C937A1-BC2C-443B-A8ED-589CD0484181}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FBD29C3C-C642-4843-A627-6E54A947B511}]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2003-09-05 03:24 65536]
    "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2008-01-23 13:00 5724184]
    "HijackThis startup scan"="C:\Documents and Settings\user\My Documents\source\spyware\hijackthis\HijackThis.exe" [ ]
    "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-03 22:56 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-04-21 21:10 335872]
    "CeEKEY"="C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe" [2004-05-06 13:12 638976]
    "CeEPOWER"="C:\Program Files\TOSHIBA\Power Management\CePMTray.exe" [2004-05-20 10:21 135168]
    "EzButton"="C:\Program Files\EzButton\EzButton.EXE" [2004-05-13 19:29 712704]
    "Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2003-10-30 01:46 192512]
    "TPNF"="C:\Program Files\TOSHIBA\TouchPad\TPTray.exe" [2004-03-15 11:17 53248]
    "NDSTray.exe"="NDSTray.exe" []
    "dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-04-21 01:04 118843]
    "PadTouch"="C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe" [2004-02-03 14:47 1089589]
    "LtMoh"="C:\Program Files\ltmoh\Ltmoh.exe" [2003-09-26 15:43 184320]
    "AGRSMMSG"="AGRSMMSG.exe" [2004-02-20 15:00 88363 C:\WINDOWS\agrsmmsg.exe]
    "Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2007-05-10 23:46 624248]
    "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-01-15 15:54 37376]
    "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Microsoft Office OneNote 2003 Quick Launch.lnk - C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2003-08-06 13:23:32 51776]
    RAMASST.lnk - C:\WINDOWS\system32\RAMASST.exe [2004-05-22 14:02:18 155648]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ddcyvst]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
    "BM931b8bdc"=Rundll32.exe "C:\WINDOWS\system32\lqkqxbib.dll",s

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "C:\\Program Files\\Internet Explorer\\iexplore.exe"=
    "C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "C:\\Program Files\\WS_FTP\\WS_FTP95.EXE"=
    "C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "C:\\Program Files\\uTorrent\\utorrent.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

    R1 ECioctl;ECioctl;C:\WINDOWS\system32\Drivers\ECioctl.sys [2004-05-06 13:40]
    S3 UXDCMN;UXDCMN;D:\UXDCMN.SYS []

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{82d3c126-ebea-11dc-a233-000fb03c0cf9}]
    \Shell\AutoRun\command - E:\ntdelect.com
    \Shell\explore\Command - E:\ntdelect.com
    \Shell\open\Command - E:\ntdelect.com

    .
    Contents of the 'Scheduled Tasks' folder
    "2007-12-31 18:55:55 C:\WINDOWS\Tasks\Registration reminder 3.job"
    - C:\WINDOWS\System32\OOBE\oobebaln.exe
    .
    **************************************************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-03-31 22:30:36
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    ------------------------ Other Running Processes ------------------------
    .
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\WINDOWS\System32\ACS.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe
    C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
    C:\WINDOWS\System32\DVDRAMSV.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
    C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    C:\Program Files\Apoint2K\Apntex.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    .
    **************************************************************************
    .
    Completion time: 2008-03-31 22:33:36 - machine was rebooted
    ComboFix-quarantined-files.txt 2008-04-01 05:33:33
    Pre-Run: 12,650,815,488 bytes free
    Post-Run: 12,583,350,272 bytes free
    .
    2008-03-11 23:04:23 --- E O F ---
  6. 2008-04-01, 09:12 #6
    Blade81
    Blade81 is offline
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hi

    Disable Spybot's TeaTimer
    • Run Spybot-S&D in Advanced Mode
    • If it is not already set to do this, go to the Mode menu
      select
      Advanced Mode
    • On the left hand side, click on Tools
    • Then click on the Resident icon in the list
    • Uncheck
      Resident TeaTimer
       and OK any prompts.
    • Restart your computer




    Open notepad and copy/paste the text in the quotebox below into it:

    Code:
    File::
C:\WINDOWS\system32\gbsedfqj.ini
C:\WINDOWS\system32\didvywpe.ini
C:\WINDOWS\system32\necofxpg.ini
C:\WINDOWS\system32\cowuxvwt.ini
C:\WINDOWS\system32\vxujysve.ini
C:\WINDOWS\system32\hqjeumwt.ini
C:\WINDOWS\system32\lvfkqopg.ini
C:\WINDOWS\system32\aodyancv.ini
C:\WINDOWS\system32\kxtqchhc.ini
C:\WINDOWS\system32\eykvfioe.ini
C:\WINDOWS\system32\ylvjfjpw.ini
C:\WINDOWS\system32\xoppdiri.ini
C:\WINDOWS\system32\jkvghcfb.ini
C:\WINDOWS\system32\vkmytusl.ini
C:\WINDOWS\system32\qqjawhed.ini
C:\WINDOWS\system32\tbslpwgt.ini
E:\ntdelect.com

Folder::
C:\VundoFix Backups
C:\Documents and Settings\All Users\Application Data\Rabio
C:\WINDOWS\system32\yp9
C:\WINDOWS\system32\ps4
C:\WINDOWS\system32\or2

Registry::
[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{13e7b564-af87-45e4-822c-c0e81016fb51}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1C2E5D27-A17C-4D89-85DD-3553C189380D}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1C6AAC9B-9C50-4505-98A5-6BE5D11AA8C2}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1FCE7B68-B217-4828-86BB-A49C6382243A}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{29862701-01AE-48AF-B29D-78A529FE4EB3}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{32822054-77A7-4C8E-9E67-FD7DCBB1814B}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3CD6360F-2F54-4FCE-AE97-97A17A220D26}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{40BA3487-BB80-4ED2-A9DE-743E84ACC8FB}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5961EB99-2974-4E72-BD74-D8312F4C66D2}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{5B61149A-7AA8-4953-91B1-77BC82635951}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{66F872BE-67E3-43F6-B402-60004092FBCC}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6C3EC9C8-5A00-7FAD-0010-5F00B6C38E9C}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{6CC3C597-7580-4452-BC54-2D9F5E3C514F}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{79B2A01A-3936-4BCC-A292-3CCEEC97BF64}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{94F858FB-CBFE-405E-91B8-BE63E7988723}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9979A0CF-0ABE-4E82-911B-05BA1200AB10}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A5A1D31E-39DE-48F1-BA19-600B9A34DE5F}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{BA6F4A04-B93B-4C9B-9DB2-FB3C4860380E}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C172A143-D922-4A84-B599-EEF122337290}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{C2D455A4-34D4-4E7A-BA63-072AE821B0B2}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D8431E9F-54A5-4D9D-8258-97EBEC301A92}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F1C937A1-BC2C-443B-A8ED-589CD0484181}]

[-HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FBD29C3C-C642-4843-A627-6E54A947B511}]

[-HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\ddcyvst]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"BM931b8bdc"=-

[-HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{82d3c126-ebea-11dc-a233-000fb03c0cf9}]

    Save this as
    CFScript




    Refering to the picture above, drag CFScript into ComboFix.exe
    Then post the resultant log.


    Combofix should never take more that 20 minutes including the reboot if malware is detected.
    If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
    If that happened we want to know, and also what process you had to end.


    Download ATF (Atribune Temp File) Cleaner© by Atribune to your desktop.

    Double-click ATF Cleaner.exe to open it

    Under Main choose:
    Windows Temp
    Current User Temp
    All Users Temp
    Cookies
    Temporary Internet Files
    Prefetch
    Java Cache
    *The other boxes are optional*
    Then click the Empty Selected button.

    If you use Firefox:
    Click Firefox at the top and choose: Select All
    Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

    If you use Opera:
    Click Opera at the top and choose: Select All
    Click the Empty Selected button.
    NOTE: If you would like to keep your saved passwords, please click NO at the prompt.

    Click Exit on the Main menu to close the program.



    Run Kaspersky online scanner and post back its report & a fresh hjt log (without forgetting ComboFix resultant log).
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.
  7. 2008-04-03, 09:04 #7
    GaelicEarl
    GaelicEarl is offline
    Junior Member
    Join Date
    Mar 2008
    Posts
    22

    Default

    Here goes:

    ComboFix 08-03-30.5 - user 2008-04-02 22:23:29.2 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.565 [GMT -7:00]
    Running from: C:\Documents and Settings\user\Desktop\ComboFix.exe
    Command switches used :: C:\Documents and Settings\user\Desktop\CFScript.txt
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

    FILE ::
    C:\WINDOWS\system32\aodyancv.ini
    C:\WINDOWS\system32\cowuxvwt.ini
    C:\WINDOWS\system32\didvywpe.ini
    C:\WINDOWS\system32\eykvfioe.ini
    C:\WINDOWS\system32\gbsedfqj.ini
    C:\WINDOWS\system32\hqjeumwt.ini
    C:\WINDOWS\system32\jkvghcfb.ini
    C:\WINDOWS\system32\kxtqchhc.ini
    C:\WINDOWS\system32\lvfkqopg.ini
    C:\WINDOWS\system32\necofxpg.ini
    C:\WINDOWS\system32\qqjawhed.ini
    C:\WINDOWS\system32\tbslpwgt.ini
    C:\WINDOWS\system32\vkmytusl.ini
    C:\WINDOWS\system32\vxujysve.ini
    C:\WINDOWS\system32\xoppdiri.ini
    C:\WINDOWS\system32\ylvjfjpw.ini
    E:\ntdelect.com
    .
    TimedOut: progfile.dat

    ((((((((((((((((((((((((( Other Deletions ))))))))))))))))))))))))
    .

    C:\Documents and Settings\All Users\Application Data\Rabio
    C:\VundoFix Backups
    C:\VundoFix Backups\awtss.dll.bad
    C:\VundoFix Backups\awvvs.dll.bad
    C:\VundoFix Backups\ddcyvst.dll.bad
    C:\VundoFix Backups\svvwa.ini.bad
    C:\VundoFix Backups\svvwa.ini2.bad
    C:\VundoFix Backups\tskgvqvj.dll.bad
    C:\WINDOWS\system32\aodyancv.ini
    C:\WINDOWS\system32\cowuxvwt.ini
    C:\WINDOWS\system32\didvywpe.ini
    C:\WINDOWS\system32\eykvfioe.ini
    C:\WINDOWS\system32\gbsedfqj.ini
    C:\WINDOWS\system32\hqjeumwt.ini
    C:\WINDOWS\system32\jkvghcfb.ini
    C:\WINDOWS\system32\kxtqchhc.ini
    C:\WINDOWS\system32\lvfkqopg.ini
    C:\WINDOWS\system32\necofxpg.ini
    C:\WINDOWS\system32\or2
    C:\WINDOWS\system32\ps4
    C:\WINDOWS\system32\qqjawhed.ini
    C:\WINDOWS\system32\tbslpwgt.ini
    C:\WINDOWS\system32\vkmytusl.ini
    C:\WINDOWS\system32\vxujysve.ini
    C:\WINDOWS\system32\xoppdiri.ini
    C:\WINDOWS\system32\ylvjfjpw.ini
    C:\WINDOWS\system32\yp9

    .
    ((((((((((((( Files Created from 2008-03-03 to 2008-04-03 ))))))))))))))))
    .

    2008-03-24 19:58 . 2008-03-24 19:58 <DIR> d-------- C:\Program Files\Trend Micro
    2008-03-24 18:08 . 2008-03-24 18:08 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
    2008-03-24 18:08 . 2008-03-24 18:08 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
    2008-03-19 21:10 . 2008-03-19 21:10 <DIR> d-------- C:\Program Files\Lavasoft
    2008-03-19 21:10 . 2008-03-19 21:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-03-19 20:51 . 2008-03-19 20:51 <DIR> d-------- C:\Program Files\Common Files\Wise Installation Wizard
    2008-03-19 09:30 . 2008-03-27 11:38 <DIR> d-------- C:\Program Files\SpeedFan
    2008-03-19 09:29 . 2008-03-19 09:30 45 --a------ C:\WINDOWS\system32\initdebug.nfo
    2008-03-16 15:44 . 2008-03-31 22:24 <DIR> d-------- C:\Temp
    2008-03-10 21:39 . 2008-03-10 21:39 <DIR> d-------- C:\Program Files\InterMute
    2008-03-10 18:17 . 2008-03-10 18:07 691,545 --a------ C:\WINDOWS\unins000.exe
    2008-03-10 18:17 . 2008-03-10 18:17 2,540 --a------ C:\WINDOWS\unins000.dat
    2008-03-06 12:25 . 2008-03-06 12:25 <DIR> d-------- C:\WINDOWS\Sun

    .
    (((((( ((((((((((((( Find3M Report ))))))))))))))))))
    .
    2008-04-03 05:16 --------- d-----w C:\Documents and Settings\user\Application Data\uTorrent
    2008-03-11 02:06 --------- d-----w C:\Program Files\Spybot - Search & Destroy
    2008-03-11 02:06 --------- d-----w C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-02-29 07:47 --------- d-----w C:\Documents and Settings\user\Application Data\CopyTransManager
    2008-02-15 22:20 --------- d-----w C:\Documents and Settings\user\Application Data\U3
    2008-02-14 22:49 --------- d-----w C:\Program Files\CDisplay
    2008-02-10 08:49 --------- d-----w C:\Program Files\Common Files\Ahead
    2008-02-10 08:49 --------- d-----w C:\Program Files\Ahead
    2008-02-06 05:48 --------- d-----w C:\Program Files\FLAC
    2008-02-05 22:25 --------- d-----w C:\Documents and Settings\user\Application Data\Winamp
    2008-02-05 22:24 --------- d-----w C:\Program Files\Winamp
    2007-08-09 21:08 8,784 ----a-w C:\Program Files\mozilla firefox\plugins\ractrlkeyhook.dll
    2007-08-09 21:10 245,408 ----a-w C:\Program Files\mozilla firefox\plugins\unicows.dll
    2006-05-03 10:06 163,328 --sha-r C:\WINDOWS\system32\flvDX.dll
    .

    (((( ((((((((((( Reg Loading Points )))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "TOSCDSPD"="C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe" [2003-09-05 03:24 65536]
    "MsnMsgr"="C:\Program Files\Windows Live\Messenger\MsnMsgr.exe" [2008-01-23 13:00 5724184]
    "HijackThis startup scan"="C:\Documents and Settings\user\My Documents\source\spyware\hijackthis\HijackThis.exe" [ ]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-04-21 21:10 335872]
    "CeEKEY"="C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe" [2004-05-06 13:12 638976]
    "CeEPOWER"="C:\Program Files\TOSHIBA\Power Management\CePMTray.exe" [2004-05-20 10:21 135168]
    "EzButton"="C:\Program Files\EzButton\EzButton.EXE" [2004-05-13 19:29 712704]
    "Apoint"="C:\Program Files\Apoint2K\Apoint.exe" [2003-10-30 01:46 192512]
    "TPNF"="C:\Program Files\TOSHIBA\TouchPad\TPTray.exe" [2004-03-15 11:17 53248]
    "NDSTray.exe"="NDSTray.exe" []
    "dla"="C:\WINDOWS\system32\dla\tfswctrl.exe" [2004-04-21 01:04 118843]
    "PadTouch"="C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe" [2004-02-03 14:47 1089589]
    "LtMoh"="C:\Program Files\ltmoh\Ltmoh.exe" [2003-09-26 15:43 184320]
    "AGRSMMSG"="AGRSMMSG.exe" [2004-02-20 15:00 88363 C:\WINDOWS\agrsmmsg.exe]
    "Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2007-05-10 23:46 624248]
    "WinampAgent"="C:\Program Files\Winamp\winampa.exe" [2008-01-15 15:54 37376]
    "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 12:50 155648]
    "BM931b8bdc"="C:\WINDOWS\system32\gelgxdjh.dll" [ ]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Microsoft Office OneNote 2003 Quick Launch.lnk - C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE [2003-08-06 13:23:32 51776]
    RAMASST.lnk - C:\WINDOWS\system32\RAMASST.exe [2004-05-22 14:02:18 155648]

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "C:\\Program Files\\Internet Explorer\\iexplore.exe"=
    "C:\\Program Files\\Mozilla Firefox\\firefox.exe"=
    "C:\\Program Files\\Messenger\\msmsgs.exe"=
    "C:\\Program Files\\WS_FTP\\WS_FTP95.EXE"=
    "C:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "C:\\Program Files\\uTorrent\\utorrent.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "3389:TCP"= 3389:TCP:@xpsp2res.dll,-22009

    R1 ECioctl;ECioctl;C:\WINDOWS\system32\Drivers\ECioctl.sys [2004-05-06 13:40]
    S3 UXDCMN;UXDCMN;D:\UXDCMN.SYS []

    .
    Contents of the 'Scheduled Tasks' folder
    "2007-12-31 18:55:55 C:\WINDOWS\Tasks\Registration reminder 3.job"
    - C:\WINDOWS\System32\OOBE\oobebaln.exe
    .
    ***********************************************

    catchme 0.3.1344 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-04-02 22:26:18
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **********************************************
    .
    Completion time: 2008-04-02 22:26:57
    ComboFix-quarantined-files.txt 2008-04-03 05:26:48
    ComboFix2.txt 2008-04-01 05:33:37
    Pre-Run: 12,520,439,808 bytes free
    Post-Run: 12,509,765,632 bytes free
    .
    2008-03-11 23:04:23 --- E O F ---

    -------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER REPORT
    Wednesday, April 02, 2008 11:54:02 PM
    Operating System: Microsoft Windows XP Home Edition, Service Pack 2 (Build 2600)
    Kaspersky Online Scanner version: 5.0.98.0
    Kaspersky Anti-Virus database last update: 3/04/2008
    Kaspersky Anti-Virus database records: 679225
    -------------------------------------------------------------------------------

    Scan Settings:
    Scan using the following antivirus database: extended
    Scan Archives: true
    Scan Mail Bases: true

    Scan Target - My Computer:
    C:\
    D:\

    Scan Statistics:
    Total number of scanned objects: 110903
    Number of viruses found: 15
    Number of infected objects: 114
    Number of suspicious objects: 0
    Duration of the scan process: 01:03:43

    Infected Object Name / Virus Name / Last Action
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr0.dat Object is locked skipped
    C:\Documents and Settings\All Users\Application Data\Microsoft\Network\Downloader\qmgr1.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\LocalService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\LocalService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\NetworkService\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\NetworkService\ntuser.dat.LOG Object is locked skipped
    C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\u6vm86y2.default\cert8.db Object is locked skipped
    C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\u6vm86y2.default\history.dat Object is locked skipped
    C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\u6vm86y2.default\key3.db Object is locked skipped
    C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\u6vm86y2.default\parent.lock Object is locked skipped
    C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\u6vm86y2.default\search.sqlite Object is locked skipped
    C:\Documents and Settings\user\Application Data\Mozilla\Firefox\Profiles\u6vm86y2.default\urlclassifier2.sqlite Object is locked skipped
    C:\Documents and Settings\user\Cookies\index.dat Object is locked skipped
    C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat Object is locked skipped
    C:\Documents and Settings\user\Local Settings\Application Data\Microsoft\Windows\UsrClass.dat.LOG Object is locked skipped
    C:\Documents and Settings\user\Local Settings\Application Data\Mozilla\Firefox\Profiles\u6vm86y2.default\Cache\_CACHE_001_ Object is locked skipped
    C:\Documents and Settings\user\Local Settings\Application Data\Mozilla\Firefox\Profiles\u6vm86y2.default\Cache\_CACHE_002_ Object is locked skipped
    C:\Documents and Settings\user\Local Settings\Application Data\Mozilla\Firefox\Profiles\u6vm86y2.default\Cache\_CACHE_003_ Object is locked skipped
    C:\Documents and Settings\user\Local Settings\Application Data\Mozilla\Firefox\Profiles\u6vm86y2.default\Cache\_CACHE_MAP_ Object is locked skipped
    C:\Documents and Settings\user\Local Settings\History\History.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\AntiPhishing\B3BB5BBA-E7D5-40AB-A041-A5B1C0B26C8F.dat Object is locked skipped
    C:\Documents and Settings\user\Local Settings\Temporary Internet Files\Content.IE5\index.dat Object is locked skipped
    C:\Documents and Settings\user\My Documents\source\spyware\hijackthis\backups\backup-20080319-140300-102.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\Documents and Settings\user\My Documents\source\spyware\hijackthis\backups\backup-20080319-140300-280.dll Infected: not-a-virus:AdWare.Win32.PurityScan.gv skipped
    C:\Documents and Settings\user\My Documents\source\spyware\hijackthis\backups\backup-20080319-140348-693.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\Documents and Settings\user\My Documents\source\spyware\hijackthis\backups\backup-20080319-162920-573.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\Documents and Settings\user\My Documents\source\spyware\hijackthis\backups\backup-20080319-163031-900.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\Documents and Settings\user\My Documents\source\spyware\hijackthis\backups\backup-20080319-163416-573.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\Documents and Settings\user\My Documents\source\spyware\hijackthis\backups\backup-20080319-191147-953.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\Documents and Settings\user\My Documents\source\spyware\hijackthis\backups\backup-20080320-093649-486.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\Documents and Settings\user\My Documents\source\spyware\hijackthis\backups\backup-20080320-094042-240.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\Documents and Settings\user\My Documents\source\spyware\hijackthis\backups\backup-20080324-003915-663.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\Documents and Settings\user\NTUSER.DAT Object is locked skipped
    C:\Documents and Settings\user\ntuser.dat.LOG Object is locked skipped
    C:\QooBox\Quarantine\C\VundoFix Backups\awtss.dll.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\QooBox\Quarantine\C\VundoFix Backups\awvvs.dll.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\QooBox\Quarantine\C\VundoFix Backups\ddcyvst.dll.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\QooBox\Quarantine\C\VundoFix Backups\tskgvqvj.dll.bad.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\ASKS~1\nοtepad.exe.vir Infected: not-a-virus:AdWare.Win32.PurityScan.gw skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\byxyyay.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\coxonhxs.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\ddcyvst.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\ddwrrmob.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\hxxvbakr.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\iDlo01\iDlo011065.exe.vir Infected: Trojan-Downloader.Win32.VB.caw skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\iwpnuekc.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\iwwicneg.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\mgumbgqc.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\moeernmf.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\ogirgluf.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\okyjifaa.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\sqtwxivn.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\ssqropm.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\vdyjekch.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.lua skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\vrxmiail.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\xknbjkmw.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\system32\ylmuksne.dll.vir Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\QooBox\Quarantine\C\WINDOWS\WNSXS~1\attrib.exe.vir Infected: Trojan-Downloader.Win32.PurityScan.fj skipped
    C:\QooBox\Quarantine\catchme2008-03-31_223027.25.zip/Documents and Settings/user/Desktop/catchme.zip/geedd.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\QooBox\Quarantine\catchme2008-03-31_223027.25.zip/Documents and Settings/user/Desktop/catchme.zip Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\QooBox\Quarantine\catchme2008-03-31_223027.25.zip ZIP: infected - 2 skipped
    C:\System Volume Information\MountPointManagerRemoteDatabase Object is locked skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP57\A0005991.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP57\A0006043.exe Infected: Trojan-Downloader.Win32.Agent.lak skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP61\A0006588.exe Infected: Trojan-Downloader.Win32.Agent.lbx skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP62\A0006594.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP62\A0006595.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP62\A0006608.exe Infected: Trojan-Downloader.Win32.Agent.lbx skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP62\A0006635.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP62\A0006685.dll Infected: not-a-virus:AdWare.Win32.Rabio.h skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006787.dll Infected: not-a-virus:AdWare.Win32.ZenoSearch.ad skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006788.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006789.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006790.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006791.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    ...
  8. 2008-04-03, 09:05 #8
    GaelicEarl
    GaelicEarl is offline
    Junior Member
    Join Date
    Mar 2008
    Posts
    22

    Default

    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006792.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006793.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006794.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006795.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006796.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006797.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006798.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006799.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006800.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006801.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006802.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006803.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006804.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006805.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006807.exe Infected: Trojan.Win32.Scapur.k skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006808.exe/data0001 Infected: not-a-virus:AdWare.Win32.PurityScan.gp skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006808.exe NSIS: infected - 1 skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006809.exe Infected: Trojan-Downloader.Win32.Agent.lbx skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006810.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006811.dll Infected: not-a-virus:AdWare.Win32.TTC.d skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006819.dll Infected: not-a-virus:AdWare.Win32.PurityScan.gv skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006849.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006851.dll Infected: not-a-virus:AdWare.Win32.Agent.asj skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006852.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP63\A0006853.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP65\A0006976.exe Infected: Trojan-Downloader.Win32.Small.buy skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP65\A0007016.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP65\A0007017.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP65\A0007018.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP65\A0007019.dll Infected: not-a-virus:AdWare.Win32.Agent.asj skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP65\A0007138.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP65\A0007139.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP65\A0007140.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP65\A0007141.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP66\A0007155.exe/data0002 Infected: not-a-virus:AdWare.Win32.TTC.d skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP66\A0007155.exe NSIS: infected - 1 skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP66\A0007310.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP66\A0007312.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP66\A0007313.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP66\A0007314.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP66\A0007494.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP66\A0007495.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP66\A0007515.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP69\A0007965.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP71\A0008111.exe Infected: Trojan-Downloader.Win32.VB.caw skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP71\A0008112.exe Infected: not-a-virus:AdWare.Win32.PurityScan.gw skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP71\A0008113.exe Infected: Trojan-Downloader.Win32.PurityScan.fj skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP71\A0008115.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP71\A0008116.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP71\A0008118.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP71\A0008119.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP71\A0008121.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP71\A0008122.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP71\A0008123.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP71\A0008125.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP71\A0008126.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP71\A0008127.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP71\A0008128.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP71\A0008129.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP71\A0008130.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP71\A0008131.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.lua skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP71\A0008132.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP71\A0008133.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP71\A0008134.dll Infected: not-a-virus:AdWare.Win32.Virtumonde.gen skipped
    C:\System Volume Information\_restore{2B0240B6-C603-4D0D-A4EC-23F994D18860}\RP73\change.log Object is locked skipped
    C:\WINDOWS\Debug\PASSWD.LOG Object is locked skipped
    C:\WINDOWS\SchedLgU.Txt Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\DataStore\DataStore.edb Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\DataStore\Logs\edb.log Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\DataStore\Logs\tmp.edb Object is locked skipped
    C:\WINDOWS\SoftwareDistribution\ReportingEvents.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\edb.log Object is locked skipped
    C:\WINDOWS\system32\CatRoot2\tmp.edb Object is locked skipped
    C:\WINDOWS\system32\config\AppEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\default Object is locked skipped
    C:\WINDOWS\system32\config\default.LOG Object is locked skipped
    C:\WINDOWS\system32\config\Internet.evt Object is locked skipped
    C:\WINDOWS\system32\config\SAM Object is locked skipped
    C:\WINDOWS\system32\config\SAM.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SecEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY Object is locked skipped
    C:\WINDOWS\system32\config\SECURITY.LOG Object is locked skipped
    C:\WINDOWS\system32\config\software Object is locked skipped
    C:\WINDOWS\system32\config\software.LOG Object is locked skipped
    C:\WINDOWS\system32\config\SysEvent.Evt Object is locked skipped
    C:\WINDOWS\system32\config\system Object is locked skipped
    C:\WINDOWS\system32\config\system.LOG Object is locked skipped
    C:\WINDOWS\system32\h323log.txt Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.BTR Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\INDEX.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING.VER Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING1.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\MAPPING2.MAP Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.DATA Object is locked skipped
    C:\WINDOWS\system32\wbem\Repository\FS\OBJECTS.MAP Object is locked skipped
    C:\WINDOWS\WindowsUpdate.log Object is locked skipped

    Scan process completed.


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 11:57:03 PM, on 4/2/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16608)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\System32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\System32\ACS.exe
    C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
    C:\Program Files\TOSHIBA\Power Management\CePMTray.exe
    C:\Program Files\EzButton\EzButton.EXE
    C:\Program Files\Apoint2K\Apoint.exe
    C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
    C:\Program Files\TOSHIBA\ConfigFree\NDSTray.exe
    C:\WINDOWS\system32\dla\tfswctrl.exe
    C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
    C:\Program Files\ltmoh\Ltmoh.exe
    C:\WINDOWS\AGRSMMSG.exe
    C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
    C:\Program Files\Winamp\winampa.exe
    C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\RAMASST.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe
    C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
    C:\WINDOWS\System32\DVDRAMSV.exe
    C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Apoint2K\Apntex.exe
    C:\Program Files\Windows Live\Messenger\usnsvc.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = http://windowsupdate.microsoft.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: DriveLetterAccess - {5CA3D70E-1895-11CF-8E15-001234567890} - C:\WINDOWS\system32\dla\tfswshx.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [CeEKEY] C:\Program Files\TOSHIBA\E-KEY\CeEKey.exe
    O4 - HKLM\..\Run: [CeEPOWER] C:\Program Files\TOSHIBA\Power Management\CePMTray.exe
    O4 - HKLM\..\Run: [EzButton] C:\Program Files\EzButton\EzButton.EXE
    O4 - HKLM\..\Run: [Apoint] C:\Program Files\Apoint2K\Apoint.exe
    O4 - HKLM\..\Run: [TPNF] C:\Program Files\TOSHIBA\TouchPad\TPTray.exe
    O4 - HKLM\..\Run: [NDSTray.exe] NDSTray.exe
    O4 - HKLM\..\Run: [dla] C:\WINDOWS\system32\dla\tfswctrl.exe
    O4 - HKLM\..\Run: [PadTouch] C:\Program Files\TOSHIBA\Touch and Launch\PadExe.exe
    O4 - HKLM\..\Run: [LtMoh] C:\Program Files\ltmoh\Ltmoh.exe
    O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe
    O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
    O4 - HKLM\..\Run: [WinampAgent] "C:\Program Files\Winamp\winampa.exe"
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [BM931b8bdc] Rundll32.exe "C:\WINDOWS\system32\gelgxdjh.dll",s
    O4 - HKCU\..\Run: [TOSCDSPD] C:\Program Files\TOSHIBA\TOSCDSPD\toscdspd.exe
    O4 - HKCU\..\Run: [MsnMsgr] "C:\Program Files\Windows Live\Messenger\MsnMsgr.Exe" /background
    O4 - HKCU\..\Run: [HijackThis startup scan] C:\Documents and Settings\user\My Documents\source\spyware\hijackthis\HijackThis.exe /startupscan
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Global Startup: Microsoft Office OneNote 2003 Quick Launch.lnk = C:\Program Files\Microsoft Office\OFFICE11\ONENOTEM.EXE
    O4 - Global Startup: RAMASST.lnk = C:\WINDOWS\system32\RAMASST.exe
    O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\j2re1.4.2_04\bin\npjpi142_04.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/english...an_unicode.cab
    O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/wind...?1199559210477
    O16 - DPF: {FD0B6769-6490-4A91-AA0A-B5AE0DC75AC9} (Performance Viewer Activex Control) - https://secure.logmein.com/activex/ractrl.cab?lmi=100
    ...
  9. 2008-04-03, 09:08 #9
    GaelicEarl
    GaelicEarl is offline
    Junior Member
    Join Date
    Mar 2008
    Posts
    22

    Default

    O23 - Service: Ad-Aware 2007 Service (aawservice) - Lavasoft - C:\Program Files\Lavasoft\Ad-Aware 2007\aawservice.exe
    O23 - Service: Atheros Configuration Service (ACS) - Unknown owner - C:\WINDOWS\System32\ACS.exe
    O23 - Service: Ati HotKey Poller - Unknown owner - C:\WINDOWS\System32\Ati2evxx.exe
    O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: CeEPwrSvc - COMPAL ELECTRONIC INC. - C:\Program Files\TOSHIBA\Power Management\CeEPwrSvc.exe
    O23 - Service: ConfigFree Service (CFSvcs) - TOSHIBA CORPORATION - C:\Program Files\TOSHIBA\ConfigFree\CFSvcs.exe
    O23 - Service: DVD-RAM_Service - Matsushita Electric Industrial Co., Ltd. - C:\WINDOWS\System32\DVDRAMSV.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

    --
    End of file - 8605 bytes



    So that's the three logs, they're still showing infections but hopefully this is all part of the process!
  10. 2008-04-03, 09:14 #10
    Blade81
    Blade81 is offline
    Security Expert: Emeritus Blade81's Avatar
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    25,288

    Default

    Hi

    Open notepad and copy/paste the text in the quotebox below into it:

    Code:
    Folder::
C:\Documents and Settings\user\My Documents\source\spyware\hijackthis\backups

Registry::
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HijackThis startup scan"=-

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"BM931b8bdc"=-

    Save this as
    CFScript




    Refering to the picture above, drag CFScript into ComboFix.exe
    Then post the resultant log & a fresh hjt log.


    Combofix should never take more that 20 minutes including the reboot if malware is detected.
    If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
    If that happened we want to know, and also what process you had to end.
    Microsoft Windows Insider MVP 2016-2020
    Microsoft MVP Consumer Security 2008-2015
    UNITE member since 2006

    If you have problems create a thread in the forum, please.

    Malware removal instructions are for the correspondent user's case only.
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules