Page 1 of 3 123 LastLast
Results 1 to 10 of 28

Thread: Virtumonde won't go away kaspersky report 1

  1. 2008-05-30, 22:23 #1
    kevin goss
    kevin goss is offline
    Junior Member
    Join Date
    May 2008
    Location
    UK
    Posts
    19

    Default Virtumonde won't go away kaspersky report 1

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 21:05:39, on 30/05/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Logitech\Video\LogiTray.exe
    C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
    C:\WINDOWS\system32\LVComS.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    C:\Program Files\XpertVision\TBPanel.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\btbb_wcm\McciTrayApp.exe
    C:\WINDOWS\System32\svchost.exe
    C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
    C:\Program Files\BT Broadband Desktop Help\bin\BTHelpNotifier.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\PROGRA~1\Yahoo!\browser\ycommon.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\PROGRA~1\Ahead\Ahead\data\Xtras\mssysmgr.exe
    C:\Program Files\Samsung\Digimax Viewer 2.1\STImgBrowser.exe
    C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
    C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    C:\Program Files\BT Broadband Desktop Help\bin\mpbtn.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/c...o/bt_side.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.red.clientapps.yahoo.com/c...rch.yahoo.com/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.supanet.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://uk.red.clientapps.yahoo.com/c...rch.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/c...o/bt_side.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.red.clientapps.yahoo.com/c...rch.yahoo.com/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.red.clientapps.yahoo.com/c...rch.yahoo.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O1 - Hosts: 1.1.1.1 ewido.net
    O1 - Hosts: 1.1.1.1 www.ewido.net
    O1 - Hosts: 1.1.1.1 www.bitdefender.com
    O1 - Hosts: 1.1.1.1 download.bitdefender.com
    O1 - Hosts: 1.1.1.1 spywareinfo.com
    O1 - Hosts: 1.1.1.1 www.spywareinfo.com
    O1 - Hosts: 1.1.1.1 sysinternals.com
    O1 - Hosts: 1.1.1.1 www.sysinternals.com
    O1 - Hosts: 1.1.1.1 onguardonline.gov
    O1 - Hosts: 1.1.1.1 www.onguardonline.gov
    O1 - Hosts: 1.1.1.1 avast.com
    O1 - Hosts: 1.1.1.1 www.avast.com
    O1 - Hosts: 1.1.1.1 safety.live.com
    O1 - Hosts: 1.1.1.1 www.paretologic.com
    O1 - Hosts: 1.1.1.1 paretologic.com
    O1 - Hosts: 1.1.1.1 services.google.com
    O1 - Hosts: 1.1.1.1 www.webroot.com
    O1 - Hosts: 1.1.1.1 webroot.com
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: (no name) - {103F0C2A-516D-46FF-B3DF-6EB94A4C57F9} - (no file)
    O2 - BHO: (no name) - {1040F744-202E-4331-B6E8-89993D6A7657} - C:\WINDOWS\system32\vtUmnnOF.dll (file missing)
    O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
    O2 - BHO: (no name) - {227ADE7C-5B39-4F40-BC1E-9EAD8E8203E3} - (no file)
    O2 - BHO: (no name) - {3095D50F-F1BA-4BBC-A54D-819EEB7E0898} - C:\WINDOWS\system32\wvUljHBs.dll
    O2 - BHO: (no name) - {514A5C49-0C7D-42c3-A71B-38864A269B7A} - C:\WINDOWS\system32\cefgvxkl.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
    O2 - BHO: {bf5d6750-504d-2608-4b94-4c1f761fdfe6} - {6efdf167-f1c4-49b4-8062-d4050576d5fb} - C:\WINDOWS\system32\sgimkgic.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: (no name) - {7F8AD45B-59ED-46F6-AB00-884241D81248} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: (no name) - {9CCE1F4D-07F4-4C16-909B-82028DD89B21} - (no file)
    O2 - BHO: (no name) - {ABDEF3AE-052E-4846-8860-8206AC1F3383} - C:\WINDOWS\system32\tuvTmNFX.dll (file missing)
    O2 - BHO: (no name) - {D8DAA57A-3087-42FE-9298-E16A2961B460} - C:\WINDOWS\system32\awtusPHx.dll (file missing)
    O2 - BHO: (no name) - {E369262C-A737-4812-93F5-3E0763DED706} - (no file)
    O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
    O2 - BHO: (no name) - {F4057D43-249D-42CB-B459-8CB0AA930AFD} - (no file)
    O2 - BHO: (no name) - {F5A7959F-A7DF-4889-95A8-B5FDB712F9C8} - C:\WINDOWS\system32\hgGaaXpQ.dll (file missing)
    O2 - BHO: (no name) - {FFB6FFF1-237A-4EDF-93A3-AE66E65FDA45} - (no file)
    O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
    O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
    O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [Gainward] C:\Program Files\XpertVision\TBPanel.exe /A
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [btbb_wcm_McciTrayApp] C:\Program Files\btbb_wcm\McciTrayApp.exe
    O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
    O4 - HKLM\..\Run: [btbb_McciTrayApp] C:\Program Files\BT Broadband Desktop Help\bin\BTHelpNotifier.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [b5145006] rundll32.exe "C:\WINDOWS\system32\tafwasyd.dll",b
    O4 - HKLM\..\Run: [BMb627639a] Rundll32.exe "C:\WINDOWS\system32\mbdrkeyf.dll",s
    O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
    O4 - HKLM\..\RunOnce: [SpybotDeletingC4501] cmd /c del "C:\WINDOWS\system32\awtusPHx.dll_old"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\Ahead\Ahead\data\Xtras\mssysmgr.exe
    O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: BT Broadband Desktop Help.lnk = C:\Program Files\BT Broadband Desktop Help\bin\matcli.exe
    O4 - Global Startup: Digimax Viewer 2.1.lnk = ?
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: BT Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Samantha\Start Menu\Programs\Accessories\IMVU\Run IMVU.lnk (file missing)
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
    O16 - DPF: {138E6DC9-722B-4F4B-B09D-95D191869696} (Bebo Uploader Control) - http://www.bebo.com/files/BeboUploader.5.1.4.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {26522409-8BBF-4C5B-A4D3-CF4B1D6F255B} (UMediaPlayer Class) - http://www.umediaserver.net/bin/UMediaControl5.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1186819028718
    O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} (VideoEgg ActiveX Loader) - http://update.videoegg.com/Install/W...gPublisher.exe
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab
    O20 - Winlogon Notify: wvUljHBs - C:\WINDOWS\SYSTEM32\wvUljHBs.dll
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
    O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
    O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

    --
    End of file - 15081 bytes
  2. 2008-05-30, 22:28 #2
    kevin goss
    kevin goss is offline
    Junior Member
    Join Date
    May 2008
    Location
    UK
    Posts
    19

    Default Virtumonde won't go away HJT report 1

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 21:05:39, on 30/05/2008
    Platform: Windows XP SP3 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    C:\Program Files\Logitech\Video\LogiTray.exe
    C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
    C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe
    C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe
    C:\WINDOWS\system32\LVComS.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    C:\Program Files\XpertVision\TBPanel.exe
    C:\Program Files\Common Files\Real\Update_OB\realsched.exe
    C:\Program Files\btbb_wcm\McciTrayApp.exe
    C:\WINDOWS\System32\svchost.exe
    C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
    C:\Program Files\BT Broadband Desktop Help\bin\BTHelpNotifier.exe
    C:\Program Files\Common Files\Symantec Shared\ccApp.exe
    C:\Program Files\Windows Defender\MSASCui.exe
    C:\PROGRA~1\Yahoo!\browser\ycommon.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\PROGRA~1\Ahead\Ahead\data\Xtras\mssysmgr.exe
    C:\Program Files\Samsung\Digimax Viewer 2.1\STImgBrowser.exe
    C:\PROGRA~1\Yahoo!\MESSEN~1\ymsgr_tray.exe
    C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    C:\Program Files\BT Broadband Desktop Help\bin\mpbtn.exe
    C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLLoginProxy.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Internet Explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/c...o/bt_side.html
    R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.red.clientapps.yahoo.com/c...rch.yahoo.com/
    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.supanet.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://uk.red.clientapps.yahoo.com/c...rch.yahoo.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Bar = http://uk.red.clientapps.yahoo.com/c...o/bt_side.html
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://uk.red.clientapps.yahoo.com/c...rch.yahoo.com/
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Internet Explorer\SearchURL,(Default) = http://uk.red.clientapps.yahoo.com/c...rch.yahoo.com/
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = 127.0.0.1
    R3 - URLSearchHook: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O1 - Hosts: 1.1.1.1 ewido.net
    O1 - Hosts: 1.1.1.1 www.ewido.net
    O1 - Hosts: 1.1.1.1 www.bitdefender.com
    O1 - Hosts: 1.1.1.1 download.bitdefender.com
    O1 - Hosts: 1.1.1.1 spywareinfo.com
    O1 - Hosts: 1.1.1.1 www.spywareinfo.com
    O1 - Hosts: 1.1.1.1 sysinternals.com
    O1 - Hosts: 1.1.1.1 www.sysinternals.com
    O1 - Hosts: 1.1.1.1 onguardonline.gov
    O1 - Hosts: 1.1.1.1 www.onguardonline.gov
    O1 - Hosts: 1.1.1.1 avast.com
    O1 - Hosts: 1.1.1.1 www.avast.com
    O1 - Hosts: 1.1.1.1 safety.live.com
    O1 - Hosts: 1.1.1.1 www.paretologic.com
    O1 - Hosts: 1.1.1.1 paretologic.com
    O1 - Hosts: 1.1.1.1 services.google.com
    O1 - Hosts: 1.1.1.1 www.webroot.com
    O1 - Hosts: 1.1.1.1 webroot.com
    O2 - BHO: Yahoo! Toolbar Helper - {02478D38-C3F9-4EFB-9B51-7695ECA05670} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O2 - BHO: (no name) - {103F0C2A-516D-46FF-B3DF-6EB94A4C57F9} - (no file)
    O2 - BHO: (no name) - {1040F744-202E-4331-B6E8-89993D6A7657} - C:\WINDOWS\system32\vtUmnnOF.dll (file missing)
    O2 - BHO: (no name) - {1E8A6170-7264-4D0F-BEAE-D42A53123C75} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\NppBho.dll
    O2 - BHO: (no name) - {227ADE7C-5B39-4F40-BC1E-9EAD8E8203E3} - (no file)
    O2 - BHO: (no name) - {3095D50F-F1BA-4BBC-A54D-819EEB7E0898} - C:\WINDOWS\system32\wvUljHBs.dll
    O2 - BHO: (no name) - {514A5C49-0C7D-42c3-A71B-38864A269B7A} - C:\WINDOWS\system32\cefgvxkl.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Yahoo! IE Services Button - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
    O2 - BHO: {bf5d6750-504d-2608-4b94-4c1f761fdfe6} - {6efdf167-f1c4-49b4-8062-d4050576d5fb} - C:\WINDOWS\system32\sgimkgic.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O2 - BHO: (no name) - {7F8AD45B-59ED-46F6-AB00-884241D81248} - (no file)
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: (no name) - {9CCE1F4D-07F4-4C16-909B-82028DD89B21} - (no file)
    O2 - BHO: (no name) - {ABDEF3AE-052E-4846-8860-8206AC1F3383} - C:\WINDOWS\system32\tuvTmNFX.dll (file missing)
    O2 - BHO: (no name) - {D8DAA57A-3087-42FE-9298-E16A2961B460} - C:\WINDOWS\system32\awtusPHx.dll (file missing)
    O2 - BHO: (no name) - {E369262C-A737-4812-93F5-3E0763DED706} - (no file)
    O2 - BHO: SidebarAutoLaunch Class - {F2AA9440-6328-4933-B7C9-A6CCDF9CBF6D} - C:\Program Files\Yahoo!\browser\YSidebarIEBHO.dll
    O2 - BHO: (no name) - {F4057D43-249D-42CB-B459-8CB0AA930AFD} - (no file)
    O2 - BHO: (no name) - {F5A7959F-A7DF-4889-95A8-B5FDB712F9C8} - C:\WINDOWS\system32\hgGaaXpQ.dll (file missing)
    O2 - BHO: (no name) - {FFB6FFF1-237A-4EDF-93A3-AE66E65FDA45} - (no file)
    O3 - Toolbar: (no name) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - (no file)
    O3 - Toolbar: Yahoo! Toolbar - {EF99BD32-C1FB-11D2-892F-0090271D4F88} - C:\Program Files\Yahoo!\Companion\Installs\cpn\yt.dll
    O3 - Toolbar: Show Norton Toolbar - {90222687-F593-4738-B738-FBEE9C7B26DF} - C:\Program Files\Common Files\Symantec Shared\coShared\Browser\1.5\UIBHO.dll
    O4 - HKLM\..\Run: [LogitechVideoRepair] C:\Program Files\Logitech\Video\ISStart.exe
    O4 - HKLM\..\Run: [LogitechVideoTray] C:\Program Files\Logitech\Video\LogiTray.exe
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
    O4 - HKLM\..\Run: [OrderReminder] C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe"
    O4 - HKLM\..\Run: [PCSuiteTrayApplication] C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe -startup
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [Gainward] C:\Program Files\XpertVision\TBPanel.exe /A
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe
    O4 - HKLM\..\Run: [TkBellExe] "C:\Program Files\Common Files\Real\Update_OB\realsched.exe" -osboot
    O4 - HKLM\..\Run: [btbb_wcm_McciTrayApp] C:\Program Files\btbb_wcm\McciTrayApp.exe
    O4 - HKLM\..\Run: [YBrowser] C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe
    O4 - HKLM\..\Run: [btbb_McciTrayApp] C:\Program Files\BT Broadband Desktop Help\bin\BTHelpNotifier.exe
    O4 - HKLM\..\Run: [ccApp] "C:\Program Files\Common Files\Symantec Shared\ccApp.exe"
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [Symantec PIF AlertEng] "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" /a /m "C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\AlertEng.dll"
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [b5145006] rundll32.exe "C:\WINDOWS\system32\tafwasyd.dll",b
    O4 - HKLM\..\Run: [BMb627639a] Rundll32.exe "C:\WINDOWS\system32\mbdrkeyf.dll",s
    O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
    O4 - HKLM\..\RunOnce: [SpybotDeletingC4501] cmd /c del "C:\WINDOWS\system32\awtusPHx.dll_old"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [PhotoShow Deluxe Media Manager] C:\PROGRA~1\Ahead\Ahead\data\Xtras\mssysmgr.exe
    O4 - HKCU\..\Run: [Yahoo! Pager] C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe -quiet
    O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'LOCAL SERVICE')
    O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'NETWORK SERVICE')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'SYSTEM')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\System32\CTFMON.EXE (User 'Default user')
    O4 - Global Startup: BT Broadband Desktop Help.lnk = C:\Program Files\BT Broadband Desktop Help\bin\matcli.exe
    O4 - Global Startup: Digimax Viewer 2.1.lnk = ?
    O4 - Global Startup: Logitech Desktop Messenger.lnk = C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_05\bin\ssv.dll
    O9 - Extra button: BT Yahoo! Services - {5BAB4B5B-68BC-4B02-94D6-2FC0DE4A7897} - C:\PROGRA~1\Yahoo!\Common\yiesrvc.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
    O9 - Extra button: Run IMVU - {d9288080-1baa-4bc4-9cf8-a92d743db949} - C:\Documents and Settings\Samantha\Start Menu\Programs\Accessories\IMVU\Run IMVU.lnk (file missing)
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {0EB0E74A-2A76-4AB3-A7FB-9BD8C29F7F75} (CKAVWebScan Object) - http://www.kaspersky.com/kos/eng/par...an_unicode.cab
    O16 - DPF: {138E6DC9-722B-4F4B-B09D-95D191869696} (Bebo Uploader Control) - http://www.bebo.com/files/BeboUploader.5.1.4.cab
    O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} (Windows Genuine Advantage Validation Tool) - http://go.microsoft.com/fwlink/?linkid=39204
    O16 - DPF: {26522409-8BBF-4C5B-A4D3-CF4B1D6F255B} (UMediaPlayer Class) - http://www.umediaserver.net/bin/UMediaControl5.cab
    O16 - DPF: {30528230-99f7-4bb4-88d8-fa1d4f56a2ab} (Installation Support) - C:\Program Files\Yahoo!\Common\Yinsthelper.dll
    O16 - DPF: {6A344D34-5231-452A-8A57-D064AC9B7862} (Symantec Download Manager) - https://webdl.symantec.com/activex/symdlmgr.cab
    O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} (MUWebControl Class) - http://www.update.microsoft.com/micr...?1186819028718
    O16 - DPF: {AF2E62B6-F9E1-4D4F-A10A-9DC8E6DCBCC0} (VideoEgg ActiveX Loader) - http://update.videoegg.com/Install/W...gPublisher.exe
    O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} (MessengerStatsClient Class) - http://messenger.zone.msn.com/binary...t.cab56907.cab
    O16 - DPF: {F5A7706B-B9C0-4C89-A715-7A0C6B05DD48} (Minesweeper Flags Class) - http://messenger.zone.msn.com/binary...r.cab56986.cab
    O20 - Winlogon Notify: wvUljHBs - C:\WINDOWS\SYSTEM32\wvUljHBs.dll
    O23 - Service: Symantec Event Manager (ccEvtMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Settings Manager (ccSetMgr) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: Symantec Lic NetConnect service (CLTNetCnService) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: COM Host (comHost) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\VAScanner\comHost.exe
    O23 - Service: Firebird Guardian - DefaultInstance (FirebirdGuardianDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe
    O23 - Service: Firebird Server - DefaultInstance (FirebirdServerDefaultInstance) - The Firebird Project - C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: LiveUpdate Notice Service Ex (LiveUpdate Notice Ex) - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    O23 - Service: LiveUpdate Notice Service - Symantec Corporation - C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe
    O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe
    O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: ServiceLayer - Nokia. - C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    O23 - Service: Symantec Core LC - Unknown owner - C:\Program Files\Common Files\Symantec Shared\CCPD-LC\symlcsvc.exe
    O23 - Service: YPCService - Yahoo! Inc. - C:\WINDOWS\system32\YPCSER~1.EXE

    --
    End of file - 15081 bytes
  3. 2008-05-30, 22:57 #3
    steamwiz
    steamwiz is offline
    Security Expert-Emeritus steamwiz's Avatar
    Join Date
    Dec 2005
    Location
    Yorkshire. U.K.
    Posts
    1,313

    Default

    Hi

    I merged your posts into the same thread, before I realised you have posted the same log twice ...

    Please post the Kaspersky log in this thread by using the Post Reply button

    steam
    MICROSOFT MVP - Security 2004/9 .member of ASAP since 2004 - member of U.N.I.T.E
  4. 2008-05-31, 00:11 #4
    kevin goss
    kevin goss is offline
    Junior Member
    Join Date
    May 2008
    Location
    UK
    Posts
    19

    Default 2nd scan/report

    apologies but i am new!!

    The scan report was to big so i have enclosed it a zip file is this is ok
  5. 2008-05-31, 21:55 #5
    steamwiz
    steamwiz is offline
    Security Expert-Emeritus steamwiz's Avatar
    Join Date
    Dec 2005
    Location
    Yorkshire. U.K.
    Posts
    1,313

    Default

    HI
    apologies but i am new!!

    The scan report was to big so i have enclosed it a zip file is this is ok
    No problem & the attaching the zip is fine

    Please Download Malwarebytes' Anti-Malware from Here :-

    http://www.majorgeeks.com/Malwarebyt...are_d5756.html

    or here :-

    http://www.besttechie.net/tools/mbam-setup.exe

    Double Click mbam-setup.exe to install the application.

    * Make sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select "Perform Quick Scan", then click Scan.
    * The scan may take some time to finish,so please be patient.
    * When the scan is complete, click OK, then Show Results to view the results.
    * Make sure that everything is checked, and click Remove Selected.
    * When disinfection is completed, a log will open in Notepad and you may be prompted to Restart.
    * The log is automatically saved by MBAM and can be viewed by clicking the Logs tab in MBAM.
    * Copy and Paste the entire report in your next reply.

    THEN ...

    Please follow these directions to run Combofix & post a log.

    http://www.bleepingcomputer.com/comb...o-use-combofix

    steam
    MICROSOFT MVP - Security 2004/9 .member of ASAP since 2004 - member of U.N.I.T.E
  6. 2008-05-31, 23:26 #6
    kevin goss
    kevin goss is offline
    Junior Member
    Join Date
    May 2008
    Location
    UK
    Posts
    19

    Default 1st of 2 reports

    Thanks for the help steam.

    I have attached another zip file. Apologies but its a large word document
  7. 2008-05-31, 23:50 #7
    kevin goss
    kevin goss is offline
    Junior Member
    Join Date
    May 2008
    Location
    UK
    Posts
    19

    Default XP recovery console possible problem

    The options provided in the link are for (SP1) and (SP2) users only.

    I have updated with service (SP3)

    can i simply use the SP2 download

    Would prefer to check with you before going ahead!!
  8. 2008-06-01, 02:19 #8
    steamwiz
    steamwiz is offline
    Security Expert-Emeritus steamwiz's Avatar
    Join Date
    Dec 2005
    Location
    Yorkshire. U.K.
    Posts
    1,313

    Default

    Hi

    The SP2 download of RC has been tried in an SP3 machine and appears to work, but as Microsoft have not released an updated RC for SP3 yet ... skip that part & just run Combofix...

    The word document you zipped was created on a 2007 word program, on this computer I have word 2003 & will have to download and install a Microsoft Office Compatibility Pack for Word in order to view it ... 30 Megs ... as it's past 1am here, I'm just ready for bed ... I'll get back to you tomorrow ...

    steam
    MICROSOFT MVP - Security 2004/9 .member of ASAP since 2004 - member of U.N.I.T.E
  9. 2008-06-01, 10:34 #9
    kevin goss
    kevin goss is offline
    Junior Member
    Join Date
    May 2008
    Location
    UK
    Posts
    19

    Default combofix log report

    Thanks

    ComboFix 08-05-29.1 - Kevin 2008-06-01 9:22:14.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.3.1252.1.1033.18.1373 [GMT 1:00]
    Running from: C:\Documents and Settings\Kevin\Desktop\ComboFix.exe
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\BMb627639a.xml
    C:\WINDOWS\pskt.ini
    C:\WINDOWS\system32\acegllme.dll
    C:\WINDOWS\system32\biuotivo.dll
    C:\WINDOWS\system32\cdibcvto.ini
    C:\WINDOWS\system32\cktnpnws.dll
    C:\WINDOWS\system32\cnvromhx.dll
    C:\WINDOWS\system32\cywnrtql.dll
    C:\WINDOWS\system32\dnkuputi.dll
    C:\WINDOWS\system32\dysawfat.ini
    C:\WINDOWS\system32\eaiofxny.dll
    C:\WINDOWS\system32\egfxostg.ini
    C:\WINDOWS\system32\ewvdsehn.dll
    C:\WINDOWS\system32\ffwcaeiy.dll
    C:\WINDOWS\system32\fghhPXbc.ini
    C:\WINDOWS\system32\fghhPXbc.ini2
    C:\WINDOWS\system32\FhilTvut.ini
    C:\WINDOWS\system32\FhilTvut.ini2
    C:\WINDOWS\system32\FhPrutwa.ini
    C:\WINDOWS\system32\FhPrutwa.ini2
    C:\WINDOWS\system32\FOnnmUtv.ini
    C:\WINDOWS\system32\FOnnmUtv.ini2
    C:\WINDOWS\system32\fudhvoum.ini
    C:\WINDOWS\system32\gchjcpsd.dll
    C:\WINDOWS\system32\hfiywcpn.dll
    C:\WINDOWS\system32\hOqqrBeg.ini
    C:\WINDOWS\system32\hOqqrBeg.ini2
    C:\WINDOWS\system32\ibuowlxj.ini
    C:\WINDOWS\system32\irlvhvuy.ini
    C:\WINDOWS\system32\itupuknd.ini
    C:\WINDOWS\system32\jkSvCJjl.ini
    C:\WINDOWS\system32\jkSvCJjl.ini2
    C:\WINDOWS\system32\jlqxwcrv.dll
    C:\WINDOWS\system32\jmrwvvch.dll
    C:\WINDOWS\system32\jxlwoubi.dll
    C:\WINDOWS\system32\lljqyjjd.dll
    C:\WINDOWS\system32\lmaynytb.ini
    C:\WINDOWS\system32\mbdrkeyf.dll
    C:\WINDOWS\system32\mgwflndq.ini
    C:\WINDOWS\system32\mjvmmeqr.dll
    C:\WINDOWS\system32\Mpstttwa.ini
    C:\WINDOWS\system32\Mpstttwa.ini2
    C:\WINDOWS\system32\MSINET.oca
    C:\WINDOWS\system32\ngwcpmnt.dll
    C:\WINDOWS\system32\nhrrqaqo.dll
    C:\WINDOWS\system32\nopflhdr.ini
    C:\WINDOWS\system32\npcwyifh.ini
    C:\WINDOWS\system32\nrcollvn.dll
    C:\WINDOWS\system32\nvllocrn.ini
    C:\WINDOWS\system32\oimlcgww.dll
    C:\WINDOWS\system32\OpqtBJlm.ini
    C:\WINDOWS\system32\OpqtBJlm.ini2
    C:\WINDOWS\system32\poklbhvt.dll
    C:\WINDOWS\system32\pttjmcos.dll
    C:\WINDOWS\system32\qpmffmym.dll
    C:\WINDOWS\system32\QpXaaGgh.ini
    C:\WINDOWS\system32\QpXaaGgh.ini2
    C:\WINDOWS\system32\qtacxgtl.dll
    C:\WINDOWS\system32\qxxgilnc.ini
    C:\WINDOWS\system32\rbdfkvwq.dll
    C:\WINDOWS\system32\rdhlfpon.dll
    C:\WINDOWS\system32\rsvuCJlm.ini
    C:\WINDOWS\system32\rsvuCJlm.ini2
    C:\WINDOWS\system32\rwimywub.dll
    C:\WINDOWS\system32\sgimkgic.dll
    C:\WINDOWS\system32\suuCLUtv.ini
    C:\WINDOWS\system32\suuCLUtv.ini2
    C:\WINDOWS\system32\unpaerca.dll
    C:\WINDOWS\system32\vrcycywl.ini
    C:\WINDOWS\system32\vrcycywl.ini2
    C:\WINDOWS\system32\vrcycywl.tmp
    C:\WINDOWS\system32\wldqbpuk.ini
    C:\WINDOWS\system32\wxemgdjh.dll
    C:\WINDOWS\system32\wyIjlUtv.ini
    C:\WINDOWS\system32\wyIjlUtv.ini2
    C:\WINDOWS\system32\XFNmTvut.ini
    C:\WINDOWS\system32\XFNmTvut.ini2
    C:\WINDOWS\system32\xHPsutwa.ini
    C:\WINDOWS\system32\xHPsutwa.ini2
    C:\WINDOWS\system32\yahvltes.dll
    C:\WINDOWS\system32\ygbrwfsa.ini
    C:\WINDOWS\system32\yieacwff.ini
    C:\WINDOWS\system32\yuvhvlri.dll

    .
    ((((((((((((((((((((((((( Files Created from 2008-05-01 to 2008-06-01 )))))))))))))))))))))))))))))))
    .

    2008-05-31 21:40 . 2008-05-31 21:40 <DIR> d-------- C:\Documents and Settings\Kevin\Application Data\Malwarebytes
    2008-05-31 21:39 . 2008-05-31 21:40 <DIR> d-------- C:\Program Files\Malwarebytes' Anti-Malware
    2008-05-31 21:39 . 2008-05-31 21:39 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Malwarebytes
    2008-05-31 21:39 . 2008-05-30 01:06 34,296 --a------ C:\WINDOWS\system32\drivers\mbamcatchme.sys
    2008-05-31 21:39 . 2008-05-30 01:06 15,864 --a------ C:\WINDOWS\system32\drivers\mbam.sys
    2008-05-31 19:43 . 2008-05-31 22:02 92,160 --------- C:\WINDOWS\system32\jgrbqvht.dll
    2008-05-31 18:57 . 2008-05-31 18:57 22 --a------ C:\WINDOWS\system32\cbXPhhgf.zip
    2008-05-31 15:09 . 2008-05-31 15:09 92,160 --a------ C:\WINDOWS\system32\mxmtqadj.dll
    2008-05-31 13:12 . 2008-05-31 13:12 92,160 --a------ C:\WINDOWS\system32\vsfunmqk.dll
    2008-05-31 00:10 . 2008-05-31 00:10 92,160 --a------ C:\WINDOWS\system32\fspnyiqf.dll
    2008-05-30 21:04 . 2008-05-30 21:04 <DIR> d-------- C:\Program Files\Trend Micro
    2008-05-30 20:57 . 2008-05-30 20:57 92,160 --a------ C:\WINDOWS\system32\cefgvxkl.dll
    2008-05-29 20:39 . 2008-05-29 20:39 <DIR> d-------- C:\WINDOWS\system32\Kaspersky Lab
    2008-05-29 20:39 . 2008-05-29 20:39 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Kaspersky Lab
    2008-05-29 20:20 . 2008-05-29 20:20 92,160 --a------ C:\WINDOWS\system32\erigpoov.dll
    2008-05-29 19:27 . 2008-05-29 19:27 92,160 --a------ C:\WINDOWS\system32\oyupiqho.dll
    2008-05-29 10:07 . 2008-05-29 10:07 92,160 --a------ C:\WINDOWS\system32\ukopchqn.dll
    2008-05-29 08:43 . 2008-05-29 08:43 92,160 --a------ C:\WINDOWS\system32\tcapepww.dll
    2008-05-29 07:10 . 2008-05-29 07:10 92,160 --a------ C:\WINDOWS\system32\dknxrdge.dll
    2008-05-28 23:38 . 2008-05-28 23:38 92,160 --a------ C:\WINDOWS\system32\tqahthca.dll
    2008-05-28 23:15 . 2008-05-28 23:15 <DIR> d-------- C:\VundoFix Backups
    2008-05-28 22:07 . 2008-05-28 22:07 <DIR> d-------- C:\Program Files\TweakNow RegCleaner Std
    2008-05-28 18:37 . 2008-05-28 18:37 92,160 --a------ C:\WINDOWS\system32\otcjedft.dll
    2008-05-28 12:10 . 2008-05-28 12:10 92,160 --a------ C:\WINDOWS\system32\pgbcpybi.dll
    2008-05-28 11:04 . 2008-05-28 11:04 92,160 --a------ C:\WINDOWS\system32\iawqogus.dll
    2008-05-28 09:40 . 2008-05-28 09:40 92,160 --a------ C:\WINDOWS\system32\sklbdwat.dll
    2008-05-27 23:24 . 2008-05-27 23:24 <DIR> d-------- C:\Documents and Settings\Kevin\Phone Browser
    2008-05-27 22:05 . 2008-05-27 22:05 <DIR> d-------- C:\Program Files\Windows Defender
    2008-05-27 11:53 . 2008-05-27 11:53 92,160 --a------ C:\WINDOWS\system32\vputtocl.dll
    2008-05-26 10:27 . 2008-05-26 10:27 92,160 --a------ C:\WINDOWS\system32\xsvkkntc.dll
    2008-05-25 15:55 . 2008-05-25 15:55 <DIR> d-------- C:\WINDOWS\system32\vntiho05
    2008-05-25 15:55 . 2008-05-25 15:55 <DIR> d-------- C:\Temp\vtmp2
    2008-05-25 15:55 . 2008-05-25 15:55 <DIR> d-------- C:\Temp
    2008-05-25 15:55 . 2008-05-31 22:02 28,160 --------- C:\WINDOWS\system32\wvUljHBs.dll
    2008-05-23 14:42 . 2008-05-29 19:35 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
    2008-05-23 14:42 . 2008-05-28 01:52 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-05-18 19:14 . 2008-05-18 19:14 74,080 --a------ C:\WINDOWS\system32\GDIPFONTCACHEV1.DAT
    2008-05-18 17:10 . 2008-05-18 17:10 <DIR> d-------- C:\WINDOWS\system32\scripting
    2008-05-18 17:10 . 2008-05-18 17:10 <DIR> d-------- C:\WINDOWS\system32\en
    2008-05-18 17:10 . 2008-05-18 17:10 <DIR> d-------- C:\WINDOWS\system32\bits
    2008-05-18 17:10 . 2008-05-18 17:10 <DIR> d-------- C:\WINDOWS\l2schemas
    2008-05-18 16:53 . 2008-04-14 01:11 233,472 --a------ C:\WINDOWS\system32\azroles.dll
    2008-05-18 16:53 . 2008-04-14 01:11 136,192 --a------ C:\WINDOWS\system32\aaclient.dll
    2008-05-18 16:53 . 2008-04-14 01:11 12,800 --a------ C:\WINDOWS\system32\credssp.dll
    2008-05-18 16:53 . 2008-04-14 01:11 7,168 --a------ C:\WINDOWS\system32\bitsprx4.dll
    2008-05-18 15:17 . 2008-05-18 15:17 <DIR> d-------- C:\Program Files\Microsoft Works
    2008-05-18 15:15 . 2008-05-18 18:18 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
    2008-05-18 15:14 . 2008-05-18 15:14 <DIR> dr-h----- C:\MSOCache
    2008-05-08 22:15 . 2008-05-08 22:15 <DIR> d-------- C:\Documents and Settings\Paula\Application Data\Motive

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-01 08:28 --------- d-----w C:\Program Files\Common Files\Symantec Shared
    2008-06-01 08:09 --------- d-----w C:\Documents and Settings\All Users\Application Data\Symantec
    2008-05-31 12:35 805 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.INF
    2008-05-31 12:35 123,952 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.SYS
    2008-05-31 12:35 10,671 ----a-w C:\WINDOWS\system32\drivers\SYMEVENT.CAT
    2008-05-31 12:35 --------- d-----w C:\Program Files\Symantec
    2008-05-29 00:30 --------- d-----w C:\Program Files\Norton 360
    2008-05-23 18:58 --------- d-----w C:\Program Files\Messenger Plus! Live
    2008-04-17 18:43 --------- dcsh--w C:\Program Files\Common Files\WindowsLiveInstaller
    2008-04-17 18:42 --------- d-----w C:\Program Files\Windows Live
    2008-04-17 18:42 --------- d-----w C:\Documents and Settings\All Users\Application Data\WLInstaller
    2008-04-17 10:17 --------- d-----w C:\Documents and Settings\All Users\Application Data\Motive
    2008-04-15 11:58 --------- d-----w C:\Program Files\EA GAMES
    2008-04-15 11:44 --------- d-----w C:\Program Files\HyCam2
    2008-04-14 19:28 --------- d-----w C:\Documents and Settings\Samantha\Application Data\LimeWire
    2008-04-14 00:13 40,840 ----a-w C:\WINDOWS\system32\drivers\termdd.sys
    2008-04-14 00:13 21,896 ----a-w C:\WINDOWS\system32\drivers\tdtcp.sys
    2008-04-14 00:13 139,656 ----a-w C:\WINDOWS\system32\drivers\rdpwd.sys
    2008-04-14 00:13 12,040 ----a-w C:\WINDOWS\system32\drivers\tdpipe.sys
    2008-04-14 00:11 451,072 ----a-w C:\WINDOWS\AppPatch\aclayers.dll
    2008-04-13 19:28 175,744 ----a-w C:\WINDOWS\system32\drivers\rdbss.sys
    2008-04-13 19:21 162,816 ----a-w C:\WINDOWS\system32\drivers\netbt.sys
    2008-04-13 19:20 91,520 ----a-w C:\WINDOWS\system32\drivers\ndiswan.sys
    2008-04-13 19:20 361,344 ----a-w C:\WINDOWS\system32\drivers\tcpip.sys
    2008-04-13 19:20 182,656 ----a-w C:\WINDOWS\system32\drivers\ndis.sys
    2008-04-13 19:19 75,264 ----a-w C:\WINDOWS\system32\drivers\ipsec.sys
    2008-04-13 19:19 51,328 ----a-w C:\WINDOWS\system32\drivers\rasl2tp.sys
    2008-04-13 19:19 48,384 ----a-w C:\WINDOWS\system32\drivers\raspptp.sys
    2008-04-13 19:19 146,048 ----a-w C:\WINDOWS\system32\drivers\portcls.sys
    2008-04-13 19:19 138,112 ----a-w C:\WINDOWS\system32\drivers\afd.sys
    2008-04-13 19:18 52,480 ----a-w C:\WINDOWS\system32\drivers\i8042prt.sys
    2008-04-13 19:17 83,072 ----a-w C:\WINDOWS\system32\drivers\wdmaud.sys
    2008-04-13 19:17 456,576 ----a-w C:\WINDOWS\system32\drivers\mrxsmb.sys
    2008-04-13 19:17 105,344 ----a-w C:\WINDOWS\system32\drivers\mup.sys
    2008-04-13 19:16 49,536 ----a-w C:\WINDOWS\system32\drivers\classpnp.sys
    2008-04-13 19:16 141,056 ----a-w C:\WINDOWS\system32\drivers\ks.sys
    2008-04-13 19:15 64,512 ----a-w C:\WINDOWS\system32\drivers\serial.sys
    2008-04-13 19:15 60,800 ----a-w C:\WINDOWS\system32\drivers\sysaudio.sys
    2008-04-13 19:15 574,976 ----a-w C:\WINDOWS\system32\drivers\ntfs.sys
    2008-04-13 19:15 334,848 ----a-w C:\WINDOWS\system32\drivers\srv.sys
    2008-04-13 19:14 63,744 ----a-w C:\WINDOWS\system32\drivers\cdfs.sys
    2008-04-13 19:14 143,744 ----a-w C:\WINDOWS\system32\drivers\fastfat.sys
    2008-04-13 19:00 30,080 ----a-w C:\WINDOWS\system32\drivers\modem.sys
    2008-04-13 19:00 225,664 ----a-w C:\WINDOWS\system32\drivers\tcpip6.sys
    2008-04-13 19:00 19,072 ----a-w C:\WINDOWS\system32\drivers\tdi.sys
    2008-04-13 18:57 41,472 ----a-w C:\WINDOWS\system32\drivers\raspppoe.sys
    2008-04-13 18:57 40,576 ----a-w C:\WINDOWS\system32\drivers\ndproxy.sys
    2008-04-13 18:57 34,560 ----a-w C:\WINDOWS\system32\drivers\wanarp.sys
    2008-04-13 18:57 20,864 ----a-w C:\WINDOWS\system32\drivers\ipinip.sys
    2008-04-13 18:57 152,832 ----a-w C:\WINDOWS\system32\drivers\ipnat.sys
    2008-04-13 18:57 14,336 ----a-w C:\WINDOWS\system32\drivers\asyncmac.sys
    2008-04-13 18:57 10,112 ----a-w C:\WINDOWS\system32\drivers\ndistapi.sys
    2008-04-13 18:56 88,320 ----a-w C:\WINDOWS\system32\drivers\nwlnkipx.sys
    2008-04-13 18:56 69,120 ----a-w C:\WINDOWS\system32\drivers\psched.sys
    2008-04-13 18:56 35,072 ----a-w C:\WINDOWS\system32\drivers\msgpc.sys
    2008-04-13 18:56 34,688 ----a-w C:\WINDOWS\system32\drivers\netbios.sys
    2008-04-13 18:56 30,592 ----a-w C:\WINDOWS\system32\drivers\rndismpx.sys
    2008-04-13 18:56 30,592 ----a-w C:\WINDOWS\system32\drivers\rndismp.sys
    2008-04-13 18:56 12,800 ----a-w C:\WINDOWS\system32\drivers\usb8023x.sys
    2008-04-13 18:56 12,800 ----a-w C:\WINDOWS\system32\drivers\usb8023.sys
    2008-04-13 18:56 12,288 ----a-w C:\WINDOWS\system32\drivers\tunmp.sys
    2008-04-13 18:55 202,624 ----a-w C:\WINDOWS\system32\drivers\rmcast.sys
    2008-04-13 18:55 14,592 ----a-w C:\WINDOWS\system32\drivers\ndisuio.sys
    2008-04-13 18:54 11,264 ----a-w C:\WINDOWS\system32\drivers\irenum.sys
    2008-04-13 18:53 71,552 ----a-w C:\WINDOWS\system32\drivers\bridge.sys
    2008-04-13 18:53 40,320 ----a-w C:\WINDOWS\system32\drivers\nmnt.sys
    2008-04-13 18:53 36,608 ----a-w C:\WINDOWS\system32\drivers\ip6fw.sys
    2008-04-13 18:53 264,832 ----a-w C:\WINDOWS\system32\drivers\http.sys
    2008-04-13 18:51 61,824 ----a-w C:\WINDOWS\system32\drivers\nic1394.sys
    2008-04-13 18:51 60,800 ----a-w C:\WINDOWS\system32\drivers\arp1394.sys
    2008-04-13 18:51 59,904 ----a-w C:\WINDOWS\system32\drivers\atmarpc.sys
    2008-04-13 18:51 55,808 ----a-w C:\WINDOWS\system32\drivers\atmlane.sys
    2008-04-13 18:51 101,120 ----a-w C:\WINDOWS\system32\drivers\bthpan.sys
    2008-04-13 18:47 25,856 ----a-w C:\WINDOWS\system32\drivers\usbprint.sys
    2008-04-13 18:45 60,160 ----a-w C:\WINDOWS\system32\drivers\drmk.sys
    2008-04-13 18:44 81,664 ----a-w C:\WINDOWS\system32\drivers\videoprt.sys
    2008-04-13 18:44 799,744 ----a-w C:\WINDOWS\system32\drivers\dmboot.sys
    2008-04-13 18:44 20,992 ----a-w C:\WINDOWS\system32\drivers\vga.sys
    2008-04-13 18:44 153,344 ----a-w C:\WINDOWS\system32\drivers\dmio.sys
    2008-04-13 18:43 14,208 ----a-w C:\WINDOWS\system32\drivers\wacompen.sys
    2008-04-13 18:43 12,672 ----a-w C:\WINDOWS\system32\drivers\mutohpen.sys
    2008-04-13 18:41 52,352 ----a-w C:\WINDOWS\system32\drivers\volsnap.sys
    2008-04-13 18:39 7,552 ----a-w C:\WINDOWS\system32\drivers\mskssrv.sys
    2008-04-13 18:39 5,504 ----a-w C:\WINDOWS\system32\drivers\mstee.sys
    2008-04-13 18:39 5,376 ----a-w C:\WINDOWS\system32\drivers\mspclock.sys
    2008-04-13 18:39 42,368 ----a-w C:\WINDOWS\system32\drivers\mountmgr.sys
    2008-04-13 18:39 4,992 ----a-w C:\WINDOWS\system32\drivers\mspqm.sys
    2008-04-13 18:39 4,352 ----a-w C:\WINDOWS\system32\drivers\swenum.sys
    2008-04-13 18:39 384,768 ----a-w C:\WINDOWS\system32\drivers\update.sys
    2008-04-13 18:39 24,576 ----a-w C:\WINDOWS\system32\drivers\kbdclass.sys
    2008-04-13 18:39 23,040 ----a-w C:\WINDOWS\system32\drivers\mouclass.sys
    2008-04-13 18:38 71,168 ----a-w C:\WINDOWS\system32\drivers\dxg.sys
    2008-04-13 18:33 44,544 ----a-w C:\WINDOWS\system32\drivers\fips.sys
    2008-04-13 18:32 66,048 ----a-w C:\WINDOWS\system32\drivers\udfs.sys
    2008-04-13 18:32 30,848 ----a-w C:\WINDOWS\system32\drivers\npfs.sys
    2008-04-13 18:32 196,224 ----a-w C:\WINDOWS\system32\drivers\rdpdr.sys
    2008-04-13 18:32 19,072 ----a-w C:\WINDOWS\system32\drivers\msfs.sys
    2008-04-13 18:32 180,608 ----a-w C:\WINDOWS\system32\drivers\mrxdav.sys
    2008-04-13 18:32 129,792 ----a-w C:\WINDOWS\system32\drivers\fltmgr.sys
    2008-04-13 18:31 92,288 ----a-w C:\WINDOWS\system32\drivers\ksecdd.sys
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{103F0C2A-516D-46FF-B3DF-6EB94A4C57F9}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1040F744-202E-4331-B6E8-89993D6A7657}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{227ADE7C-5B39-4F40-BC1E-9EAD8E8203E3}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3095D50F-F1BA-4BBC-A54D-819EEB7E0898}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{514A5C49-0C7D-42c3-A71B-38864A269B7A}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7F8AD45B-59ED-46F6-AB00-884241D81248}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{88FBD27C-1A79-4410-8224-523C40ECE694}]
    C:\WINDOWS\system32\cbXPhhgf.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9CCE1F4D-07F4-4C16-909B-82028DD89B21}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ABDEF3AE-052E-4846-8860-8206AC1F3383}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{aef7ac82-b408-4fc3-9909-22b12b4e5f3f}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D8DAA57A-3087-42FE-9298-E16A2961B460}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E369262C-A737-4812-93F5-3E0763DED706}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F4057D43-249D-42CB-B459-8CB0AA930AFD}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F5A7959F-A7DF-4889-95A8-B5FDB712F9C8}]

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FFB6FFF1-237A-4EDF-93A3-AE66E65FDA45}]

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2008-04-14 01:12 15360]
    "PhotoShow Deluxe Media Manager"="C:\PROGRA~1\Ahead\Ahead\data\Xtras\mssysmgr.exe" [2004-05-12 21:04 196608]
    "Yahoo! Pager"="C:\PROGRA~1\Yahoo!\MESSEN~1\ypager.exe" [2005-08-31 18:11 2478080]
    "eyeBeam SIP Client"="" []
    "BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"="C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe" [2007-06-27 20:03 152872]
    "SpybotSD TeaTimer"="C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe" [2008-01-28 11:43 2097488]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "LogitechVideoRepair"="C:\Program Files\Logitech\Video\ISStart.exe" [2003-12-16 23:37 188416]
    "LogitechVideoTray"="C:\Program Files\Logitech\Video\LogiTray.exe" [2003-12-16 23:39 77824]
    "nwiz"="nwiz.exe" [2007-05-10 23:03 1626112 C:\WINDOWS\system32\nwiz.exe]
    "OrderReminder"="C:\Program Files\Hewlett-Packard\OrderReminder\OrderReminder.exe" [2005-03-18 12:18 98304]
    "SunJavaUpdateSched"="C:\Program Files\Java\jre1.6.0_05\bin\jusched.exe" [2008-02-22 05:25 144784]
    "PCSuiteTrayApplication"="C:\Program Files\Nokia\Nokia PC Suite 6\LaunchApplication.exe" [2007-06-18 15:10 271360]
    "SoundMan"="SOUNDMAN.EXE" [2006-06-20 22:42 577536 C:\WINDOWS\soundman.exe]
    "Gainward"="C:\Program Files\XpertVision\TBPanel.exe" [2007-06-26 15:04 2165256]
    "NeroFilterCheck"="C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 16:57 153136]
    "TkBellExe"="C:\Program Files\Common Files\Real\Update_OB\realsched.exe" [2007-11-10 10:19 185632]
    "btbb_wcm_McciTrayApp"="C:\Program Files\btbb_wcm\McciTrayApp.exe" [2006-12-07 07:59 935936]
    "YBrowser"="C:\PROGRA~1\Yahoo!\browser\ybrwicon.exe" [2006-07-21 17:19 129536]
    "btbb_McciTrayApp"="C:\Program Files\BT Broadband Desktop Help\bin\BTHelpNotifier.exe" [2007-08-22 14:34 936960]
    "ccApp"="C:\Program Files\Common Files\Symantec Shared\ccApp.exe" [2007-01-10 06:59 115816]
    "Adobe Reader Speed Launcher"="C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-01-11 23:16 39792]
    "Symantec PIF AlertEng"="C:\Program Files\Common Files\Symantec Shared\PIF\{B8E1DD85-8582-4c61-B58F-2F227FCA9A08}\PIFSvc.exe" [2008-01-29 18:38 583048]
    "b5145006"="C:\WINDOWS\system32\tafwasyd.dll" [ ]
    "lsass"="" []

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="C:\WINDOWS\System32\CTFMON.EXE" [2008-04-14 01:12 15360]
    "Nokia.PCSync"="C:\Program Files\Nokia\Nokia PC Suite 6\PcSync2.exe" [2007-06-19 10:17 1241088]
    "DWQueuedReporting"="C:\PROGRA~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-08-24 03:18 437160]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    BT Broadband Desktop Help.lnk - C:\Program Files\BT Broadband Desktop Help\bin\matcli.exe [12/29/2007 7:17:17 PM 217088]
    Digimax Viewer 2.1.lnk - C:\Program Files\Samsung\Digimax Viewer 2.1\STImgBrowser.exe [2/25/2007 5:48:10 PM 634880]
    Logitech Desktop Messenger.lnk - C:\Program Files\Logitech\Desktop Messenger\8876480\Program\LDMConf.exe [2/25/2007 5:22:14 PM 169472]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "msacm.enc"= ITIG726.acm
    "vidc.VP31"= vp31vfw.dll

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
    "DisableMonitoring"=dword:00000001

    [HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
    "DisableMonitoring"=dword:00000001

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "C:\\Program Files\\LimeWire\\LimeWire.exe"=
    "C:\\Program Files\\Microsoft Games\\Zoo Tycoon 2\\zt.exe"=
    "C:\\Program Files\\Yahoo!\\Messenger\\ypager.exe"=
    "C:\\Program Files\\Yahoo!\\Messenger\\YServer.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\msnmsgr.exe"=
    "C:\\Program Files\\Windows Live\\Messenger\\livecall.exe"=

    R2 FirebirdGuardianDefaultInstance;Firebird Guardian - DefaultInstance;C:\Program Files\Firebird\Firebird_1_5\bin\fbguard.exe [2004-12-13 02:05]
    R3 FirebirdServerDefaultInstance;Firebird Server - DefaultInstance;C:\Program Files\Firebird\Firebird_1_5\bin\fbserver.exe [2004-12-13 02:05]

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f0af6aca-e4ef-11db-9c4b-000b6aa1194d}]
    \Shell\AutoRun\command - G:\InstallTomTomHOME.exe

    *Newly Created Service* - COMHOST
    .
    Contents of the 'Scheduled Tasks' folder
    "2008-06-01 08:29:20 C:\WINDOWS\Tasks\MP Scheduled Scan.job"
    - C:\Program Files\Windows Defender\MpCmdRun.exe
    "2008-05-26 19:00:00 C:\WINDOWS\Tasks\Norton Internet Security - Run Full System Scan - Kevin.job"
    - C:\Program Files\Norton Internet Security\Norton AntiVirus\Navw32.exeh/TASK:
    "2008-05-28 21:19:48 C:\WINDOWS\Tasks\Spybot - Search & Destroy - Scheduled Task.job"
    - C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-01 09:26:55
    Windows 5.1.2600 Service Pack 3 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    ------------------------ Other Running Processes ------------------------
    .
    C:\Program Files\Windows Defender\MsMpEng.exe
    C:\Program Files\Common Files\Symantec Shared\ccSvcHst.exe
    C:\WINDOWS\system32\nvsvc32.exe
    C:\Program Files\PC Connectivity Solution\ServiceLayer.exe
    C:\PROGRA~1\Yahoo!\browser\ycommon.exe
    C:\WINDOWS\system32\LVComS.exe
    C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe
    C:\PROGRA~1\Yahoo!\MESSEN~1\Ymsgr_tray.exe
    C:\Program Files\BT Broadband Desktop Help\bin\mpbtn.exe
    .
    **************************************************************************
    .
    Completion time: 2008-06-01 9:32:14 - machine was rebooted
    ComboFix-quarantined-files.txt 2008-06-01 08:32:11

    Pre-Run: 16,031,813,632 bytes free
    Post-Run: 16,223,809,536 bytes free

    365 --- E O F --- 2008-05-31 18:41:05
  10. 2008-06-01, 20:16 #10
    steamwiz
    steamwiz is offline
    Security Expert-Emeritus steamwiz's Avatar
    Join Date
    Dec 2005
    Location
    Yorkshire. U.K.
    Posts
    1,313

    Default

    Hi

    Do you know what this zip file is ?

    C:\WINDOWS\system32\cbXPhhgf.zip

    Open notepad and copy/paste the text in the code box below into it:
    NOTE* make sure to only highlight and copy what is inside the code box nothing out side of it.
    Also ..

    Pay particular attention to this :-

    Make sure the word File:: is on the first line of the text file you save (no blank line above it, & no space in front of it)
    Code:
    File::
C:\WINDOWS\system32\jgrbqvht.dll
C:\WINDOWS\system32\mxmtqadj.dll
C:\WINDOWS\system32\vsfunmqk.dll
C:\WINDOWS\system32\fspnyiqf.dll
C:\WINDOWS\system32\cefgvxkl.dll
C:\WINDOWS\system32\erigpoov.dll
C:\WINDOWS\system32\oyupiqho.dll
C:\WINDOWS\system32\ukopchqn.dll
C:\WINDOWS\system32\tcapepww.dll
C:\WINDOWS\system32\dknxrdge.dll
C:\WINDOWS\system32\tqahthca.dll
C:\WINDOWS\system32\otcjedft.dll
C:\WINDOWS\system32\pgbcpybi.dll
C:\WINDOWS\system32\iawqogus.dll
C:\WINDOWS\system32\sklbdwat.dll
C:\WINDOWS\system32\vputtocl.dll
C:\WINDOWS\system32\xsvkkntc.dll

Folder::
C:\VundoFix Backups

Registry::
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{103F0C2A-516D-46FF-B3DF-6EB94A4C57F9}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{1040F744-202E-4331-B6E8-89993D6A7657}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{227ADE7C-5B39-4F40-BC1E-9EAD8E8203E3}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{3095D50F-F1BA-4BBC-A54D-819EEB7E0898}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{514A5C49-0C7D-42c3-A71B-38864A269B7A}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{7F8AD45B-59ED-46F6-AB00-884241D81248}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{88FBD27C-1A79-4410-8224-523C40ECE694}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{9CCE1F4D-07F4-4C16-909B-82028DD89B21}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{ABDEF3AE-052E-4846-8860-8206AC1F3383}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{aef7ac82-b408-4fc3-9909-22b12b4e5f3f}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{D8DAA57A-3087-42FE-9298-E16A2961B460}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{E369262C-A737-4812-93F5-3E0763DED706}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F4057D43-249D-42CB-B459-8CB0AA930AFD}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{F5A7959F-A7DF-4889-95A8-B5FDB712F9C8}]
[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FFB6FFF1-237A-4EDF-93A3-AE66E65FDA45}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"b5145006"=-
    Save this as "CFScript.txt"

    Then drag the CFScript.txt into ComboFix.exe as you see in the screenshot below.


    This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log.

    & a new KASPERSKY ONLINE SCANNER REPORT

    steam
    MICROSOFT MVP - Security 2004/9 .member of ASAP since 2004 - member of U.N.I.T.E
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules