Page 1 of 2 12 LastLast
Results 1 to 10 of 17

Thread: Virtumonde help please!

  1. #1
    Junior Member alliegintha703's Avatar
    Join Date
    Jun 2008
    Posts
    8

    Question Virtumonde help please!

    A few problems:
    -Windows Security Center says automatic updates are off, but won't turn them on. When I go into the system properties, it says they are on.
    -Firefox won't open or load websites, IE does but with many popups.
    -Spybot repeatedly fnds Virtumonde and Virtumonde.dll even after removing. I scanned several times in safe mode as well but it still never disappeared.


    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:58:46 PM, on 6/12/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
    C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
    C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
    C:\Program Files\Viewpoint\Common\ViewpointService.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\zHotkey.exe
    C:\Program Files\Digital Media Reader\shwiconem.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\QuickTime\QTTask.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
    C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.emachines.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: (no name) - {3CA60057-9277-49C0-8D64-280DBAD9C3E1} - C:\WINDOWS\system32\iifFuvur.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {764A95ED-CBF9-45B4-870C-D51795263392} - C:\WINDOWS\system32\ddcbbyXq.dll (file missing)
    O2 - BHO: {2e1573e6-0430-4059-9a64-d62b899d0f8b} - {b8f0d998-b26d-46a9-9504-03406e3751e2} - C:\WINDOWS\system32\mrhiidjo.dll
    O2 - BHO: (no name) - {FE1E5D43-5E7B-43E3-8BDA-BE81EAA79BDC} - C:\WINDOWS\system32\pmnkLDvU.dll (file missing)
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
    O4 - HKLM\..\Run: [ShowWnd] ShowWnd.exe
    O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
    O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
    O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
    O4 - HKLM\..\Run: [BM3fcc04a5] Rundll32.exe "C:\WINDOWS\system32\brnpegbm.dll",s
    O4 - HKLM\..\RunOnce: [Spybot - Search & Destroy] "C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe" /autocheck
    O4 - HKLM\..\RunOnce: [SpybotDeletingA6330] command /c del "C:\WINDOWS\system32\ddcbbyXq.dll_old"
    O4 - HKLM\..\RunOnce: [SpybotDeletingC5] cmd /c del "C:\WINDOWS\system32\ddcbbyXq.dll_old"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: run_startmenu.cmd
    O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O20 - Winlogon Notify: iifFuvur - C:\WINDOWS\SYSTEM32\iifFuvur.dll
    O23 - Service: Adobe Version Cue CS3 - Unknown owner - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe (file missing)
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
    O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

    --
    End of file - 8048 bytes

  2. #2
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    Hi alliegintha703

    1. Download combofix from any of these links and save it to Desktop:
    Link 1
    Link 2
    Link 3

    **Note: It is important that it is saved directly to your desktop**

    2. Double click combofix.exe & follow the prompts.
    3. When finished, it shall produce a log for you (C:\ComboFix.txt). Post that log in your next reply

    Note:
    Do not mouseclick combofix's window whilst it's running. That may cause it to stall

    Combofix should never take more that 20 minutes including the reboot if malware is detected.
    If it does, open Task Manager then Processes tab (press ctrl, alt and del at the same time) and end any processes of findstr, find, sed or swreg, then combofix should continue.
    If that happened we want to know, and also what process you had to end.

    If you have problems with Combofix usage, see here

    Post:

    - a fresh HijackThis log
    - combofix report
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006

  3. #3
    Junior Member alliegintha703's Avatar
    Join Date
    Jun 2008
    Posts
    8

    Default

    ComboFix 08-06-12.2 - Owner 2008-06-14 12:08:11.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.1252.1.1033.18.431 [GMT -4:00]
    Running from: C:\Documents and Settings\Owner\Desktop\ComboFix.exe
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    C:\WINDOWS\BM3fcc04a5.xml
    C:\WINDOWS\pskt.ini
    C:\WINDOWS\system32\awtsQHWq.dll
    C:\WINDOWS\system32\brnpegbm.dll
    C:\WINDOWS\system32\cbXRHApN.dll
    C:\WINDOWS\system32\iifFuvur.dll
    C:\WINDOWS\system32\mcrh.tmp
    C:\WINDOWS\system32\mrhiidjo.dll
    C:\WINDOWS\system32\NpAHRXbc.ini
    C:\WINDOWS\system32\NpAHRXbc.ini2
    C:\WINDOWS\system32\qufgvues.dll
    C:\WINDOWS\system32\qXybbcdd.ini
    C:\WINDOWS\system32\qXybbcdd.ini2
    C:\WINDOWS\system32\seuvgfuq.ini
    C:\WINDOWS\system32\ssnackdt.dll
    C:\WINDOWS\system32\UvDLknmp.ini
    C:\WINDOWS\system32\UvDLknmp.ini2
    D:\Autorun.inf

    .
    ((((((((((((((((((((((((( Files Created from 2008-05-14 to 2008-06-14 )))))))))))))))))))))))))))))))
    .

    2008-06-12 21:58 . 2008-06-12 21:58 <DIR> d-------- C:\Program Files\Trend Micro
    2008-06-12 18:16 . 2004-08-27 05:54 <DIR> d-------- C:\Documents and Settings\Administrator\WINDOWS
    2008-06-12 18:16 . 2008-06-03 01:01 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\SampleView
    2008-06-12 18:16 . 2008-06-03 01:03 <DIR> d-------- C:\Documents and Settings\Administrator\Application Data\McAfee
    2008-06-12 18:16 . 2008-06-12 18:16 <DIR> d-------- C:\Documents and Settings\Administrator
    2008-06-12 18:12 . 2008-06-12 21:49 382 --a------ C:\WINDOWS\wininit.ini
    2008-06-11 22:09 . 2008-06-12 17:47 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
    2008-06-11 22:09 . 2008-06-12 18:13 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
    2008-06-11 22:03 . 2008-06-11 22:03 <DIR> d-------- C:\Program Files\Lavasoft
    2008-06-11 22:03 . 2008-06-12 15:55 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Lavasoft
    2008-06-11 12:40 . 2008-06-12 15:55 <DIR> d-------- C:\Program Files\Windows Desktop Search
    2008-06-11 00:29 . 2008-06-11 00:29 <DIR> d-------- C:\Program Files\MSBuild
    2008-06-11 00:17 . 2008-06-12 15:58 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Microsoft Help
    2008-06-11 00:15 . 2008-06-11 00:15 <DIR> d-------- C:\MSOCache
    2008-06-10 23:40 . 2008-06-12 17:36 <DIR> d-------- C:\Program Files\MagicISO
    2008-06-10 18:05 . 2008-06-10 18:05 <DIR> d-------- C:\Program Files\Common Files\Control Panels
    2008-06-10 18:02 . 2008-06-10 18:02 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\ALM
    2008-06-10 12:43 . 2008-06-10 12:43 <DIR> d-------- C:\Program Files\Snes9x
    2008-06-10 12:43 . 2008-06-10 12:43 216,064 --a------ C:\WINDOWS\iun3405.exe
    2008-06-10 09:19 . 2008-06-10 09:19 0 --a------ C:\WINDOWS\VPC32.INI
    2008-06-09 17:53 . 2008-06-09 17:53 <DIR> d-------- C:\Program Files\Symantec_Client_Security
    2008-06-09 17:53 . 2008-06-09 17:52 124,167 --a------ C:\WINDOWS\system32\SYMEVNT.386
    2008-06-09 17:53 . 2008-06-09 17:52 83,208 --a------ C:\WINDOWS\system32\S32EVNT1.DLL
    2008-06-09 17:53 . 2008-06-09 17:52 73,496 --a------ C:\WINDOWS\system32\drivers\SYMEVENT.SYS
    2008-06-09 17:12 . 2008-06-09 17:12 <DIR> d-------- C:\Program Files\Windows Installer Clean Up
    2008-06-09 17:12 . 2008-06-09 17:12 <DIR> d-------- C:\Program Files\MSECACHE
    2008-06-09 16:53 . 2008-06-09 16:53 <DIR> d-------- C:\Program Files\Bonjour
    2008-06-09 16:48 . 2008-06-09 16:48 <DIR> d-------- C:\Program Files\Common Files\Macrovision Shared
    2008-06-07 23:23 . 2008-06-09 17:39 <DIR> d-------- C:\WINDOWS\SxsCaPendDel
    2008-06-07 23:15 . 2008-06-07 23:15 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\FLEXnet
    2008-06-07 17:48 . 2008-06-07 17:48 <DIR> d-------- C:\WINDOWS\system32\LogFiles
    2008-06-07 13:52 . 2008-06-07 13:52 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Ahead
    2008-06-06 22:12 . 2007-02-20 16:04 2,463,976 --a------ C:\WINDOWS\system32\NPSWF32.dll
    2008-06-06 22:12 . 2007-02-20 16:04 190,696 --a------ C:\WINDOWS\system32\NPSWF32_FlashUtil.exe
    2008-06-05 14:48 . 2008-06-05 14:48 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Media Player Classic
    2008-06-05 14:45 . 2008-06-05 14:48 49 --a------ C:\WINDOWS\NeroDigital.ini
    2008-06-05 14:40 . 2008-06-10 18:08 <DIR> d-------- C:\Program Files\Common Files\Adobe
    2008-06-04 21:49 . 2008-06-04 21:49 <DIR> d-------- C:\WINDOWS\Sun
    2008-06-04 21:46 . 2008-06-12 15:58 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\uTorrent
    2008-06-04 21:09 . 2008-06-04 21:09 376 --a------ C:\WINDOWS\ODBC.INI
    2008-06-04 21:07 . 2008-06-11 00:55 <DIR> d-------- C:\WINDOWS\ShellNew
    2008-06-04 21:06 . 2008-06-04 21:06 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Microsoft Web Folders
    2008-06-04 06:27 . 2008-03-01 09:06 6,066,176 --a--c--- C:\WINDOWS\system32\dllcache\ieframe.dll
    2008-06-04 06:27 . 2007-04-17 05:32 2,455,488 --a--c--- C:\WINDOWS\system32\dllcache\ieapfltr.dat
    2008-06-04 06:27 . 2007-03-08 01:10 991,232 --a--c--- C:\WINDOWS\system32\dllcache\ieframe.dll.mui
    2008-06-04 06:27 . 2008-03-01 09:06 459,264 --a--c--- C:\WINDOWS\system32\dllcache\msfeeds.dll
    2008-06-04 06:27 . 2008-03-01 09:06 383,488 --a--c--- C:\WINDOWS\system32\dllcache\ieapfltr.dll
    2008-06-04 06:27 . 2008-03-01 09:06 267,776 --a--c--- C:\WINDOWS\system32\dllcache\iertutil.dll
    2008-06-04 06:27 . 2008-03-01 09:06 63,488 --a--c--- C:\WINDOWS\system32\dllcache\icardie.dll
    2008-06-04 06:27 . 2008-03-01 09:06 52,224 --a--c--- C:\WINDOWS\system32\dllcache\msfeedsbs.dll
    2008-06-04 06:27 . 2008-02-22 06:00 13,824 --a--c--- C:\WINDOWS\system32\dllcache\ieudinit.exe
    2008-06-04 03:00 . 2008-06-04 17:48 <DIR> d--h----- C:\WINDOWS\$hf_mig$
    2008-06-04 03:00 . 2006-09-06 17:43 22,752 --a------ C:\WINDOWS\system32\spupdsvc.exe
    2008-06-03 23:07 . 2008-06-03 23:07 <DIR> d-------- C:\Program Files\XBCD
    2008-06-03 23:06 . 2008-06-03 23:06 <DIR> d-------- C:\Program Files\K-Lite Codec Pack
    2008-06-03 23:05 . 2008-06-03 23:05 <DIR> d-------- C:\Program Files\BitPim
    2008-06-03 23:04 . 2008-06-03 23:04 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\acccore
    2008-06-03 02:11 . 2008-06-03 23:05 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AOL OCP
    2008-06-03 02:10 . 2008-06-03 23:04 <DIR> d-------- C:\Program Files\AIM6
    2008-06-03 01:47 . 2008-06-03 01:47 <DIR> d-------- C:\Program Files\iTunes
    2008-06-03 01:47 . 2008-06-03 01:47 <DIR> d-------- C:\Program Files\iPod
    2008-06-03 01:47 . 2008-06-10 18:47 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\Apple Computer
    2008-06-03 01:47 . 2008-06-14 12:18 54,156 --ah----- C:\WINDOWS\QTFont.qfn
    2008-06-03 01:47 . 2008-06-03 01:47 1,409 --a------ C:\WINDOWS\QTFont.for
    2008-06-03 01:46 . 2008-06-03 01:46 <DIR> d----c--- C:\WINDOWS\system32\DRVSTORE
    2008-06-03 01:46 . 2008-06-03 01:47 <DIR> d-------- C:\Program Files\QuickTime
    2008-06-03 01:46 . 2008-06-03 01:46 <DIR> d-------- C:\Program Files\Common Files\Apple
    2008-06-03 01:46 . 2008-06-03 01:46 <DIR> d-------- C:\Program Files\Apple Software Update
    2008-06-03 01:46 . 2008-06-03 01:47 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple Computer
    2008-06-03 01:46 . 2008-06-03 01:46 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Apple
    2008-06-03 01:20 . 2008-06-03 01:20 2 --a------ C:\WINDOWS\msoffice.ini
    2008-06-03 01:11 . 2004-08-27 05:54 <DIR> d-------- C:\WINDOWS\system32\config\systemprofile\WINDOWS
    2008-06-03 01:11 . 2004-08-27 05:54 <DIR> d-------- C:\Documents and Settings\Default User\WINDOWS
    2008-06-03 01:06 . 2008-06-03 01:06 8,192 --a------ C:\WINDOWS\REGLOCS.OLD
    2008-06-03 01:04 . 2008-06-03 01:04 333 --a------ C:\WINDOWS\system32\$ncsp$.inf
    2008-06-03 01:04 . 2008-06-03 01:04 0 --a------ C:\WINDOWS\system32\emachines_T6212__.MRK
    2008-06-03 01:03 . 2008-06-03 01:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee.com
    2008-06-03 01:03 . 2008-06-03 01:03 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\McAfee
    2008-06-03 01:03 . 2004-08-04 15:00 221,184 --a------ C:\WINDOWS\system32\wmpns.dll
    2008-06-03 01:02 . 2006-06-14 04:47 6,400 --a------ C:\WINDOWS\system32\drivers\splitter.sys
    2008-06-03 01:02 . 2006-06-14 04:47 6,400 --a--c--- C:\WINDOWS\system32\dllcache\splitter.sys
    2008-06-03 01:01 . 2008-06-03 01:01 <DIR> d-------- C:\Program Files\ATI Technologies
    2008-06-03 01:01 . 2008-06-03 01:01 <DIR> d-------- C:\Documents and Settings\Owner\Application Data\SampleView
    2008-06-03 01:00 . 2004-07-15 17:08 471,300 --a------ C:\WINDOWS\wallpe.exe
    2008-06-03 01:00 . 2003-03-25 08:00 67,072 --a------ C:\WINDOWS\POWERCFG.EXE
    2008-06-03 01:00 . 2004-04-22 20:48 30,056 --a------ C:\WINDOWS\system32\oemlogo.bmp
    2008-06-03 01:00 . 2004-09-03 19:07 20,480 --a------ C:\WINDOWS\system32\Marker32.exe
    2008-06-03 00:59 . 2008-06-03 00:59 <DIR> d-------- C:\Program Files\CyberLink
    2008-06-03 00:59 . 2008-06-03 00:59 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\CyberLink
    2008-06-03 00:58 . 2008-06-03 00:58 <DIR> d-------- C:\Program Files\Google
    2008-06-03 00:57 . 2008-06-03 00:57 <DIR> d-------- C:\WINDOWS\occache
    2008-06-03 00:57 . 2008-06-03 23:03 <DIR> d-------- C:\Program Files\Viewpoint
    2008-06-03 00:57 . 2008-06-03 00:57 <DIR> d-------- C:\Program Files\Pure Networks
    2008-06-03 00:57 . 2008-06-03 00:57 <DIR> d-------- C:\Program Files\Learn2.com
    2008-06-03 00:57 . 2008-06-03 00:57 <DIR> d-------- C:\Program Files\Common Files\Ahead
    2008-06-03 00:57 . 2008-06-03 00:58 <DIR> d-------- C:\Program Files\Ahead
    2008-06-03 00:57 . 2008-06-03 02:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Viewpoint
    2008-06-03 00:57 . 2008-06-03 00:57 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Pure Networks
    2008-06-03 00:55 . 2008-06-03 00:55 <DIR> d-------- C:\Program Files\Common Files\Nullsoft
    2008-06-03 00:55 . 2008-06-03 00:55 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\QuickTime
    2008-06-03 00:54 . 2008-06-03 00:54 <DIR> d-------- C:\Program Files\Real
    2008-06-03 00:54 . 2008-06-03 00:54 <DIR> d-------- C:\Program Files\Common Files\Real
    2008-06-03 00:54 . 2008-06-03 01:26 <DIR> d-------- C:\Program Files\Common Files\aolshare
    2008-06-03 00:54 . 2008-06-03 00:54 <DIR> d-------- C:\My Music
    2008-06-03 00:54 . 2008-06-03 02:11 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\AOL
    2008-06-03 00:52 . 2008-06-03 02:11 <DIR> d-------- C:\Program Files\Common Files\AOL
    2008-06-03 00:52 . 2008-06-03 00:52 335 --a------ C:\WINDOWS\nsreg.dat
    2008-06-03 00:51 . 2008-06-03 00:51 <DIR> d-------- C:\WINDOWS\Downloaded Installations
    2008-06-03 00:51 . 2008-06-03 00:51 <DIR> d-------- C:\Program Files\Java
    2008-06-03 00:51 . 2008-06-03 00:51 <DIR> d-------- C:\Program Files\Digital Media Reader
    2008-06-03 00:51 . 2008-06-03 00:51 <DIR> d-------- C:\Program Files\Common Files\Java
    2008-06-03 00:51 . 2008-06-03 00:51 53,352 --a------ C:\WINDOWS\system32\jpicpl32.cpl
    2008-06-03 00:45 . 2008-06-09 17:53 <DIR> d-------- C:\Program Files\Symantec
    2008-06-03 00:45 . 2008-06-03 01:02 <DIR> d--h----- C:\Program Files\InstallShield Installation Information
    2008-06-03 00:45 . 2008-06-09 17:53 <DIR> d-------- C:\Program Files\Common Files\Symantec Shared
    2008-06-03 00:45 . 2008-06-03 00:51 <DIR> d-------- C:\Program Files\Common Files\InstallShield
    2008-06-03 00:45 . 2008-06-09 17:53 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Symantec
    2008-06-03 00:45 . 2004-05-17 21:30 543,232 --a------ C:\WINDOWS\zHotkey.exe
    2008-06-03 00:45 . 2003-05-26 22:19 532,544 --a------ C:\WINDOWS\PIC.dll
    2008-06-03 00:45 . 2003-09-19 12:09 36,864 --a------ C:\WINDOWS\ShowWnd.exe
    2008-06-03 00:45 . 2001-07-02 23:36 24,576 --a------ C:\WINDOWS\HKNTDLL.dll
    2008-06-03 00:45 . 2000-08-07 14:57 5,280 --a------ C:\WINDOWS\hotbtnv.vxd
    2008-06-03 00:45 . 2003-05-29 21:56 3,927 --a------ C:\WINDOWS\mHotkey.reg
    2008-06-03 00:41 . 2008-06-03 00:41 <DIR> d-------- C:\Program Files\Common Files\New Boundary
    2008-06-03 00:41 . 2008-06-03 00:41 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Prism Deploy

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2008-06-05 01:06 --------- d-----w C:\Program Files\microsoft frontpage
    2008-06-03 04:54 8,552 ----a-w C:\WINDOWS\system32\drivers\asctrm.sys
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{764A95ED-CBF9-45B4-870C-D51795263392}]
    C:\WINDOWS\system32\ddcbbyXq.dll

    [HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{FE1E5D43-5E7B-43E3-8BDA-BE81EAA79BDC}]
    C:\WINDOWS\system32\pmnkLDvU.dll

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Aim6"="" []
    "ctfmon.exe"="C:\WINDOWS\system32\ctfmon.exe" [2004-08-04 15:00 15360]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "Recguard"="C:\WINDOWS\SMINST\RECGUARD.EXE" [2002-09-13 16:42 212992]
    "CHotkey"="zHotkey.exe" [2004-05-17 21:30 543232 C:\WINDOWS\zHotkey.exe]
    "ShowWnd"="ShowWnd.exe" [2003-09-19 12:09 36864 C:\WINDOWS\ShowWnd.exe]
    "SunKistEM"="C:\Program Files\Digital Media Reader\shwiconem.exe" [2004-11-15 18:04 135168]
    "NeroFilterCheck"="C:\WINDOWS\system32\NeroCheck.exe" [2001-07-09 14:50 155648]
    "SoundMan"="SOUNDMAN.EXE" [2004-11-15 15:20 77824 C:\WINDOWS\SOUNDMAN.EXE]
    "QuickTime Task"="C:\Program Files\QuickTime\QTTask.exe" [2008-03-28 23:37 413696]
    "RemoteControl"="C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe" [2003-10-31 22:42 32768]
    "ATIPTA"="C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe" [2004-11-12 00:10 344064]
    "iTunesHelper"="C:\Program Files\iTunes\iTunesHelper.exe" [2008-03-30 10:36 267048]
    "vptray"="C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe" [2003-05-21 01:21 90112]
    "Acrobat Assistant 8.0"="C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe" [2007-03-29 22:14 624248]
    "Adobe_ID0EYTHM"="C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE" [ ]

    C:\Documents and Settings\All Users\Start Menu\Programs\Startup\
    Microsoft Office.lnk - C:\Program Files\Microsoft Office\Office\OSA9.EXE [1999-02-17 23:05:56 65588]
    run_startmenu.cmd [2004-10-11 16:20:38 45]

    [HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
    "VIDC.YV12"= yv12vfw.dll

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "C:\\Program Files\\iTunes\\iTunes.exe"=
    "C:\\Program Files\\Common Files\\AOL\\Loader\\aolload.exe"=
    "C:\\Program Files\\AIM6\\aim6.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "3703:TCP"= 3703:TCP:Adobe Version Cue CS3 Server
    "3704:TCP"= 3704:TCP:Adobe Version Cue CS3 Server
    "50900:TCP"= 50900:TCP:Adobe Version Cue CS3 Server
    "50901:TCP"= 50901:TCP:Adobe Version Cue CS3 Server

    R1 vcdrom;Virtual CD-ROM Device Driver;C:\WINDOWS\system32\drivers\VCdRom.sys [2001-12-19 11:45]
    R2 Viewpoint Manager Service;Viewpoint Manager Service;"C:\Program Files\Viewpoint\Common\ViewpointService.exe" [2007-01-04 17:38]

    .
    Contents of the 'Scheduled Tasks' folder
    "2008-06-03 05:46:47 C:\WINDOWS\Tasks\AppleSoftwareUpdate.job"
    - C:\Program Files\Apple Software Update\SoftwareUpdate.exe
    "2008-06-03 05:11:12 C:\WINDOWS\Tasks\ISP signup reminder 3.job"
    - C:\WINDOWS\system32\OOBE\oobebaln.exe
    .
    **************************************************************************

    catchme 0.3.1361 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2008-06-14 12:16:56
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    PROCESS: C:\WINDOWS\system32\winlogon.exe
    -> C:\WINDOWS\system32\NavLogon.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    C:\WINDOWS\system32\ati2evxx.exe
    C:\WINDOWS\system32\ati2evxx.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
    C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
    C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
    C:\WINDOWS\system32\wdfmgr.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    .
    **************************************************************************
    .
    Completion time: 2008-06-14 12:29:09 - machine was rebooted
    ComboFix-quarantined-files.txt 2008-06-14 16:28:12

    Pre-Run: 14,027,948,032 bytes free
    Post-Run: 14,467,481,600 bytes free

    246 --- E O F --- 2008-06-05 00:27:13



    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 12:33:25 PM, on 6/14/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16640)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
    C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
    C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
    C:\WINDOWS\zHotkey.exe
    C:\Program Files\Viewpoint\Common\ViewpointService.exe
    C:\Program Files\Digital Media Reader\shwiconem.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\QuickTime\QTTask.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
    C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    C:\WINDOWS\system32\wuauclt.exe
    C:\WINDOWS\explorer.exe
    C:\WINDOWS\system32\notepad.exe
    C:\Program Files\internet explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.emachines.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {764A95ED-CBF9-45B4-870C-D51795263392} - C:\WINDOWS\system32\ddcbbyXq.dll (file missing)
    O2 - BHO: (no name) - {FE1E5D43-5E7B-43E3-8BDA-BE81EAA79BDC} - C:\WINDOWS\system32\pmnkLDvU.dll (file missing)
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
    O4 - HKLM\..\Run: [ShowWnd] ShowWnd.exe
    O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
    O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
    O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: run_startmenu.cmd
    O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O23 - Service: Adobe Version Cue CS3 - Unknown owner - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe (file missing)
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
    O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

    --
    End of file - 7412 bytes

  4. #4
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    Hi

    Open HijackThis, click do a system scan only and checkmark these:

    O2 - BHO: (no name) - {764A95ED-CBF9-45B4-870C-D51795263392} - C:\WINDOWS\system32\ddcbbyXq.dll (file missing)
    O2 - BHO: (no name) - {FE1E5D43-5E7B-43E3-8BDA-BE81EAA79BDC} - C:\WINDOWS\system32\pmnkLDvU.dll (file missing)


    Close all windows including browser and press fix checked.

    Reboot.

    Please do an online scan with Kaspersky Online Scanner. You will be prompted to install an ActiveX component from Kaspersky, Click Yes.
    • The program will launch and then start to download the latest definition files.
    • Once the scanner is installed and the definitions downloaded, click Next.
    • Now click on Scan Settings
    • In the scan settings make sure that the following are selected:

      o Scan using the following Anti-Virus database:

      + Extended (If available otherwise Standard)

      o Scan Options:

      + Scan Archives
      + Scan Mail Bases
    • Click OK
    • Now under select a target to scan select My Computer
    • The scan will take a while so be patient and let it run. Once the scan is complete it will display if your system has been infected.
    • Please do not use your computer while the scan is running. Once the scan is complete it will display if your system has been infected.
    • Click the Save Report As... button (see red arrow below)
    • In the Save as... prompt, select Desktop
    • In the File name box, name the file KasScan-ddmmyy (or similar)
    • In the Save as type prompt, select Text file (see below)
    • Now click on the Save as Text button
    • Savethe file to your desktop.
    • Copy and paste that information in your next post.


    Note: This scanner will work with Internet Explorer Only! Keep ALL other programs closed during the scan

    Note for Internet Explorer 7 users: If at any time you have trouble with the accept button of the license, click on the Zoom tool located at the right bottom of the IE window and set the zoom to 75 %. Once the license accepted, reset to 100%.

    Post:

    - a fresh HijackThis log
    - kaspersky report
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006

  5. #5
    Junior Member alliegintha703's Avatar
    Join Date
    Jun 2008
    Posts
    8

    Default

    The first time I ran Kaspersky my computer decided to automatically restart when i wasnt home because of a "serious error" that occured after the scan had finished, so I had to do it all over again. 10 hours and 42 minutes later, I finally have a log. By the way, thanks for all the help!


    --------------------------------------------------------------------------------
    KASPERSKY ONLINE SCANNER 7 REPORT
    Sunday, June 15, 2008
    Operating System: Microsoft Windows XP Home Edition Service Pack 2 (build 2600)
    Kaspersky Online Scanner 7 version: 7.0.25.0
    Program database last update: Sunday, June 15, 2008 13:14:31
    Records in database: 867103
    --------------------------------------------------------------------------------

    Scan settings:
    Scan using the following database: extended
    Scan archives: yes
    Scan mail databases: yes

    Scan area - My Computer:
    C:\
    D:\
    E:\
    F:\
    G:\
    H:\
    I:\
    J:\

    Scan statistics:
    Files scanned: 141992
    Threat name: 6
    Infected objects: 17
    Suspicious objects: 0
    Duration of the scan: 10:41:50


    File name / Threat name / Threats count
    C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0C2C0000.VBN Infected: Trojan.Win32.Monder.oa 1
    C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0C2C0001.VBN Infected: Trojan.Win32.Monder.na 1
    C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0C2C0004.VBN Infected: Trojan.Win32.Monder.na 1
    C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0C2C0005.VBN Infected: Trojan.Win32.Monder.oa 1
    C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0C2C0006.VBN Infected: Trojan.Win32.Monder.nb 1
    C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0C2C0007.VBN Infected: Trojan.Win32.Monder.oa 1
    C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0C300000.VBN Infected: Trojan.Win32.Monder.nb 1
    C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0C300001.VBN Infected: Trojan-PSW.Win32.OnLineGames.apjl 1
    C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0C300002.VBN Infected: Trojan.Win32.Monder.nb 1
    C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0C300003.VBN Infected: Trojan.Win32.Monder.na 1
    C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0C9C0000.VBN Infected: Trojan.Win32.Monder.na 1
    C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0CA40000.VBN Infected: Trojan.Win32.Monder.nb 1
    C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\0CA40001.VBN Infected: Trojan.Win32.Monder.oa 1
    C:\Program Files\MagicISO\magic.iso.maker.v5.5.261-nope.exe Infected: Trojan.Win32.Monder.gen 1
    C:\QooBox\Quarantine\C\WINDOWS\system32\awtsQHWq.dll.vir Infected: Trojan.Win32.Monder.gen 1
    C:\QooBox\Quarantine\C\WINDOWS\system32\iifFuvur.dll.vir Infected: Trojan.Win32.Monder.gen 1
    C:\QooBox\Quarantine\C\WINDOWS\system32\ssnackdt.dll.vir Infected: Trojan.Win32.Monder.qg 1

    The selected area was scanned.



    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 9:33:10 PM, on 6/15/2008
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16674)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\zHotkey.exe
    C:\Program Files\Digital Media Reader\shwiconem.exe
    C:\WINDOWS\SOUNDMAN.EXE
    C:\Program Files\QuickTime\QTTask.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
    C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
    C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
    C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe
    C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
    C:\Program Files\Viewpoint\Common\ViewpointService.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    C:\WINDOWS\system32\wscntfy.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\internet explorer\iexplore.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.emachines.com/
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
    R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
    R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
    R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
    O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll
    O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Program Files\Adobe\/Adobe Contribute CS3/contributeieplugin.dll
    O4 - HKLM\..\Run: [Recguard] C:\WINDOWS\SMINST\RECGUARD.EXE
    O4 - HKLM\..\Run: [CHotkey] zHotkey.exe
    O4 - HKLM\..\Run: [ShowWnd] ShowWnd.exe
    O4 - HKLM\..\Run: [SunKistEM] C:\Program Files\Digital Media Reader\shwiconem.exe
    O4 - HKLM\..\Run: [NeroFilterCheck] C:\WINDOWS\system32\NeroCheck.exe
    O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime
    O4 - HKLM\..\Run: [RemoteControl] "C:\Program Files\CyberLink\PowerDVD\PDVDServ.exe"
    O4 - HKLM\..\Run: [ATIPTA] C:\Program Files\ATI Technologies\ATI Control Panel\atiptaxx.exe
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [vptray] C:\PROGRA~1\SYMANT~1\SYMANT~1\vptray.exe
    O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Program Files\Adobe\Acrobat 8.0\Acrobat\Acrotray.exe"
    O4 - HKLM\..\Run: [Adobe_ID0EYTHM] C:\PROGRA~1\COMMON~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre1.6.0_06\bin\jusched.exe"
    O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Global Startup: Microsoft Office.lnk = C:\Program Files\Microsoft Office\Office\OSA9.EXE
    O4 - Global Startup: run_startmenu.cmd
    O8 - Extra context menu item: Append to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert link target to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert link target to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert selected links to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
    O8 - Extra context menu item: Convert selected links to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
    O8 - Extra context menu item: Convert selection to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O8 - Extra context menu item: Convert selection to existing PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html
    O8 - Extra context menu item: Convert to Adobe PDF - res://C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.6.0_06\bin\ssv.dll
    O9 - Extra button: Real.com - {CD67F990-D8E9-11d2-98FE-00C0F0318AFE} - C:\WINDOWS\system32\Shdocvw.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} (Java Runtime Environment 1.6.0) - http://sdlc-esd.sun.com/ESD42/JSCDL/...ws-i586-jc.cab
    O23 - Service: Adobe Version Cue CS3 - Unknown owner - C:\Program Files\Common Files\Adobe\Adobe Version Cue CS3\Server\bin\VersionCueCS3.exe (file missing)
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ##Id_String1.6844F930_1628_4223_B5CC_5BB94B879762## (Bonjour Service) - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: DefWatch - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\DefWatch.exe
    O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Symantec AntiVirus Client (Norton AntiVirus Server) - Symantec Corporation - C:\PROGRA~1\SYMANT~1\SYMANT~1\Rtvscan.exe
    O23 - Service: PrismXL - New Boundary Technologies, Inc. - C:\Program Files\Common Files\New Boundary\PrismXL\PRISMXL.SYS
    O23 - Service: Viewpoint Manager Service - Viewpoint Corporation - C:\Program Files\Viewpoint\Common\ViewpointService.exe

    --
    End of file - 8069 bytes

  6. #6
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    Hi

    And we found out where it all started:

    C:\Program Files\MagicISO\magic.iso.maker.v5.5.261-nope.exe Infected: Trojan.Win32.Monder.gen 1

    Using pirated software is not only illegal but also very stupid as you can see.

    Uninstall via add/remove programs:

    MagicISO

    Delete this:

    C:\Program Files\MagicISO\

    Empty these folders:

    C:\Documents and Settings\All Users\Application Data\Symantec\Norton AntiVirus Corporate Edition\7.5\Quarantine\
    C:\QooBox\Quarantine\

    Empty Recycle Bin.

    Still problems?
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006

  7. #7
    Junior Member alliegintha703's Avatar
    Join Date
    Jun 2008
    Posts
    8

    Default

    Yeah I never actually used the program, I tried to uninstall it a few weeks ago from add/remove programs, but it always said that it couldn't because of a missing INSTALL.log file so I just left it. I deleted everything in the 2 folders but misosh.dll because it says "access is denied." It's not write-protected ad not in use as far as I can tell so I don't know what to do about that.

  8. #8
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    Hi

    You can try to delete that folder in safe mode.
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006

  9. #9
    Junior Member alliegintha703's Avatar
    Join Date
    Jun 2008
    Posts
    8

    Default

    That didn't work; I tried both the owner account and the administrator account and it still says the same thing.

  10. #10
    Security Expert: Emeritus
    Join Date
    Oct 2006
    Location
    Finland
    Posts
    29,374

    Default

    Hi

    Please download the OTMoveIt2 by OldTimer.
    • Save it to your desktop.
    • Please double-click OTMoveIt2.exe to run it. (Note: If you are running on Vista, right-click on the file and choose Run As Administrator).
    • Copy the lines in the codebox below to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose Copy):

      Code:
      C:\Program Files\MagicISO
    • Return to OTMoveIt2, right click in the "Paste List of Files/Folders to Move" window (under the light blue bar) and choose Paste.
    • Click the red Moveit! button.
    • Copy everything in the Results window (under the green bar) to the clipboard by highlighting ALL of them and pressing CTRL + C (or, after highlighting, right-click and choose copy), and paste it in your next reply.
    • Close OTMoveIt2

    Note: If a file or folder cannot be moved immediately you may be asked to reboot the machine to finish the move process. If you are asked to reboot the machine choose Yes. In this case, after the reboot, open Notepad (Start->All Programs->Accessories->Notepad), click File->Open, in the File Name box enter *.log and press the Enter key, navigate to the C:\_OTMoveIt\MovedFiles folder, and open the newest .log file present, and copy/paste the contents of that document back here in your next post.
    Microsoft MVP Consumer Security 2008-2011

    Member of ASAP and UNITE since 2006

Tags for this Thread

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •