Page 1 of 2 12 LastLast
Results 1 to 10 of 11

Thread: unable to remove virtumonde

  1. #1
    Junior Member
    Join Date
    Mar 2009
    Posts
    6

    Default unable to remove virtumonde

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 6:10:35 PM, on 3/17/2009
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16791)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    C:\WINDOWS\System32\svchost.exe
    c:\WINDOWS\system32\ZuneBusEnum.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Spybot - Search & Destroy\SpybotSD.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Documents and Settings\graham\Desktop\HiJackThis.exe

    O4 - HKLM\..\Run: [e4e5a998] rundll32.exe "C:\WINDOWS\system32\tonnmcwn.dll",b
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O15 - ESC Trusted Zone: http://*.update.microsoft.com
    O20 - AppInit_DLLs: flfnru.dll alzugh.dll qnuquo.dll
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

    --
    End of file - 3808 bytes

    sorry, i had tea timer running. let me post this again.

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 6:41:02 PM, on 3/17/2009
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16791)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    C:\Program Files\Alwil Software\Avast4\ashServ.exe
    C:\WINDOWS\Explorer.EXE
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\rundll32.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\WINDOWS\System32\svchost.exe
    c:\WINDOWS\system32\ZuneBusEnum.exe
    C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    O4 - HKLM\..\Run: [e4e5a998] rundll32.exe "C:\WINDOWS\system32\tonnmcwn.dll",b
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Restrictions present
    O6 - HKCU\Software\Policies\Microsoft\Internet Explorer\Control Panel present
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O15 - ESC Trusted Zone: http://*.update.microsoft.com
    O20 - AppInit_DLLs: flfnru.dll alzugh.dll qnuquo.dll
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: avast! iAVS4 Control Service (aswUpdSv) - ALWIL Software - C:\Program Files\Alwil Software\Avast4\aswUpdSv.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: avast! Antivirus - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashServ.exe
    O23 - Service: avast! Mail Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashMaiSv.exe
    O23 - Service: avast! Web Scanner - ALWIL Software - C:\Program Files\Alwil Software\Avast4\ashWebSv.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

    --
    End of file - 3598 bytes
    Last edited by tashi; 2009-03-18 at 01:48. Reason: merged two posts ;)

  2. #2
    In Memoriam -Always in our heart pskelley's Avatar
    Join Date
    Oct 2005
    Location
    Clearwater, Florida
    Posts
    20,247

    Default

    Welcome to Safer Networking, I wish to be sure you have viewed and understand this information.
    "BEFORE you POST" (READ this Procedure before Requesting Assistance) http://forums.spybot.info/showthread.php?t=288
    All advice given is taken at your own risk.
    Please make sure you have read this information so we are on the same page.

    Make sure you read and follow the directions, anything else will slow the process and waste both of our time. I suggest you keep this computer offline except when troubleshooting, the junk may download more. If you have any tool I use, delete it and download it new from the link I provide. Read and follow the directions carefully, the tools will not work unless you do.
    The junk can be tough to remove, so do not expect fast or easy.

    Pinned (sticky) to the top of this forum, and posted above are the directions, make sure you have read and followed them.

    1) Please DO NOT ENABLE Spybot S&D TeaTimer while we work together.

    2) A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own. This tool is not a toy and not for everyday use

    Download ComboFix from here:

    Link 1

    * IMPORTANT !!! Save ComboFix.exe to your Desktop

    • Disable your AntiVirus and AntiSpyware applications, usually via a right click on the System Tray icon. They may otherwise interfere with our tools
    • See this Link for programs that need to be disabled and instruction on how to disable them.
    • Remember to re-enable them when we're done.

    • Double click on ComboFix.exe & follow the prompts.
    • As part of it's process, ComboFix will check to see if the Microsoft Windows Recovery Console is installed. With malware infections being as they are today, it's strongly recommended to have this pre-installed on your machine before doing any malware removal. It will allow you to boot up into a special recovery/repair mode that will allow us to more easily help you should your computer have a problem after an attempted removal of malware.
    • Follow the prompts to allow ComboFix to download and install the Microsoft Windows Recovery Console, and when prompted, agree to the End-User License Agreement to install the Microsoft Windows Recovery Console.


    **Please note: If the Microsoft Windows Recovery Console is already installed, ComboFix will continue it's malware removal procedures.


    Once the Microsoft Windows Recovery Console is installed using ComboFix, you should see the following message:

    Click on Yes, to continue scanning for malware.

    When finished, it shall produce a log for you. Please include the C:\ComboFix.txt in your next reply along with a New Hijackthis log.

    *If there is no internet connection when Combofix has completely finished then restart your computer to restore back the connections.

    Tutorial if needed
    http://www.bleepingcomputer.com/comb...o-use-combofix

    3) Post also an uninstall list: Open Hijackthis.
    Click the "Open the Misc Tools" section Button.
    Click the "Open Uninstall Manager" Button.
    Click the "Save list..." Button.
    Save it to your desktop. Copy and paste the contents into your reply.
    (You may edit out Microsoft, Hotfixes, Security Update for Windows XP,
    Update for Windows XP and Windows XP Hotfix to shorten the list
    )
    Image: http://img.bleepingcomputer.com/tuto...nstall-man.jpg

    Thanks
    MS-MVP Consumer Security 2007-08-09
    Proud Member ASAP
    UNITE Member 2006

  3. #3
    Junior Member
    Join Date
    Mar 2009
    Posts
    6

    Default

    it did not bring up any prompt regarding microsoft recovery console yet in the report it says i do not have it installed. it went right into its scan.

    ################combofix#########################

    ComboFix 09-03-15.01 - graham 2009-03-18 16:53:55.1 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.932.81.1033.18.741.362 [GMT -5:00]
    Running from: c:\documents and settings\graham\Desktop\ComboFix.exe
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\docume~1\graham\LOCALS~1\Temp\tmp1.tmp
    c:\docume~1\graham\LOCALS~1\Temp\tmp2.tmp
    c:\program files\INSTALL.LOG
    c:\windows\AppPatch\Custom\{deb7008b-681e-4a4a-8aae-cc833e8216ce}.sdb
    c:\windows\system32\alzugh.dll
    c:\windows\system32\awupenpe.dll
    c:\windows\system32\bjoynatv.dll
    c:\windows\system32\bqrtme.dll
    c:\windows\system32\cauufh.dll
    c:\windows\system32\cisuvc.dll
    c:\windows\system32\cvwlht.dll
    c:\windows\system32\eLononpo.ini
    c:\windows\system32\eLononpo.ini2
    c:\windows\system32\ewlrvc.dll
    c:\windows\system32\fiyldxub.dll
    c:\windows\system32\flfnru.dll
    c:\windows\system32\gbusqcdy.dll
    c:\windows\system32\gcexjwpe.dll
    c:\windows\system32\gkyttj.dll
    c:\windows\system32\gtjvxfix.dll
    c:\windows\system32\hfgjbnmk.dll
    c:\windows\system32\hrnzzj.dll
    c:\windows\system32\hsneac.dll
    c:\windows\system32\igqtym.dll
    c:\windows\system32\iguuke.dll
    c:\windows\system32\ildmwlkd.dll
    c:\windows\system32\iuhykwxh.dll
    c:\windows\system32\ivhcugux.dll
    c:\windows\system32\jbkipskr.dll
    c:\windows\system32\klwvvkrp.dll
    c:\windows\system32\knghljqw.dll
    c:\windows\system32\ktijpg.dll
    c:\windows\system32\kxvmihom.dll
    c:\windows\system32\mbedjnyw.dll
    c:\windows\system32\mmbkub.dll
    c:\windows\system32\mupoigku.dll
    c:\windows\system32\ncxqihum.dll
    c:\windows\system32\nmhapm.dll
    c:\windows\system32\noccqbju.dll
    c:\windows\system32\opnonoLe.dll
    c:\windows\system32\padwtc.dll
    c:\windows\system32\qnuquo.dll
    c:\windows\system32\slxdbmyf.dll
    c:\windows\system32\szqptz.dll
    c:\windows\system32\tmoptjiu.dll
    c:\windows\system32\tonnmcwn.dll
    c:\windows\system32\tqffya.dll
    c:\windows\system32\trrvcuns.dll
    c:\windows\system32\tuhbov.dll
    c:\windows\system32\twfnbx.dll
    c:\windows\system32\vrqcwlcu.dll
    c:\windows\system32\wedpkl.dll
    c:\windows\system32\wgbfwz.dll
    c:\windows\system32\xcgpyovc.dll
    c:\windows\system32\xcntarld.dll
    c:\windows\system32\xfittnbo.dll
    c:\windows\system32\xmbume.dll
    c:\windows\system32\yqxytoca.dll
    D:\Autorun.inf

    .
    ((((((((((((((((((((((((( Files Created from 2009-02-18 to 2009-03-18 )))))))))))))))))))))))))))))))
    .

    2009-03-18 11:37 . 2009-03-18 11:59 1,788,578 --ahs---- c:\windows\system32\wqjlhgnk.ini
    2009-03-17 23:37 . 2009-03-17 23:59 1,740,870 --ahs---- c:\windows\system32\xifxvjtg.ini
    2009-03-17 18:40 . 2009-03-17 18:40 <DIR> d-------- c:\program files\Trend Micro
    2009-03-17 18:08 . 2009-03-17 18:08 <DIR> d-------- c:\program files\ERUNT
    2009-03-17 17:25 . 2009-03-17 17:25 121 --ahs---- c:\windows\system32\nwcmnnot.ini
    2009-03-15 14:29 . 2009-03-16 17:24 269 --a------ c:\windows\wininit.ini
    2009-03-15 13:58 . 2009-03-15 13:58 <DIR> d-------- c:\program files\TeaTimer (Spybot - Search & Destroy)
    2009-03-15 13:58 . 2009-03-15 13:58 <DIR> d-------- c:\program files\SDHelper (Spybot - Search & Destroy)
    2009-03-15 13:58 . 2009-03-15 13:58 <DIR> d-------- c:\program files\Misc. Support Library (Spybot - Search & Destroy)
    2009-03-15 13:58 . 2009-03-15 13:58 <DIR> d-------- c:\program files\File Scanner Library (Spybot - Search & Destroy)
    2009-02-28 13:47 . 2009-02-28 13:47 <DIR> d--h----- c:\windows\PIF

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-03-16 00:33 --------- d-----w c:\program files\ATI Technologies
    2009-03-15 23:03 --------- d-----w c:\program files\World of Warcraft
    2009-03-15 19:06 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2009-03-15 19:02 --------- d-----w c:\program files\Spybot - Search & Destroy
    2009-02-07 18:52 --------- d-----w c:\program files\CDKnet
    2009-02-01 19:10 0 ---ha-w c:\windows\system32\drivers\MsftWdf_user_01_07_00.Wdf
    2009-02-01 19:10 0 ---ha-w c:\windows\system32\drivers\Msft_User_ZuneDriver_01_07_00.Wdf
    2009-02-01 19:10 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_WinUSB_01007.Wdf
    2009-02-01 16:14 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
    2009-02-01 16:14 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_zumbus_01007.Wdf
    2009-02-01 16:14 --------- d-----w c:\program files\Zune
    2007-05-25 18:10 3,918,123,008 -c--a-w c:\program files\schoolmate.iso
    2007-05-25 04:01 105 -c--a-w c:\program files\HentaiShare!.URL
    2007-05-21 22:14 7,364 -c--a-w c:\program files\[HentaiShare].Schoolmate.nfo
    2006-09-27 21:55 7,139 -c--a-w c:\program files\[HentaiShare].Sexy.Beach.3.nfo
    2006-09-27 21:41 3,191,007,232 -c--a-w c:\program files\[HentaiShare].Sexy.Beach.3.DeathMarine.iso
    2006-09-27 20:54 509 -c--a-w c:\program files\file_id.diz
    2006-06-23 02:29 48 -c--a-w c:\program files\HentaiShare.URL
    2006-02-18 00:00 3,027 -c--a-w c:\program files\install_wizard.log
    2006-02-18 00:00 24 -c--a-w c:\program files\defaults.ini
    2006-02-18 00:00 24 -c--a-w c:\program files\components.ini
    2006-02-18 00:00 1,696 -c--a-w c:\program files\install_status.log
    2004-12-13 02:13 208,896 -c--a-w c:\documents and settings\graham\3DAnalyze.exe
    2004-12-11 04:44 90,112 -c--a-w c:\documents and settings\graham\hook_3DA.dll
    2004-12-11 04:44 52,736 -c--a-w c:\documents and settings\graham\ForceDLL.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]

    c:\documents and settings\graham\Start Menu\Programs\Startup\
    ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
    @="Driver"

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
    "WMPNSCFG"=c:\program files\Windows Media Player\WMPNSCFG.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
    "Alcmtr"=ALCMTR.EXE
    "Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe"
    "e4e5a998"=rundll32.exe "c:\windows\system32\tonnmcwn.dll",b

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\NeverwinterNights\\NWN\\nwmain.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "c:\\Program Files\\windows media player\\wmplayer.exe"=
    "c:\\Program Files\\CCP\\EVE\\eve.exe"=
    "c:\\StubInstaller.exe"=
    "c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
    "c:\\Program Files\\Sierra\\FEAR\\fpupdate.exe"=
    "c:\\Program Files\\Sierra\\FEAR\\FEAR.exe"=
    "c:\\Program Files\\Sierra\\FEAR\\FEARMP.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\WINDOWS\\system32\\dpvsetup.exe"=
    "c:\\Program Files\\World of Warcraft\\WoW-2.0.3-enUS-downloader.exe"=
    "c:\\Program Files\\World of Warcraft\\WoW-2.0.3.6299-to-2.0.6.6337-enUS-downloader.exe"=
    "c:\\Program Files\\World of Warcraft\\WoW-2.0.6.6337-to-2.0.7.6383-enUS-downloader.exe"=
    "c:\\Program Files\\World of Warcraft\\WoW-2.0.7.6383-to-2.0.8.6403-enUS-downloader.exe"=
    "c:\\Program Files\\World of Warcraft\\WoW-2.0.3.6299-to-2.0.7.6383-enUS-downloader.exe"=
    "c:\\Program Files\\World of Warcraft\\WoW-2.0.8.6403-to-2.0.10.6448-enUS-downloader.exe"=
    "c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=
    "c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"=
    "c:\\Program Files\\World of Warcraft\\Launcher.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "26000:TCP"= 26000:TCP:eve
    "3724:TCP"= 3724:TCP:Blizzard Downloader
    "6122:TCP"= 6122:TCP:Blizzard Downloader

    S3 ZD1211U(WLAN);IEEE 802.11g USB Wireless LAN Driver(WLAN);c:\windows\system32\drivers\ZD1211U.sys [2006-07-02 273408]
    S3 ZDBRGSYS;ZDBRGSYS NDIS Protocol Driver;c:\windows\system32\ZDBRGSYS.sys [2006-07-02 19200]
    .
    Contents of the 'Scheduled Tasks' folder

    2009-03-13 c:\windows\Tasks\1-Click Maintenance.job
    - c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe []

    2009-03-14 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 17:57]
    .
    - - - - ORPHANS REMOVED - - - -

    BHO-{131C3BCA-3004-47F8-8F1F-C083E4AF416E} - c:\windows\system32\opnonoLe.dll
    BHO-{c9156c43-62d2-4ad7-b119-40b255d9d64c} - c:\windows\system32\iguuke.dll
    Notify-fccdcBQK - (no file)
    Notify-WgaLogon - (no file)


    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com/
    FF - ProfilePath - c:\documents and settings\graham\Application Data\Mozilla\Firefox\Profiles\32o48mct.default\
    FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava11.dll
    FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava12.dll
    FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava13.dll
    FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava14.dll
    FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJava32.dll
    FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPJPI150_06.dll
    FF - plugin: c:\program files\Java\jre1.5.0_06\bin\NPOJI610.dll
    FF - plugin: c:\program files\Mozilla Firefox\plugins\npitunes.dll

    ---- FIREFOX POLICIES ----
    FF - user.js: network.http.max-persistent-connections-per-server - 4
    FF - user.js: content.max.tokenizing.time - 200000
    FF - user.js: content.notify.interval - 100000
    FF - user.js: content.switch.threshold - 650000
    FF - user.js: nglayout.initialpaint.delay - 300
    .

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-03-18 17:00:17
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_USERS\S-1-5-21-268331592-2039796729-2405960755-1006\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
    "?慴"=hex:64,32,ac,09,ac,84,7b,0f,5c,ee,ae,b3,8f,fc,89,89,e2,57,97,c1,7c,3f,f9,
    0a,9a,6d,54,d1,3e,1d,c0,a1,b2,f9,8d,e5,54,9f,a6,3b,4d,54,55,eb,be,b5,0c,a4,\
    "?祥"=hex:34,19,4e,73,69,48,98,52,d8,19,07,9a,7f,e3,aa,f0
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\windows\system32\ati2evxx.exe
    c:\windows\system32\conime.exe
    c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    c:\windows\system32\ZuneBusEnum.exe
    .
    **************************************************************************
    .
    Completion time: 2009-03-18 17:04:47 - machine was rebooted [graham]
    ComboFix-quarantined-files.txt 2009-03-18 22:04:26

    Pre-Run: 69,835,366,400 bytes free
    Post-Run: 69,755,793,408 bytes free

    218 --- E O F --- 2009-02-26 09:00:47

    ###################new hijackthis log##################

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 5:14:57 PM, on 3/18/2009
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16791)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\WINDOWS\system32\conime.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\WINDOWS\System32\svchost.exe
    c:\WINDOWS\system32\ZuneBusEnum.exe
    C:\WINDOWS\system32\ctfmon.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    O2 - BHO: AcroIEHlprObj Class - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Adobe\Acrobat 6.0\Reader\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre1.5.0_06\bin\ssv.dll
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O15 - ESC Trusted Zone: http://*.update.microsoft.com
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

    --
    End of file - 2905 bytes


    ###################uninstall list######################

    Actiontec Gateway
    Adobe Flash Player Plugin
    Adobe Reader 6.0
    Adobe Shockwave Player
    Apple Mobile Device Support
    Apple Software Update
    ATI - Software Uninstall Utility
    ATI Catalyst Control Center
    ATI Control Panel
    ATI Display Driver
    DivX Codec
    DivX Converter
    DivX Player
    DivX Web Player
    ERUNT 1.1j
    EVE-ONLINE (remove only)
    Fallout
    Fallout2
    FEAR
    High Definition Audio Driver Package - KB835221
    HijackThis 2.0.2
    HydraVision
    IEEE 802.11g USB Wireless LAN Adapter
    ILLUSION Sexy?r?[?`3
    ILLUSION Sexy?r?[?`3?`?L???‰?N?^?[’C‰ADISC?`
    Intel(R) PRO Network Adapters and Drivers
    iTunes
    J2SE Runtime Environment 5.0 Update 3
    J2SE Runtime Environment 5.0 Update 6
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Hotfix (KB928366)
    Microsoft .NET Framework 2.0 Service Pack 1
    Microsoft Age of Empires Gold
    Microsoft AppLocale
    Microsoft Base Smart Card Cryptographic Service Provider Package
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft Kernel-Mode Driver Framework Feature Pack 1.7
    Microsoft National Language Support Downlevel APIs
    Microsoft Office Word Viewer 2003
    Microsoft Speech SDK 5.1
    Microsoft User-Mode Driver Framework Feature Pack 1.7
    Microsoft Windows Application Compatibility Database
    Microsoft Windows XP Video Decoder Checkup Utility
    Microsoft WinUsb 1.0
    MobMap 2.02
    Mozilla Firefox (3.0.7)
    Neverwinter Nights Platinum Edition
    NVIDIA PureVideo Decoder
    Pharaoh
    QuickTime
    Realtek High Definition Audio Driver
    Sid Meier's Civilization 4
    Soft Data Fax Modem with SmartCP
    Spybot - Search & Destroy
    Spybot - Search & Destroy 1.4
    TeamSpeak 2 RC2
    Titan Quest
    URGE
    Ventrilo Client
    Viewpoint Media Player
    Windows Backup Utility
    Windows Installer 3.1 (KB893803)
    Windows Internet Explorer 7
    Windows Media Connect
    Windows Media Format 11 runtime
    Windows Media Format 11 runtime
    Windows Media Format SDK Hotfix - KB891122
    Windows Media Player 11
    Windows Media Player 11
    WinRAR archiver
    World of Warcraft
    Xfire (remove only)
    Zune
    Zune
    Zune Language Pack (ES)
    Zune Language Pack (FR)

  4. #4
    In Memoriam -Always in our heart pskelley's Avatar
    Join Date
    Oct 2005
    Location
    Clearwater, Florida
    Posts
    20,247

    Default

    This can be done as time permits, but it is important, and may be why you are infected.
    Uninstall list: I look for malware and security issues and will not know all of your programs, but you should.
    Hackers are using out of date programs to infect folks more and more,
    Here is a small free tool that lets you know when something needs an update if you are interested:
    http://secunia.com/vulnerability_scanning/personal/ While PSI runs in the System Tray for realtime notifications, I personally prefer to turn it off in MSConfig and run it from All Programs when I want to do a check.

    Adobe Flash Player Plugin
    Adobe recommends all users of Adobe Flash Player 10.0.12.36 and earlier versions upgrade to the newest version 10.0.22.87
    http://www.adobe.com/support/securit...apsb09-01.html

    Adobe Reader 6.0 <<< out of date and unsafe, see this:
    http://news.cnet.com/8301-1009_3-100...ml?tag=nl.e433
    http://www.filehippo.com/download_adobe_reader/
    (if you want a smaller program, look at this one)
    Foxit Reader 2.3 for Windows (make sure to uncheck any toolbars)
    http://www.foxitsoftware.com/pdf/rd_intro.php

    J2SE Runtime Environment 5.0 Update 3
    J2SE Runtime Environment 5.0 Update 6

    both are out of date and unsafe, see this:
    http://forums.spybot.info/showpost.p...80&postcount=2
    Be aware of this information so you can opt out of anything you do not want.
    Microsoft Does MSN Toolbar Distribution Deal With Java:
    http://searchengineland.com/microsof...java-15413.php

    Spybot - Search & Destroy 1.4 <<< uninstall this out of date version.
    Please be sure Spybot S&D is up to date and fully immunized.
    http://www.safer-networking.org/en/
    http://www.safer-networking.org/en/news/2008-07-08.html
    http://www.safer-networking.org/en/faq/index.html
    http://www.safer-networking.org/en/tutorial/index.html

    Viewpoint Media Player
    For your information, Viewpoint is installed by aol probably without your knowledge. I suggest you uninstall this resource waster in Add Remove programs.
    http://www.spywareinfo.com/newslette....php#viewpoint
    http://www.clickz.com/news/article.php/3561546
    http://vil.nai.com/vil/content/v_137262.htm


    Please follow the directions carefully and in the numbered order.

    1) Please download ATF Cleaner by Atribune
    http://www.atribune.org/public-beta/ATF-Cleaner.exe
    Save it to your Desktop. We will use this later.

    2) Open notepad and copy/paste the text in the codebox below into it:

    Code:
    File::
    c:\windows\system32\wqjlhgnk.ini
    c:\windows\system32\xifxvjtg.ini
    c:\windows\system32\nwcmnnot.ini
    Save this as CFScript



    Referring to the picture above, drag CFScript into ComboFix.exe.

    This will start ComboFix again. After reboot, (in case it asks to reboot), post the contents of Combofix.txt in your next reply together with a new HijackThis log. (wait until you finish to post the logs)

    3) Run ATF Cleaner
    Double-click ATF-Cleaner.exe to run the program.
    Click Select All found at the bottom of the list.
    Click the Empty Selected button.
    Click Exit on the Main menu to close the program.

    *Cleaning Prefetch may result in a few slow starts until the folder is repopulated:
    http://www.windowsnetworking.com/art...efetch-XP.html

    (Database version: 1866 3/18/2009)

    4) Download Malwarebytes' Anti-Malware to your Desktop
    http://www.malwarebytes.org/

    * Double-click mbam-setup.exe and follow the prompts to install the program.
    * Be sure a checkmark is placed next to Update Malwarebytes' Anti-Malware and Launch Malwarebytes' Anti-Malware, then click Finish.
    * If an update is found, it will download and install the latest version.
    * Once the program has loaded, select Perform FULL SCAN, then click Scan.
    * When the scan is complete, click OK, then Show Results to view the results.
    * Be sure that everything is checked, and click Remove Selected.
    * When completed, a log will open in Notepad. Please save it to a convenient location. The log can also be opened by going to Start > All Programs > Malwarebytes' Anti-Malware > Logs > log-date.txt
    * Please post the log from CFScript, the log from MBAM and a new HJT log.

    Note: If MBAM encounters a file that is difficult to remove, you will be presented with 1 of 2 prompts. Click OK to either and let MBAM proceed with the disinfection process. If asked to restart the computer, please do so immediately. Failure to reboot will prevent MBAM from removing all the malware.

    Tutorial if needed:
    http://www.techsupportteam.org/forum...ware-mbam.html

    How is the computer running?

    Thanks
    MS-MVP Consumer Security 2007-08-09
    Proud Member ASAP
    UNITE Member 2006

  5. #5
    Junior Member
    Join Date
    Mar 2009
    Posts
    6

    Default

    i want to thank you for your help if i have not already. i don't think i did, so thank you.

    PSI is amazing, thak you for that. it pointed to several holes i had in my system which i promptly corrected. i updated all the files you specified and removed a few. i had to uninstall avast! before i ran combo fix because it would not shut down (it was also very out of date). i will be going through the "how was i infected" thread once you give me the go ahead that my system is clean.

    the system is running better than it had been. its very old (updating hardware this weekend) and will be slow until i get more ram.

    before i post the logs i was wondering if there was anything else that is not essential running in the background slowing me down. i want to shut off everything i can. you had said msconfig in your previous post. is this the way to do it and if so can you point me to a page or site explaining how to do it? thanks in advance.

    here are my logs.

    #################CFS log###########################
    ComboFix 09-03-18.01 - graham 2009-03-18 18:59:14.2 - NTFSx86
    Microsoft Windows XP Home Edition 5.1.2600.2.932.81.1033.18.741.397 [GMT -5:00]
    Running from: c:\documents and settings\graham\Desktop\ComboFix.exe
    Command switches used :: c:\documents and settings\graham\Desktop\CFScript.txt
    * Created a new restore point

    WARNING -THIS MACHINE DOES NOT HAVE THE RECOVERY CONSOLE INSTALLED !!

    FILE ::
    c:\windows\system32\nwcmnnot.ini
    c:\windows\system32\wqjlhgnk.ini
    c:\windows\system32\xifxvjtg.ini
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\system32\nwcmnnot.ini
    c:\windows\system32\wqjlhgnk.ini
    c:\windows\system32\xifxvjtg.ini

    .
    ((((((((((((((((((((((((( Files Created from 2009-02-18 to 2009-03-18 )))))))))))))))))))))))))))))))
    .

    2009-03-18 18:52 . 2009-03-18 18:52 <DIR> d-------- c:\windows\LastGood
    2009-03-18 18:52 . 2009-03-18 18:52 <DIR> d-------- c:\program files\CONEXANT
    2009-03-18 18:45 . 2009-03-18 18:44 73,728 --a------ c:\windows\system32\javacpl.cpl
    2009-03-18 18:44 . 2009-03-18 18:44 <DIR> d-------- c:\program files\Java
    2009-03-18 18:39 . 2009-03-18 18:44 410,984 --a------ c:\windows\system32\deploytk.dll
    2009-03-18 18:05 . 2009-03-18 18:05 <DIR> d-------- c:\program files\iTunes
    2009-03-18 18:05 . 2009-03-18 18:05 <DIR> d-------- c:\program files\iPod
    2009-03-18 18:05 . 2009-03-18 18:05 <DIR> d-------- c:\program files\Bonjour
    2009-03-18 18:05 . 2009-03-18 18:05 <DIR> d-------- c:\documents and settings\All Users\Application Data\{00D89592-F643-4D8D-8F0F-AFAE0F14D4C3}
    2009-03-18 18:03 . 2009-03-18 18:03 <DIR> d-------- c:\program files\Apple Software Update
    2009-03-18 17:52 . 2009-03-18 17:52 <DIR> d-------- c:\program files\Secunia
    2009-03-17 18:40 . 2009-03-17 18:40 <DIR> d-------- c:\program files\Trend Micro
    2009-03-17 18:08 . 2009-03-17 18:08 <DIR> d-------- c:\program files\ERUNT
    2009-03-15 14:29 . 2009-03-16 17:24 269 --a------ c:\windows\wininit.ini
    2009-03-15 13:58 . 2009-03-15 13:58 <DIR> d-------- c:\program files\TeaTimer (Spybot - Search & Destroy)
    2009-03-15 13:58 . 2009-03-15 13:58 <DIR> d-------- c:\program files\SDHelper (Spybot - Search & Destroy)
    2009-03-15 13:58 . 2009-03-15 13:58 <DIR> d-------- c:\program files\Misc. Support Library (Spybot - Search & Destroy)
    2009-03-15 13:58 . 2009-03-15 13:58 <DIR> d-------- c:\program files\File Scanner Library (Spybot - Search & Destroy)
    2009-02-28 13:47 . 2009-02-28 13:47 <DIR> d--h----- c:\windows\PIF

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-03-18 23:55 --------- d-----w c:\program files\Spybot - Search & Destroy
    2009-03-18 23:54 --------- d-----w c:\documents and settings\All Users\Application Data\Spybot - Search & Destroy
    2009-03-18 23:18 --------- d-----w c:\program files\Common Files\Adobe
    2009-03-18 23:05 --------- d-----w c:\program files\Common Files\Apple
    2009-03-16 00:33 --------- d-----w c:\program files\ATI Technologies
    2009-03-15 23:03 --------- d-----w c:\program files\World of Warcraft
    2009-02-07 18:52 --------- d-----w c:\program files\CDKnet
    2009-02-01 19:10 0 ---ha-w c:\windows\system32\drivers\MsftWdf_user_01_07_00.Wdf
    2009-02-01 19:10 0 ---ha-w c:\windows\system32\drivers\Msft_User_ZuneDriver_01_07_00.Wdf
    2009-02-01 19:10 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_WinUSB_01007.Wdf
    2009-02-01 16:14 0 ---ha-w c:\windows\system32\drivers\MsftWdf_Kernel_01007_Coinstaller_Critical.Wdf
    2009-02-01 16:14 0 ---ha-w c:\windows\system32\drivers\Msft_Kernel_zumbus_01007.Wdf
    2009-02-01 16:14 --------- d-----w c:\program files\Zune
    2008-12-20 23:15 826,368 ----a-w c:\windows\system32\wininet.dll
    2007-05-25 18:10 3,918,123,008 -c--a-w c:\program files\schoolmate.iso
    2007-05-25 04:01 105 -c--a-w c:\program files\HentaiShare!.URL
    2007-05-21 22:14 7,364 -c--a-w c:\program files\[HentaiShare].Schoolmate.nfo
    2006-09-27 21:55 7,139 -c--a-w c:\program files\[HentaiShare].Sexy.Beach.3.nfo
    2006-09-27 21:41 3,191,007,232 -c--a-w c:\program files\[HentaiShare].Sexy.Beach.3.DeathMarine.iso
    2006-09-27 20:54 509 -c--a-w c:\program files\file_id.diz
    2006-06-23 02:29 48 -c--a-w c:\program files\HentaiShare.URL
    2006-02-18 00:00 3,027 -c--a-w c:\program files\install_wizard.log
    2006-02-18 00:00 24 -c--a-w c:\program files\defaults.ini
    2006-02-18 00:00 24 -c--a-w c:\program files\components.ini
    2006-02-18 00:00 1,696 -c--a-w c:\program files\install_status.log
    2004-12-13 02:13 208,896 -c--a-w c:\documents and settings\graham\3DAnalyze.exe
    2004-12-11 04:44 90,112 -c--a-w c:\documents and settings\graham\hook_3DA.dll
    2004-12-11 04:44 52,736 -c--a-w c:\documents and settings\graham\ForceDLL.dll
    .

    ((((((((((((((((((((((((((((( SnapShot@2009-03-18_17.03.25.84 )))))))))))))))))))))))))))))))))))))))))
    .
    + 2005-10-20 17:02:28 163,328 ----a-w c:\windows\ERDNT\AutoBackup\3-18-2009\ERDNT.EXE
    + 2009-03-18 23:37:08 9,732,096 ----a-w c:\windows\ERDNT\AutoBackup\3-18-2009\Users\00000001\NTUSER.DAT
    + 2009-03-18 23:37:09 118,784 ----a-w c:\windows\ERDNT\AutoBackup\3-18-2009\Users\00000002\UsrClass.dat
    + 2009-03-18 23:05:02 86,016 ----a-r c:\windows\Installer\{07287123-B8AC-41CE-8346-3D777245C35B}\PrntWzrdIco.exe
    + 2009-03-18 23:03:33 27,136 ----a-r c:\windows\Installer\{6956856F-B6B3-4BE0-BA0B-8F495BE32033}\AppleSoftwareUpdateIco.exe
    + 2009-03-18 23:19:02 295,606 ----a-r c:\windows\Installer\{AC76BA86-7AD7-1033-7B44-A81300000003}\SC_Reader.exe
    + 2009-03-18 23:06:05 102,400 ----a-r c:\windows\Installer\{C26B06A9-27BB-45B0-9873-9C623EC2BA38}\iTunesIco.exe
    + 2008-12-12 16:18:16 87,336 ----a-w c:\windows\system32\dns-sd.exe
    + 2008-12-12 16:11:46 61,440 ----a-w c:\windows\system32\dnssd.dll
    - 2006-09-19 23:44:04 15,664 ----a-w c:\windows\system32\drivers\GEARAspiWDM.sys
    + 2009-01-15 17:19:36 23,848 ----a-w c:\windows\system32\drivers\GEARAspiWDM.sys
    - 2005-07-22 18:01:00 717,952 ----a-w c:\windows\system32\drivers\HSF_CNXT.sys
    + 2004-06-17 22:55:38 685,056 ----a-w c:\windows\system32\drivers\HSF_CNXT.sys
    - 2005-07-22 18:01:10 231,168 ----a-w c:\windows\system32\drivers\HSFHWBS2.sys
    + 2004-06-17 22:56:22 220,032 ----a-w c:\windows\system32\drivers\HSFHWBS2.sys
    - 2005-10-05 22:57:08 12,544 ----a-w c:\windows\system32\drivers\mdmxsdk.sys
    + 2004-03-17 19:04:14 13,059 ----a-w c:\windows\system32\drivers\mdmxsdk.sys
    + 2008-12-10 14:17:14 7,808 ----a-w c:\windows\system32\drivers\psi_mf.sys
    + 2008-04-17 17:12:54 107,368 -c--a-w c:\windows\system32\DRVSTORE\GEARAspiWD_4F4AA3475F1B13A1E8212B6D40B351211BC358CE\x86\GEARAspi.dll
    + 2009-01-15 17:19:36 23,848 -c--a-w c:\windows\system32\DRVSTORE\GEARAspiWD_4F4AA3475F1B13A1E8212B6D40B351211BC358CE\x86\GEARAspiWDM.sys
    + 2009-03-06 04:59:00 36,864 -c--a-w c:\windows\system32\DRVSTORE\usbaapl_AF109929C2381E41FEF454F3FEDAA257A9E85F92\usbaapl.sys
    + 2009-03-06 04:59:00 1,900,544 -c--a-w c:\windows\system32\DRVSTORE\usbaapl_AF109929C2381E41FEF454F3FEDAA257A9E85F92\usbaaplrc.dll
    - 2006-10-04 02:47:52 109,360 -c--a-w c:\windows\system32\GEARAspi.dll
    + 2008-04-17 17:12:54 107,368 ----a-w c:\windows\system32\GEARAspi.dll
    - 2005-11-10 18:27:06 49,248 -c--a-w c:\windows\system32\java.exe
    + 2009-03-18 23:44:59 144,792 ----a-w c:\windows\system32\java.exe
    - 2005-11-10 18:27:16 49,250 -c--a-w c:\windows\system32\javaw.exe
    + 2009-03-18 23:44:59 144,792 ----a-w c:\windows\system32\javaw.exe
    - 2005-11-10 20:03:54 127,078 -c--a-w c:\windows\system32\javaws.exe
    + 2009-03-18 23:44:59 148,888 ----a-w c:\windows\system32\javaws.exe
    + 2009-02-03 02:07:18 240,544 ----a-r c:\windows\system32\Macromed\Flash\FlashUtil10b.exe
    - 2008-03-25 03:21:18 2,889,088 ----a-w c:\windows\system32\Macromed\Flash\NPSWF32.dll
    + 2009-02-03 02:15:28 3,771,296 ----a-w c:\windows\system32\Macromed\Flash\NPSWF32.dll
    - 2008-03-25 03:21:20 218,496 -c--a-w c:\windows\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
    + 2009-02-03 02:15:30 240,544 ----a-w c:\windows\system32\Macromed\Flash\NPSWF32_FlashUtil.exe
    + 2009-03-18 23:07:18 89,102 ----a-w c:\windows\system32\Macromed\Flash\uninstall_activeX.exe
    - 2008-05-12 00:42:35 70,264 -c--a-w c:\windows\system32\Macromed\Flash\uninstall_plugin.exe
    + 2009-03-18 23:09:50 84,661 ----a-w c:\windows\system32\Macromed\Flash\uninstall_plugin.exe
    - 2005-10-05 22:56:44 86,016 -c--a-w c:\windows\system32\mdmxsdk.dll
    + 2004-03-17 19:00:32 86,016 ----a-w c:\windows\system32\mdmxsdk.dll
    + 2009-03-18 23:51:42 16,384 ----atw c:\windows\temp\Perflib_Perfdata_768.dat
    + 2006-06-05 19:14:28 479,232 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcm80.dll
    + 2006-06-05 19:14:28 548,864 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcp80.dll
    + 2006-06-05 19:14:28 626,688 ----a-w c:\windows\WinSxS\x86_Microsoft.VC80.CRT_1fc8b3b9a1e18e3b_8.0.50727.163_x-ww_681e29fb\msvcr80.dll
    .
    -- Snapshot reset to current date --
    .
    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2004-08-04 15360]
    "SpybotSD TeaTimer"="c:\program files\Spybot - Search & Destroy\TeaTimer.exe" [2009-01-26 2144088]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2009-03-12 342312]
    "Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 8.0\Reader\Reader_sl.exe" [2008-10-15 39792]
    "SunJavaUpdateSched"="c:\program files\Java\jre6\bin\jusched.exe" [2009-03-18 148888]

    c:\documents and settings\graham\Start Menu\Programs\Startup\
    ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]
    Secunia PSI.lnk - c:\program files\Secunia\PSI\psi.exe [2008-12-17 748840]

    [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
    @="Driver"

    [HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run-]
    "WMPNSCFG"=c:\program files\Windows Media Player\WMPNSCFG.exe

    [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
    "Alcmtr"=ALCMTR.EXE
    "Zune Launcher"="c:\program files\Zune\ZuneLauncher.exe"
    "e4e5a998"=rundll32.exe "c:\windows\system32\tonnmcwn.dll",b

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=
    "c:\\NeverwinterNights\\NWN\\nwmain.exe"=
    "c:\\Program Files\\Messenger\\msmsgs.exe"=
    "c:\\Program Files\\windows media player\\wmplayer.exe"=
    "c:\\Program Files\\CCP\\EVE\\eve.exe"=
    "c:\\StubInstaller.exe"=
    "c:\\Program Files\\Mozilla Firefox\\firefox.exe"=
    "c:\\Program Files\\Sierra\\FEAR\\fpupdate.exe"=
    "c:\\Program Files\\Sierra\\FEAR\\FEAR.exe"=
    "c:\\Program Files\\Sierra\\FEAR\\FEARMP.exe"=
    "%windir%\\Network Diagnostic\\xpnetdiag.exe"=
    "c:\\WINDOWS\\system32\\dpvsetup.exe"=
    "c:\\Program Files\\World of Warcraft\\WoW-2.0.3-enUS-downloader.exe"=
    "c:\\Program Files\\World of Warcraft\\WoW-2.0.3.6299-to-2.0.6.6337-enUS-downloader.exe"=
    "c:\\Program Files\\World of Warcraft\\WoW-2.0.6.6337-to-2.0.7.6383-enUS-downloader.exe"=
    "c:\\Program Files\\World of Warcraft\\WoW-2.0.7.6383-to-2.0.8.6403-enUS-downloader.exe"=
    "c:\\Program Files\\World of Warcraft\\WoW-2.0.3.6299-to-2.0.7.6383-enUS-downloader.exe"=
    "c:\\Program Files\\World of Warcraft\\WoW-2.0.8.6403-to-2.0.10.6448-enUS-downloader.exe"=
    "c:\\Program Files\\World of Warcraft\\BackgroundDownloader.exe"=
    "c:\\Program Files\\Firaxis Games\\Sid Meier's Civilization 4\\Civilization4.exe"=
    "c:\\Program Files\\World of Warcraft\\Launcher.exe"=
    "c:\\Program Files\\Bonjour\\mDNSResponder.exe"=
    "c:\\Program Files\\iTunes\\iTunes.exe"=

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\GloballyOpenPorts\List]
    "26000:TCP"= 26000:TCP:eve
    "3724:TCP"= 3724:TCP:Blizzard Downloader
    "6122:TCP"= 6122:TCP:Blizzard Downloader

    R3 PSI;PSI;c:\windows\system32\drivers\psi_mf.sys [2008-12-10 7808]
    S3 ZD1211U(WLAN);IEEE 802.11g USB Wireless LAN Driver(WLAN);c:\windows\system32\drivers\ZD1211U.sys [2006-07-02 273408]
    S3 ZDBRGSYS;ZDBRGSYS NDIS Protocol Driver;c:\windows\system32\ZDBRGSYS.sys [2006-07-02 19200]

    --- Other Services/Drivers In Memory ---

    *NewlyCreated* - MDMXSDK
    .
    Contents of the 'Scheduled Tasks' folder

    2009-03-13 c:\windows\Tasks\1-Click Maintenance.job
    - c:\program files\TuneUp Utilities 2007\SystemOptimizer.exe []
    .
    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com/
    uInternet Settings,ProxyOverride = *.local
    FF - ProfilePath - c:\documents and settings\graham\Application Data\Mozilla\Firefox\Profiles\32o48mct.default\

    ---- FIREFOX POLICIES ----
    FF - user.js: network.http.max-persistent-connections-per-server - 4
    FF - user.js: content.max.tokenizing.time - 200000
    FF - user.js: content.notify.interval - 100000
    FF - user.js: content.switch.threshold - 650000
    FF - user.js: nglayout.initialpaint.delay - 300
    FF - user.js: yahoo.homepage.dontask - true.

    **************************************************************************

    catchme 0.3.1367 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-03-18 19:01:31
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_USERS\S-1-5-21-268331592-2039796729-2405960755-1006\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
    "?慴"=hex:64,32,ac,09,ac,84,7b,0f,5c,ee,ae,b3,8f,fc,89,89,e2,57,97,c1,7c,3f,f9,
    0a,9a,6d,54,d1,3e,1d,c0,a1,b2,f9,8d,e5,54,9f,a6,3b,4d,54,55,eb,be,b5,0c,a4,\
    "?祥"=hex:34,19,4e,73,69,48,98,52,d8,19,07,9a,7f,e3,aa,f0
    .
    Completion time: 2009-03-18 19:03:28
    ComboFix-quarantined-files.txt 2009-03-19 00:02:52
    ComboFix2.txt 2009-03-18 22:04:48

    Pre-Run: 68,631,691,264 bytes free
    Post-Run: 68,696,915,968 bytes free

    215 --- E O F --- 2009-02-26 09:00:47



    #####################mbam log#######################


    Malwarebytes' Anti-Malware 1.34
    Database version: 1866
    Windows 5.1.2600 Service Pack 2

    3/18/2009 7:53:16 PM
    mbam-log-2009-03-18 (19-53-16).txt

    Scan type: Full Scan (C:\|D:\|)
    Objects scanned: 175261
    Time elapsed: 40 minute(s), 48 second(s)

    Memory Processes Infected: 0
    Memory Modules Infected: 0
    Registry Keys Infected: 0
    Registry Values Infected: 0
    Registry Data Items Infected: 0
    Folders Infected: 0
    Files Infected: 42

    Memory Processes Infected:
    (No malicious items detected)

    Memory Modules Infected:
    (No malicious items detected)

    Registry Keys Infected:
    (No malicious items detected)

    Registry Values Infected:
    (No malicious items detected)

    Registry Data Items Infected:
    (No malicious items detected)

    Folders Infected:
    (No malicious items detected)

    Files Infected:
    C:\Qoobox\Quarantine\C\WINDOWS\system32\cvwlht.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\ewlrvc.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\gbusqcdy.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\gtjvxfix.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\hfgjbnmk.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\ivhcugux.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\knghljqw.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\padwtc.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\tonnmcwn.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\trrvcuns.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\Qoobox\Quarantine\C\WINDOWS\system32\tuhbov.dll.vir (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP1265\A0088871.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP1265\A0088872.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP1265\A0088873.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP1265\A0088874.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP1265\A0088875.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP1265\A0088876.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP1265\A0088877.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP1265\A0088878.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP1265\A0088879.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP1265\A0088880.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP1265\A0088881.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP1265\A0088882.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP1265\A0088883.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP1265\A0088885.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP1265\A0088886.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP1265\A0088887.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP1265\A0088921.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP1265\A0088922.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP1265\A0088884.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP1268\A0093314.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP1270\A0093577.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP1270\A0093578.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP1270\A0093581.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP1270\A0093584.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP1270\A0093585.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP1270\A0093592.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP1270\A0093595.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP1270\A0093605.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP1270\A0093610.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP1270\A0093613.dll (Trojan.Vundo) -> Quarantined and deleted successfully.
    C:\System Volume Information\_restore{F845E3DB-F751-4BE4-A620-64F2CA1BFB5F}\RP1270\A0093612.dll (Trojan.Vundo) -> Quarantined and deleted successfully.


    ####################hijackthis log######################

    Logfile of Trend Micro HijackThis v2.0.2
    Scan saved at 8:03:49 PM, on 3/18/2009
    Platform: Windows XP SP2 (WinNT 5.01.2600)
    MSIE: Internet Explorer v7.00 (7.00.6000.16791)
    Boot mode: Normal

    Running processes:
    C:\WINDOWS\System32\smss.exe
    C:\WINDOWS\system32\winlogon.exe
    C:\WINDOWS\system32\services.exe
    C:\WINDOWS\system32\lsass.exe
    C:\WINDOWS\system32\Ati2evxx.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\System32\svchost.exe
    C:\WINDOWS\system32\svchost.exe
    C:\WINDOWS\system32\spoolsv.exe
    C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    C:\Program Files\iTunes\iTunesHelper.exe
    C:\Program Files\Bonjour\mDNSResponder.exe
    C:\WINDOWS\System32\svchost.exe
    C:\Program Files\Java\jre6\bin\jqs.exe
    C:\Program Files\Java\jre6\bin\jusched.exe
    C:\WINDOWS\system32\ctfmon.exe
    c:\WINDOWS\system32\ZuneBusEnum.exe
    C:\Program Files\Secunia\PSI\psi.exe
    C:\Program Files\iPod\bin\iPodService.exe
    C:\WINDOWS\system32\conime.exe
    C:\WINDOWS\system32\notepad.exe
    C:\WINDOWS\explorer.exe
    C:\Program Files\Mozilla Firefox\firefox.exe
    C:\WINDOWS\system32\NOTEPAD.EXE
    C:\Program Files\Trend Micro\HijackThis\HijackThis.exe

    O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 8.0\Reader\Reader_sl.exe"
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - Startup: ERUNT AutoBackup.lnk = C:\Program Files\ERUNT\AUTOBACK.EXE
    O4 - Startup: Secunia PSI.lnk = C:\Program Files\Secunia\PSI\psi.exe
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\MSMSGS.EXE
    O15 - ESC Trusted Zone: http://*.update.microsoft.com
    O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
    O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe
    O23 - Service: Bonjour Service - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe

    --
    End of file - 3795 bytes

  6. #6
    In Memoriam -Always in our heart pskelley's Avatar
    Join Date
    Oct 2005
    Location
    Clearwater, Florida
    Posts
    20,247

    Default

    Thanks for the feedback, I will post links that should answer your questions before we start.

    http://www.crucial.com/support/howmuch.aspx
    Adding RAM to increase computer speed - Video Tip
    http://www.helpmerick.com/adding_ram..._video_tip.htm

    http://www.netsquirrel.com/msconfig/msconfig_xp.html
    http://www.malwareremoval.com/tutori...ningslowly.php
    http://users.telenet.be/bluepatchy/m...wcomputer.html
    http://www.microsoft.com/atwork/getstarted/speed.mspx

    What's new in avast! version 4
    http://www.avast.com/eng/whats_new_in_avast_v2.html

    Let's see if we can wrap up like this:

    Remove combofix from the computer like this:

    Click START then RUN
    Now type or copy Combofix /u in the runbox and click OK.
    Note the space between the X and the U, it needs to be there.



    Clean the System Restore files like this:

    Turn off System Restore.
    On the Desktop, right-click My Computer.
    Click Properties.
    Click the System Restore tab.
    Check Turn off System Restore.
    Click Apply, and then click OK.

    Reboot

    Turn ON System Restore,
    On the Desktop, right-click My Computer.
    Click Properties.
    Click the System Restore tab.
    UN-Check *Turn off System Restore*.
    Click Apply, and then click OK.

    Update MBAM (Database version: 1868 3/18/2009)
    and scan to be sure we missed none of the junk, there is no need to post a clean scan result.
    (MBAM is yours to keep if you wish, update it and run it once a month or so)

    Update Avast4 and scan the system, to be sure it is running right and scanning clean.

    If all is well at this point, let me know and I will close the topic.

    Some good information for you:
    http://www.microsoft.com/windowsxp/u...s/mcgill1.mspx

    Here is some great information from experts in this field that will help you stay clean and safe online.
    http://users.telenet.be/bluepatchy/m...revention.html
    http://forums.spybot.info/showthread.php?t=279
    http://russelltexas.com/malware/allclear.htm
    http://forum.malwareremoval.com/viewtopic.php?t=14
    http://www.bleepingcomputer.com/forums/topict2520.html
    http://cybercoyote.org/security/not-admin.shtml

    http://www.malwarecomplaints.info/

    Thanks...pskelley
    Safer Networking Forums
    http://www.spybot.info/en/donate/index.html
    If you are reading this information...thank a teacher,
    If you are reading it in English...thank a soldier.

    http://users.telenet.be/bluepatchy/m...oes/Links.html
    http://www.microsoft.com/windows/ie/...rotection.mspx
    Improve the safety of your browsing and e-mail activities
    http://www.microsoft.com/protect/com.../browsing.mspx
    MS-MVP Consumer Security 2007-08-09
    Proud Member ASAP
    UNITE Member 2006

  7. #7
    Junior Member
    Join Date
    Mar 2009
    Posts
    6

    Default

    i did the above mentioned fixes but i seem to have a problem with online armor and avast. both are the newest versions. avast will quit for a second or two then come back online. online armor will quit and show in my toolbar that it has terminated unexpectedly. i also had some problems getting system restore to turn back on after i had turned it off, the system would lock up.

    do i need to uninstall both avast and online armor and then reinstall them? i dont think i have a virus because all my scanners show an all clear.

  8. #8
    In Memoriam -Always in our heart pskelley's Avatar
    Join Date
    Oct 2005
    Location
    Clearwater, Florida
    Posts
    20,247

    Default

    I have never used Online Armor: http://www.tallemu.com/
    so I will not be able to advise you. Here is their free forum:
    http://support.tallemu.com/vbforum/

    I do use Avast4 but only on a Windows 98SE box that I rarely take online.
    What's new in avast! version 4
    http://www.avast.com/eng/whats_new_in_avast_v2.html
    http://forum.avast.com/ <<< support forum

    One is a firewall and the other antivirus and I can think of no reason they should not run together.

    Thanks
    MS-MVP Consumer Security 2007-08-09
    Proud Member ASAP
    UNITE Member 2006

  9. #9
    Junior Member
    Join Date
    Mar 2009
    Posts
    6

    Default

    i am now having problems running explorer. i also keep getting the message that system config utility is in diag or selective start mode. i put it in normal and after a minute of saving my settings it finally restarts. after it has restarted the message will come back up. at this point i cannot get into control pannel without it being very slow or locking up. i have had to restart the computer several times to get firefox to work (i am keeping my fingers crossed that this posts). any idea what may have caused this?

  10. #10
    In Memoriam -Always in our heart pskelley's Avatar
    Join Date
    Oct 2005
    Location
    Clearwater, Florida
    Posts
    20,247

    Default

    I have no idea, here is what you had to say, sounds like you must.
    the system is running better than it had been. its very old (updating hardware this weekend) and will be slow until i get more ram.
    Run this scan to see if there is any malware we missed:

    Do an online scan with Kaspersky Online Scanner

    http://www.kaspersky.com/kos/eng/par...=1213442456390

    1. Note: If you are using Windows Vista, open your browser by right-clicking on its icon and select 'Run as administrator' to perform this scan.
    2. Click on the Accept button and install any components it needs.
    3. The program will install and then begin downloading the latest definition files.
    4. After the files have been downloaded on the left side of the page in the Scan section select My Computer
    5. This will start the program and scan your system.
    6. The scan will take a while, so be patient and let it run.
    7. Once the scan is complete, click on View scan report
    8. Now, click on the Save Report as button.
    9. Save the file to your desktop.
    10. Copy and paste that information in your next post
    MS-MVP Consumer Security 2007-08-09
    Proud Member ASAP
    UNITE Member 2006

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •