Results 1 to 4 of 4

Thread: Hupigon 13, Win32.Delf.uv, and probably more

  1. 2009-05-20, 16:55 #1
    qualitamatic
    qualitamatic is offline
    Junior Member
    Join Date
    May 2009
    Posts
    2

    Default Hupigon 13, Win32.Delf.uv, and probably more

    Hi,

    I was alerted to the presence of a Trojan (called Jonunu? I haven't seen the name reoccur since) by Windows Defender yesterday and since then I've been using Defender, Spybot, Malwarebyte's Anti-Malware, and Kapersky to try and route out various infections. Some are still persisting; Spybot is repeatedly turning up Hupigon13 and Win32.Delf.uv entries, and Anti-Malware is showing about a 100 infected registry values and entries that reappear on restart. Unfortunately today I've noticed trouble updating Anti-Malware, visiting their site, and running HijackThis (I had to rename it) that suggests the infections are only getting worse.

    MalWare initially turned up entries including Trojan.BHO and Worm.Koobface, but these haven't reappeared since. I'd really appreciate any help you can offer with this, I do need use of this computer!

    I can post the MalWare logfile if necessary. Here's my HijackThis log.

    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)
    O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll
    O2 - BHO: Windows Live Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
    O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\program files\google\googletoolbar2.dll
    O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll
    O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Program Files\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
    O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\program files\google\googletoolbar2.dll
    O4 - HKLM\..\Run: [ehTray] C:\WINDOWS\ehome\ehtray.exe
    O4 - HKLM\..\Run: [hpWirelessAssistant] C:\Program Files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe
    O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
    O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
    O4 - HKLM\..\Run: [nwiz] nwiz.exe /installquiet /nodetect
    O4 - HKLM\..\Run: [MsmqIntCert] regsvr32 /s mqrt.dll
    O4 - HKLM\..\Run: [High Definition Audio Property Page Shortcut] CHDAudPropShortcut.exe
    O4 - HKLM\..\Run: [SynTPEnh] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
    O4 - HKLM\..\Run: [QPService] "C:\Program Files\HP\QuickPlay\QPService.exe"
    O4 - HKLM\..\Run: [QlbCtrl] %ProgramFiles%\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe /Start
    O4 - HKLM\..\Run: [Cpqset] C:\Program Files\Hewlett-Packard\Default Settings\cpqset.exe
    O4 - HKLM\..\Run: [RecGuard] C:\Windows\SMINST\RecGuard.exe
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\qttask.exe" -atboottime
    O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"
    O4 - HKLM\..\Run: [NBKeyScan] "C:\Program Files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
    O4 - HKLM\..\Run: [HP Software Update] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
    O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
    O4 - HKCU\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1
    O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
    O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe
    O4 - HKUS\S-1-5-21-4242693575-1754446674-701612613-1005\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (User '?')
    O4 - HKUS\S-1-5-21-4242693575-1754446674-701612613-1005\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020 (User '?')
    O4 - HKUS\S-1-5-21-4242693575-1754446674-701612613-1005\..\Run: [updateMgr] C:\Program Files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe AcRdB7_0_5 -reboot 1 (User '?')
    O4 - HKUS\S-1-5-21-4242693575-1754446674-701612613-1005\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe (User '?')
    O4 - HKUS\S-1-5-21-4242693575-1754446674-701612613-1005\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe (User '?')
    O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User '?')
    O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
    O4 - S-1-5-21-4242693575-1754446674-701612613-1005 Startup: is-873B5.lnk = C:\Documents and Settings\Phil\Desktop\Virus Removal Tool\is-873B5\startup.exe (User '?')
    O4 - Startup: is-873B5.lnk = C:\Documents and Settings\Phil\Desktop\Virus Removal Tool\is-873B5\startup.exe
    O4 - Global Startup: Bluetooth.lnk = ?
    O4 - Global Startup: HP Pavilion Webcam Tray Icon.lnk = ?
    O4 - Global Startup: HP Photosmart Premier Fast Start.lnk = C:\Program Files\HP\Digital Imaging\bin\hpqthb08.exe
    O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000
    O8 - Extra context menu item: Send To &Bluetooth - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll
    O9 - Extra 'Tools' menuitem: Sun Java Console - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll
    O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL
    O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra 'Tools' menuitem: @btrez.dll,-4017 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
    O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra 'Tools' menuitem: Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\PROGRA~1\SPYBOT~1\SDHelper.dll
    O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
    O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Program Files\Messenger\msmsgs.exe
    O14 - IERESET.INF: START_PAGE_URL=http://ie.redirect.hp.com/svs/rdr?TYPE=3&tp=iehome&locale=EN_GB&c=64&bd=pavilion&pf=laptop
    O16 - DPF: {02BF25D5-8C17-4B23-BC80-D3488ABDDC6B} (QuickTime Object) - http://a1540.g.akamai.net/7/1540/52/...x/qtplugin.cab
    O16 - DPF: {1851174C-97BD-4217-A0CC-E908F60D5B7A} (Hewlett-Packard Online Support Services) - http://h50203.www5.hp.com/HPISWeb/Cu...ataManager.CAB
    O16 - DPF: {67A5F8DC-1A4B-4D66-9F24-A704AD929EEE} (System Requirements Lab) - http://www.nvidia.com/content/Driver...sysreqlab2.cab
    O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/webplayer/s...rInstaller.cab
    O16 - DPF: {6F15128C-E66A-490C-B848-5000B5ABEEAC} (HP Download Manager) - https://h20436.www2.hp.com/ediags/de...e/HPDEXAXO.cab
    O16 - DPF: {9AC81071-4B2C-48DF-A245-C131DD64B7D2} (MachineCheck Class) - https://wwws.richmond.edu/UofRMachineCheck.cab
    O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} (Java Plug-in 1.6.0_03) -
    O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} (Java Plug-in 1.6.0_05) -
    O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} (Java Plug-in 1.6.0_07) -
    O16 - DPF: {D821DC4A-0814-435E-9820-661C543A4679} (CRLDownloadWrapper Class) - http://drmlicense.one.microsoft.com/.../en/crlocx.ocx
    O20 - AppInit_DLLs: karna.dat
    O23 - Service: AddFiltr - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\HP Quick Launch Buttons\AddFiltr.exe
    O23 - Service: Apple Mobile Device - Apple, Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    O23 - Service: Bonjour Service - Apple Computer, Inc. - C:\Program Files\Bonjour\mDNSResponder.exe
    O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    O23 - Service: DCOM Server Process Launcher DcomLaunchWinDefend (DcomLaunchWinDefend) - Unknown owner - C:\WINDOWS\system32\12520850w.exe
    O23 - Service: hpqwmiex - Hewlett-Packard Development Company, L.P. - C:\Program Files\Hewlett-Packard\Shared\hpqwmiex.exe
    O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - c:\Program Files\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
    O23 - Service: iPod Service - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe
    O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Program Files\Java\jre6\bin\jqs.exe
    O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files\Common Files\LightScribe\LSSrvc.exe
    O23 - Service: LiveUpdate - Symantec Corporation - C:\PROGRA~1\Symantec\LIVEUP~1\LUCOMS~1.EXE
    O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
    O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe

    --
    End of file - 12338 bytes
  2. 2009-05-21, 12:39 #2
    katana
    katana is offline
    Security Expert-Emeritus
    Join Date
    Oct 2006
    Location
    Manchester UK
    Posts
    3,425

    Default

    Please note that all instructions given are customised for this computer only,
    the tools used may cause damage if used on a computer with different infections.

    If you think you have similar problems, please post a log in the HJT forum and wait for help.

    Hello and welcome to the forums

    My name is Katana and I will be helping you to remove any infection(s) that you may have.

    Please observe these rules while we work:
    1. Please Read All Instructions Carefully
    2. If you don't understand something, stop and ask! Don't keep going on.
    3. Please do not run any other tools or scans whilst I am helping you
    4. Failure to reply within 5 days will result in the topic being closed.
    5. Please continue to respond until I give you the "All Clear"
      (Just because you can't see a problem doesn't mean it isn't there)

    If you can do those few things, everything should go smoothly

    Please Note, your security programs may give warnings for some of the tools I will ask you to use.
    Be assured, any links I give are safe
    ----------------------------------------------------------------------------------------


    Disable Teatimer
    We need to disable Teatimer as it may interfere with the cleaning.
    Please do not re-enable it until I give instructions.

    First step:
    • Right-click the Spybot Icon in the System Tray (looks like a blue/white calendar with a padlock symbol)
    • If you have the new version 1.5, Click once on Resident Protection, then Right click the Spybot icon again and make sure Resident Protection is now Unchecked. The Spybot icon in the System tray should now be now colorless.
    • If you have Version 1.4, Click on Exit Spybot S&D Resident
    Second step, For Either Version :
    • Open Spybot S&D
    • Click Mode, choose Advanced Mode
    • Go To the bottom of the Vertical Panel on the Left, Click Tools
    • then, also in left panel, click Resident shows a red/white shield.
    • If your firewall raises a question, say OK
    • In the Resident protection status frame, Uncheck the box labeled Resident "Tea-Timer"(Protection of over-all system settings) active
    • OK any prompts.
    • Use File, Exit to terminate Spybot
    • Click Link >>> HERE <<< Link and select "save as" and save it to your desktop
    • Double click TTWipe.bat
    • Reboot your machine for the changes to take effect.



    Fix With HJT

    Close all other windows and then start HiJack This
    Click Do A System Scan Only
    When it has finished scanning put a check next to the following lines IF still present
    O2 - BHO: (no name) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - (no file)
    O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
    O4 - HKLM\..\Run: [Windows Defender] "C:\Program Files\Windows Defender\MSASCui.exe" -hide
    O4 - HKLM\..\Run: [ISUSPM Startup] C:\PROGRA~1\COMMON~1\INSTAL~1\UPDATE~1\ISUSPM.exe -startup
    O4 - HKLM\..\Run: [ISUSScheduler] "C:\Program Files\Common Files\InstallShield\UpdateService\issch.exe" -start
    O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"
    O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe
    O4 - HKUS\S-1-5-21-4242693575-1754446674-701612613-1005\..\Run: [SpybotSD TeaTimer] C:\Program Files\Spybot - Search & Destroy\TeaTimer.exe (User '?')
    O4 - S-1-5-21-4242693575-1754446674-701612613-1005 Startup: is-873B5.lnk = C:\Documents and Settings\Phil\Desktop\Virus Removal Tool\is-873B5\startup.exe (User '?')
    O4 - Startup: is-873B5.lnk = C:\Documents and Settings\Phil\Desktop\Virus Removal Tool\is-873B5\startup.exe
    O16 - DPF: {CAFEEFAC-0016-0000-0003-ABCDEFFEDCBA} (Java Plug-in 1.6.0_03) -
    O16 - DPF: {CAFEEFAC-0016-0000-0005-ABCDEFFEDCBA} (Java Plug-in 1.6.0_05) -
    O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} (Java Plug-in 1.6.0_07) -
    O20 - AppInit_DLLs: karna.dat
    O23 - Service: DCOM Server Process Launcher DcomLaunchWinDefend (DcomLaunchWinDefend) - Unknown owner - C:\WINDOWS\system32\12520850w.exe
    - Close ALL open windows (especially Internet Explorer!)-
    Now click Fix checked
    Click yes to any prompts
    Close HijackThis



    Download and Run ComboFix (by sUBs)
    Please visit this webpage for instructions for downloading and running ComboFix:

    Bleeping Computer ComboFix Tutorial

    • You must download it to and run it from your Desktop
    • Now STOP all your monitoring programs (Antivirus/Antispyware, Guards and Shields) as they could easily interfere with ComboFix.
    • Double click combofix.exe & follow the prompts.
    • When finished, it will produce a log. Please save that log to post in your next reply
    • Re-enable all the programs that were disabled during the running of ComboFix..



    A word of warning: Neither I nor sUBs are responsible for any damage you may have caused your machine by running ComboFix on your own.
    This tool is not a toy and not for everyday use.
    ComboFix SHOULD NOT be used unless requested by a forum helper





    Installed Programs

    Please could you give me a list of the programs that are installed.
    • Start HijackThis
    • Click on the Misc Tools button
    • Click on the Open Uninstall Manager button.

    You will see a list with the programs installed in your computer.
    Click on save list button and specify where you would like to save this file.
    When you press Save button a notepad will open with the contents of that file.
    Simply copy and paste the contents of that notepad into your next post.


    Logs/Information to Post in Reply
    Please post the following logs/Information in your reply
    • Combofix log
    • Installed Programs List
    • How are things running now ?
    Microsoft MVP Consumer Security 2009 -2010
    If we have helped, please consider a donation
    THESE INSTRUCTIONS ARE FOR THIS USER ONLY
  3. 2009-05-22, 00:18 #3
    qualitamatic
    qualitamatic is offline
    Junior Member
    Join Date
    May 2009
    Posts
    2

    Default

    Hey katana, thanks for helping me out with this. My PC's frozen a few times tonight and my internet connection's been very unstable (think the last part is unrelated though), so it took a while, but I've managed to follow all of your instructions as closely as possible. I've only just ran ComboFix so I'm not sure if my PC performance has improved at all, but I'm cautiously optimistic. I do notice Malware can update successfully now, whereas before the restart it couldn't connect to the Internet even when I could.

    Here's the HijackThis log of installed programs you asked for:

    2007 Microsoft Office Suite Service Pack 1 (SP1)
    2007 Microsoft Office Suite Service Pack 1 (SP1)
    2007 Microsoft Office Suite Service Pack 1 (SP1)
    2007 Microsoft Office Suite Service Pack 1 (SP1)
    2007 Microsoft Office Suite Service Pack 1 (SP1)
    2007 Microsoft Office Suite Service Pack 1 (SP1)
    2007 Microsoft Office Suite Service Pack 1 (SP1)
    2007 Microsoft Office Suite Service Pack 1 (SP1)
    2007 Microsoft Office Suite Service Pack 1 (SP1)
    2007 Microsoft Office Suite Service Pack 1 (SP1)
    2007 Microsoft Office Suite Service Pack 1 (SP1)
    2007 Microsoft Office Suite Service Pack 1 (SP1)
    2007 Microsoft Office Suite Service Pack 1 (SP1)
    Adobe Flash Player 10 Plugin
    Adobe Flash Player ActiveX
    Adobe Shockwave Player
    Advanced GIF Animator 2.23
    Apple Mobile Device Support
    Apple Software Update
    Audacity 1.2.6
    Bonjour Core for Windows
    Broadcom 802.11 Driver
    CDisplayEx 1.4
    Choice Guard
    Company of Heroes: Opposing Fronts
    Conexant HD Audio
    CopyPod Suite (remove only)
    Critical Update for Windows Media Player 11 (KB959772)
    Customer Experience Enhancement
    DivX Content Uploader
    DivX Web Player
    Easy Internet Sign-up
    EAX Unified
    EphPod
    ERUNT 1.1j
    GTA2
    Half-Life 2: Episode One
    Half-Life 2: Episode Two
    HijackThis 2.0.2
    Hitman 2: Silent Assassin
    Hitman: Contracts
    Hotfix for Windows Internet Explorer 7 (KB947864)
    Hotfix for Windows Media Format 11 SDK (KB929399)
    Hotfix for Windows Media Player 11 (KB939683)
    Hotfix for Windows XP (KB896256)
    Hotfix for Windows XP (KB896344)
    Hotfix for Windows XP (KB909095)
    Hotfix for Windows XP (KB910728)
    Hotfix for Windows XP (KB912024)
    Hotfix for Windows XP (KB912436)
    Hotfix for Windows XP (KB914440)
    Hotfix for Windows XP (KB915865)
    Hotfix for Windows XP (KB918005)
    Hotfix for Windows XP (KB926239)
    Hotfix for Windows XP (KB928388)
    Hotfix for Windows XP (KB929120)
    Hotfix for Windows XP (KB952287)
    HP Help and Support
    HP Imaging Device Functions 6.0
    HP Integrated Module with Bluetooth wireless technology
    HP Pavilion Webcam Demo
    HP Pavilion Webcam Driver for Vista v061.001.00005
    HP Pavilion Webcam Tray Icon
    HP Photosmart Premier Software 6.0
    HP Quick Launch Buttons 6.10 A2
    HP QuickPlay 2.3
    HP Update
    HP User Guides 0031
    HP Webcam
    HP Wireless Assistant 2.00 G2
    iTunes
    J2SE Runtime Environment 5.0 Update 6
    Java(TM) 6 Update 11
    Last.fm 1.5.4.24567
    LiveUpdate 3.0 (Symantec Corporation)
    Macromedia Flash Player 8
    Macromedia Shockwave Player
    Mafia
    Malwarebytes' Anti-Malware
    Microsoft .NET Framework 1.0 Hotfix (KB887998)
    Microsoft .NET Framework 1.0 Hotfix (KB930494)
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1
    Microsoft .NET Framework 1.1 Hotfix (KB928366)
    Microsoft .NET Framework 2.0 Service Pack 1
    Microsoft Base Smart Card Cryptographic Service Provider Package
    Microsoft Chat 2.5
    Microsoft Compression Client Pack 1.0 for Windows XP
    Microsoft Internationalized Domain Names Mitigation APIs
    Microsoft National Language Support Downlevel APIs
    Microsoft Office Access MUI (English) 2007
    Microsoft Office Access Setup Metadata MUI (English) 2007
    Microsoft Office Excel MUI (English) 2007
    Microsoft Office Outlook MUI (English) 2007
    Microsoft Office PowerPoint MUI (English) 2007
    Microsoft Office Professional 2007
    Microsoft Office Professional 2007 Trial
    Microsoft Office Proof (English) 2007
    Microsoft Office Proof (French) 2007
    Microsoft Office Proof (Spanish) 2007
    Microsoft Office Proofing (English) 2007
    Microsoft Office Publisher MUI (English) 2007
    Microsoft Office Shared MUI (English) 2007
    Microsoft Office Shared Setup Metadata MUI (English) 2007
    Microsoft Office Word MUI (English) 2007
    Microsoft Silverlight
    Microsoft User-Mode Driver Framework Feature Pack 1.0
    Microsoft Visual C++ 2005 Redistributable
    Microsoft Works
    mIRC
    Mozilla Firefox (2.0.0.12)
    Mozilla Firefox (3.0.10)
    MSVCRT
    MSXML 4.0 SP2 (KB927978)
    MSXML 4.0 SP2 (KB936181)
    MSXML 4.0 SP2 (KB954430)
    Mumble and Murmur
    neroxml
    NetWaiting
    NVIDIA Drivers
    Oddworld: Abe's Oddysee Demo
    OpenAL
    Otto
    PeerGuardian 2.0
    Planescape - Torment
    Portal
    PowerISO
    QuickTime
    RC2
    ReaJPEG 3.0
    Real Alternative 1.52
    Redemption - For Half-Life
    ScummVM 0.7.1
    Security Update for 2007 Microsoft Office System (KB951550)
    Security Update for 2007 Microsoft Office System (KB951944)
    Security Update for 2007 Microsoft Office System (KB960003)
    Security Update for CAPICOM (KB931906)
    Security Update for CAPICOM (KB931906)
    Security Update for Microsoft Office Excel 2007 (KB959997)
    Security Update for Microsoft Office PowerPoint 2007 (KB957789)
    Security Update for Microsoft Office Publisher 2007 (KB950114)
    Security Update for Microsoft Office system 2007 (KB954326)
    Security Update for Microsoft Office system 2007 (KB956828)
    Security Update for Microsoft Office Word 2007 (KB956358)
    Security Update for Outlook 2007 (KB946983)
    Security Update for Step By Step Interactive Training (KB898458)
    Security Update for Step By Step Interactive Training (KB923723)
    Security Update for Visio 2007 (KB947590)
    Security Update for Windows Internet Explorer 7 (KB928090)
    Security Update for Windows Internet Explorer 7 (KB931768)
    Security Update for Windows Internet Explorer 7 (KB933566)
    Security Update for Windows Internet Explorer 7 (KB937143)
    Security Update for Windows Internet Explorer 7 (KB938127)
    Security Update for Windows Internet Explorer 7 (KB939653)
    Security Update for Windows Internet Explorer 7 (KB942615)
    Security Update for Windows Internet Explorer 7 (KB944533)
    Security Update for Windows Internet Explorer 7 (KB950759)
    Security Update for Windows Internet Explorer 7 (KB953838)
    Security Update for Windows Internet Explorer 7 (KB956390)
    Security Update for Windows Internet Explorer 7 (KB958215)
    Security Update for Windows Internet Explorer 7 (KB960714)
    Security Update for Windows Internet Explorer 7 (KB961260)
    Security Update for Windows Internet Explorer 7 (KB963027)
    Security Update for Windows Media Player (KB911564)
    Security Update for Windows Media Player (KB952069)
    Security Update for Windows Media Player 10 (KB911565)
    Security Update for Windows Media Player 10 (KB917734)
    Security Update for Windows Media Player 11 (KB936782)
    Security Update for Windows Media Player 11 (KB954154)
    Security Update for Windows Media Player 6.4 (KB925398)
    Security Update for Windows XP (KB893066)
    Security Update for Windows XP (KB893756)
    Security Update for Windows XP (KB896358)
    Security Update for Windows XP (KB896422)
    Security Update for Windows XP (KB896423)
    Security Update for Windows XP (KB896424)
    Security Update for Windows XP (KB896428)
    Security Update for Windows XP (KB899587)
    Security Update for Windows XP (KB899591)
    Security Update for Windows XP (KB900725)
    Security Update for Windows XP (KB901017)
    Security Update for Windows XP (KB901190)
    Security Update for Windows XP (KB901214)
    Security Update for Windows XP (KB902400)
    Security Update for Windows XP (KB903235)
    Security Update for Windows XP (KB904706)
    Security Update for Windows XP (KB905414)
    Security Update for Windows XP (KB905749)
    Security Update for Windows XP (KB908519)
    Security Update for Windows XP (KB911562)
    Security Update for Windows XP (KB911927)
    Security Update for Windows XP (KB912919)
    Security Update for Windows XP (KB913446)
    Security Update for Windows XP (KB913580)
    Security Update for Windows XP (KB914388)

    And here's the ComboFix log:

    ComboFix 09-05-20.A1 - Phil 21/05/2009 22:41.1 - NTFSx86
    Running from: c:\documents and settings\Phil\Desktop\Combo.exe
    * Created a new restore point
    .

    ((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    c:\windows\system32\12520850w.exe
    D:\Autorun.inf
    D:\Desktop.ini

    .
    ((((((((((((((((((((((((((((((((((((((( Drivers/Services )))))))))))))))))))))))))))))))))))))))))))))))))
    .

    -------\Legacy_DCOMLAUNCHWINDEFEND
    -------\Service_DcomLaunchWinDefend


    ((((((((((((((((((((((((( Files Created from 2009-04-21 to 2009-05-21 )))))))))))))))))))))))))))))))
    .

    2009-05-20 14:47 . 2009-05-20 14:47 -------- d-----w c:\program files\ERUNT
    2009-05-19 19:04 . 2009-05-21 21:45 10143776 --sha-w c:\windows\system32\drivers\fidbox.dat
    2009-05-19 19:04 . 2008-07-08 13:54 148496 ----a-w c:\windows\system32\drivers\28971972.sys
    2009-05-19 18:34 . 2009-05-19 18:38 -------- d-----w c:\documents and settings\Phil\.SunDownloadManager
    2009-05-19 15:08 . 2009-05-19 15:08 2 ---h--w c:\windows\sto453250.dat
    2009-05-19 01:08 . 2009-05-19 01:08 32 --s-a-w c:\windows\system32\2335106829.dat
    2009-05-19 01:08 . 2009-05-19 01:08 136192 ----a-w c:\windows\system32\drivers\ethgfvgd.sys
    2009-05-18 00:29 . 2009-05-19 20:15 -------- d-----w c:\windows\system32\MAD MEN SCREENSAVER dir

    .
    (((((((((((((((((((((((((((((((((((((((( Find3M Report ))))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    2009-05-21 21:43 . 2009-05-19 19:04 119084 --sha-w c:\windows\system32\drivers\fidbox.idx
    2009-05-21 21:19 . 2008-03-17 22:10 -------- d-----w c:\program files\Mozilla Firefox 3 Beta 4
    2009-05-21 15:37 . 2006-09-20 03:14 -------- d-----w c:\program files\Google
    2009-05-21 14:10 . 2007-06-27 23:29 -------- d-----w c:\program files\Soulseek
    2009-05-21 14:10 . 2007-01-21 18:47 -------- d-----w c:\program files\Rockstar Games
    2009-05-20 15:45 . 2008-11-12 22:03 -------- d-----w c:\program files\Malwarebytes' Anti-Malware
    2009-05-19 22:47 . 2007-05-14 22:36 -------- d-----w c:\program files\PeerGuardian2
    2009-05-19 20:14 . 2006-09-20 09:35 -------- d-----w c:\program files\Java
    2009-05-19 20:10 . 2006-09-20 09:35 -------- d--h--w c:\program files\InstallShield Installation Information
    2009-05-19 18:38 . 2007-04-08 02:28 -------- d-----w c:\program files\mIRC
    2009-05-09 23:28 . 2007-02-27 22:26 -------- d-----w c:\program files\Steam
    2009-04-20 19:20 . 2007-06-07 01:42 -------- d-----w c:\program files\Spybot - Search & Destroy
    2009-04-20 18:40 . 2009-04-20 18:40 -------- d-----w c:\program files\Microsoft
    2009-04-20 18:40 . 2009-04-20 18:39 -------- d-----w c:\program files\Windows Live
    2009-04-20 18:40 . 2009-04-20 18:40 -------- d-----w c:\program files\Windows Live SkyDrive
    2009-04-20 18:36 . 2009-04-20 18:36 -------- d-----w c:\program files\Common Files\Windows Live
    2009-04-06 14:32 . 2008-11-12 22:03 38496 ----a-w c:\windows\system32\drivers\mbamswissarmy.sys
    2009-04-06 14:32 . 2008-11-12 22:03 15504 ----a-w c:\windows\system32\drivers\mbam.sys
    2009-03-29 01:45 . 2007-09-07 06:02 -------- d-----w c:\program files\Last.fm
    2009-03-27 12:44 . 2007-01-17 15:37 664 ----a-w c:\windows\system32\d3d9caps.dat
    2009-03-23 19:41 . 2009-03-23 19:41 -------- d-----w c:\program files\SoulseekNS
    2009-03-06 14:00 . 2006-03-16 04:00 284160 ----a-w c:\windows\system32\pdh.dll
    2009-03-03 00:18 . 2006-03-16 04:00 826368 ----a-w c:\windows\system32\wininet.dll
    2008-02-10 17:56 . 2007-09-02 03:22 67696 -c--a-w c:\program files\mozilla firefox\components\jar50.dll
    2008-02-10 17:56 . 2007-09-02 03:22 54376 -c--a-w c:\program files\mozilla firefox\components\jsd3250.dll
    2008-02-10 17:56 . 2007-09-02 03:22 34952 -c--a-w c:\program files\mozilla firefox\components\myspell.dll
    2008-02-10 17:56 . 2007-09-02 03:22 46720 -c--a-w c:\program files\mozilla firefox\components\spellchk.dll
    2008-02-10 17:56 . 2007-09-02 03:22 172144 -c--a-w c:\program files\mozilla firefox\components\xpinstal.dll
    .

    ((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))))
    .
    .
    *Note* empty entries & legit default entries are not shown
    REGEDIT4

    [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ctfmon.exe"="c:\windows\system32\ctfmon.exe" [2006-03-15 15360]
    "WMPNSCFG"="c:\program files\Windows Media Player\WMPNSCFG.exe" [2006-10-18 204288]

    [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
    "ehTray"="c:\windows\ehome\ehtray.exe" [2005-08-06 64512]
    "hpWirelessAssistant"="c:\program files\hpq\HP Wireless Assistant\HP Wireless Assistant.exe" [2006-05-04 458752]
    "NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2006-08-18 7585792]
    "NvMediaCenter"="c:\windows\system32\NvMcTray.dll" [2006-08-18 86016]
    "SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-04-01 761946]
    "QPService"="c:\program files\HP\QuickPlay\QPService.exe" [2006-07-11 102400]
    "QlbCtrl"="c:\program files\Hewlett-Packard\HP Quick Launch Buttons\QlbCtrl.exe" [2006-06-19 163840]
    "Cpqset"="c:\program files\Hewlett-Packard\Default Settings\cpqset.exe" [2006-05-30 40960]
    "RecGuard"="c:\windows\SMINST\RecGuard.exe" [2005-10-11 1187840]
    "QuickTime Task"="c:\program files\QuickTime\qttask.exe" [2007-11-14 286720]
    "iTunesHelper"="c:\program files\iTunes\iTunesHelper.exe" [2007-11-15 267048]
    "HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
    "nwiz"="nwiz.exe" - c:\windows\system32\nwiz.exe [2006-08-18 1617920]
    "MsmqIntCert"="mqrt.dll" - c:\windows\system32\mqrt.dll [2007-07-06 177152]
    "High Definition Audio Property Page Shortcut"="CHDAudPropShortcut.exe" - c:\windows\system32\CHDAudPropShortcut.exe [2006-07-26 61952]

    [HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
    "CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2006-03-15 15360]
    "DWQueuedReporting"="c:\progra~1\COMMON~1\MICROS~1\DW\dwtrig20.exe" [2007-08-24 437160]

    c:\documents and settings\Phil\Start Menu\Programs\Startup\
    ERUNT AutoBackup.lnk - c:\program files\ERUNT\AUTOBACK.EXE [2005-10-20 38912]

    c:\documents and settings\All Users\Start Menu\Programs\Startup\
    Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2006-5-12 581693]
    HP Pavilion Webcam Tray Icon.lnk - c:\program files\Hewlett-Packard\HP Pavilion Webcam\HPWebcam.exe [2007-1-9 98304]
    HP Photosmart Premier Fast Start.lnk - c:\program files\HP\Digital Imaging\bin\hpqthb08.exe [2005-9-24 73728]

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile]
    "EnableFirewall"= 0 (0x0)

    [HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
    "%windir%\\system32\\sessmgr.exe"=

    R1 ethgfvgd;ethgfvgd;c:\windows\system32\drivers\ethgfvgd.sys [2009-05-19 136192]
    R3 WebSTARNdis;WebSTAR DPX110;c:\windows\system32\DRIVERS\WebSTAR.sys [2001-01-12 14821]
    S1 is-873B5drv;is-873B5drv;c:\windows\system32\DRIVERS\28971972.sys [2008-07-08 148496]
    S2 WinDefend;Windows Defender;c:\program files\Windows Defender\MsMpEng.exe [2006-11-03 13592]


    --- Other Services/Drivers In Memory ---

    *Deregistered* - AFD
    *Deregistered* - ALG
    *Deregistered* - Apple Mobile Device
    *Deregistered* - Arp1394
    *Deregistered* - AudioSrv
    *Deregistered* - audstub
    *Deregistered* - Bonjour Service
    *Deregistered* - Browser
    *Deregistered* - BTKRNL
    *Deregistered* - btwdins
    *Deregistered* - Cdfs
    *Deregistered* - Compbatt
    *Deregistered* - COMSysApp
    *Deregistered* - CryptSvc
    *Deregistered* - DcomLaunch
    *Deregistered* - Dhcp
    *Deregistered* - dmio
    *Deregistered* - dmload
    *Deregistered* - dmserver
    *Deregistered* - Dnscache
    *Deregistered* - eabfiltr
    *Deregistered* - ehRecvr
    *Deregistered* - ehSched
    *Deregistered* - ERSvc
    *Deregistered* - EventSystem
    *Deregistered* - Fastfat
    *Deregistered* - FastUserSwitchingCompatibility
    *Deregistered* - Fips
    *Deregistered* - FltMgr
    *Deregistered* - Ftdisk
    *Deregistered* - Gpc
    *Deregistered* - helpsvc
    *Deregistered* - hpqwmiex
    *Deregistered* - HTTP
    *Deregistered* - HTTPFilter
    *Deregistered* - i2omgmt
    *Deregistered* - ImapiService
    *Deregistered* - IpNat
    *Deregistered* - iPod Service
    *Deregistered* - IPSec
    *Deregistered* - is-873B5drv
    *Deregistered* - JavaQuickStarterService
    *Deregistered* - KSecDD
    *Deregistered* - lanmanserver
    *Deregistered* - lanmanworkstation
    *Deregistered* - LightScribeService
    *Deregistered* - LmHosts
    *Deregistered* - McrdSvc
    *Deregistered* - mnmdd
    *Deregistered* - MountMgr
    *Deregistered* - MQAC
    *Deregistered* - MRxDAV
    *Deregistered* - MRxSmb
    *Deregistered* - MSDTC
    *Deregistered* - Msfs
    *Deregistered* - MSMQ
    *Deregistered* - MSMQTriggers
    *Deregistered* - mssmbios
    *Deregistered* - Mup
    *Deregistered* - NDIS
    *Deregistered* - NdisTapi
    *Deregistered* - Ndisuio
    *Deregistered* - NdisWan
    *Deregistered* - NDProxy
    *Deregistered* - NetBIOS
    *Deregistered* - NetBT
    *Deregistered* - Netman
    *Deregistered* - Nla
    *Deregistered* - Npfs
    *Deregistered* - Ntfs
    *Deregistered* - NtLmSsp
    *Deregistered* - Null
    *Deregistered* - NVSvc
    *Deregistered* - PnkBstrA
    *Deregistered* - PolicyAgent
    *Deregistered* - PptpMiniport
    *Deregistered* - ProtectedStorage
    *Deregistered* - PSched
    *Deregistered* - RasAcd
    *Deregistered* - Rasl2tp
    *Deregistered* - RasMan
    *Deregistered* - RasPppoe
    *Deregistered* - Raspti
    *Deregistered* - Rdbss
    *Deregistered* - RDPCDD
    *Deregistered* - rdpdr
    *Deregistered* - RemoteRegistry
    *Deregistered* - RMCAST
    *Deregistered* - RpcSs
    *Deregistered* - SamSs
    *Deregistered* - SCDEmu
    *Deregistered* - Schedule
    *Deregistered* - Secdrv
    *Deregistered* - seclogon
    *Deregistered* - SENS
    *Deregistered* - SharedAccess
    *Deregistered* - ShellHWDetection
    *Deregistered* - Spooler
    *Deregistered* - sptd
    *Deregistered* - sr
    *Deregistered* - srservice
    *Deregistered* - Srv
    *Deregistered* - SSDPSRV
    *Deregistered* - StarOpen
    *Deregistered* - stisvc
    *Deregistered* - swenum
    *Deregistered* - TapiSrv
    *Deregistered* - Tcpip
    *Deregistered* - TermDD
    *Deregistered* - TermService
    *Deregistered* - Themes
    *Deregistered* - TrkWks
    *Deregistered* - Udfs
    *Deregistered* - Update
    *Deregistered* - upnphost
    *Deregistered* - VgaSave
    *Deregistered* - VolSnap
    *Deregistered* - W32Time
    *Deregistered* - Wanarp
    *Deregistered* - WebClient
    *Deregistered* - WinDefend
    *Deregistered* - winmgmt
    *Deregistered* - WMPNetworkSvc
    *Deregistered* - wscsvc
    *Deregistered* - wuauserv
    *Deregistered* - WZCSVC

    [HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{44BBA844-CC51-11CF-AAFA-00AA00B6015C}]
    rundll32.exe advpack.dll,LaunchINFSection c:\windows\INF\CChat25.inf,PerUserAdd.NT
    .
    Contents of the 'Scheduled Tasks' folder

    2008-12-17 c:\windows\Tasks\AppleSoftwareUpdate.job
    - c:\program files\Apple Software Update\SoftwareUpdate.exe [2008-04-11 16:57]

    2009-05-21 c:\windows\Tasks\MP Scheduled Scan.job
    - c:\program files\Windows Defender\MpCmdRun.exe [2006-11-03 18:20]
    .
    - - - - ORPHANS REMOVED - - - -

    HKCU-Run-IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA} - c:\program files\Common Files\Nero\Lib\NMIndexStoreSvr.exe
    HKCU-Run-updateMgr - c:\program files\Adobe\Acrobat 7.0\Reader\AdobeUpdateManager.exe
    HKLM-Run-NBKeyScan - c:\program files\Nero\Nero8\Nero BackItUp\NBKeyScan.exe
    Notify-NavLogon - (no file)


    .
    ------- Supplementary Scan -------
    .
    uStart Page = hxxp://www.google.com/
    uInternet Connection Wizard,ShellNext = iexplore
    uInternet Settings,ProxyOverride = *.local;<local>
    uInternet Settings,ProxyServer = http=localhost:7171
    IE: E&xport to Microsoft Excel - c:\progra~1\MICROS~3\Office12\EXCEL.EXE/3000
    IE: Send To &Bluetooth - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
    DPF: {9AC81071-4B2C-48DF-A245-C131DD64B7D2} - hxxps://wwws.richmond.edu/UofRMachineCheck.cab
    FF - ProfilePath - c:\documents and settings\Phil\Application Data\Mozilla\Firefox\Profiles\bcy9re07.default\
    .

    **************************************************************************

    catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
    Rootkit scan 2009-05-21 22:45
    Windows 5.1.2600 Service Pack 2 NTFS

    scanning hidden processes ...

    scanning hidden autostart entries ...

    HKLM\Software\Microsoft\Windows\CurrentVersion\Run
    Cpqset = c:\program files\Hewlett-Packard\Default Settings\cpqset.exe????????????<?@? ????[??????Y?@?????<?@

    scanning hidden files ...

    scan completed successfully
    hidden files: 0

    **************************************************************************
    .
    --------------------- LOCKED REGISTRY KEYS ---------------------

    [HKEY_USERS\S-1-5-21-4242693575-1754446674-701612613-1005\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved\{9143D17B-6AC2-5CEA-A896-9EB2AB736C8A}*]
    @Allowed: (Read) (RestrictedCode)
    @Allowed: (Read) (RestrictedCode)
    "iaojmmdgmjnonddfoo"=hex:69,61,6f,6d,6b,6e,6d,6b,63,63,66,6a,6e,6c,64,64,6c,6b,
    00,00
    "hamjgmbiiappceog"=hex:69,61,6f,6d,6b,6e,6d,6b,63,63,66,6a,6e,6c,64,64,6c,6b,
    00,00

    [HKEY_USERS\S-1-5-21-4242693575-1754446674-701612613-1005\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
    "??"=hex:e1,78,c2,89,06,9e,c1,25,70,53,b7,c8,d1,29,ec,da,30,7a,03,a2,49,a0,2e,
    fc,bf,d1,13,3f,84,0e,89,24,16,f8,fa,68,e2,8f,b3,52,95,5a,39,0a,4f,02,59,4a,\
    "??"=hex:fb,a5,72,59,ae,c2,b8,f3,e0,72,1f,9e,7d,fb,a3,f8
    .
    --------------------- DLLs Loaded Under Running Processes ---------------------

    - - - - - - - > 'explorer.exe'(2604)
    c:\program files\iTunes\iTunesMiniPlayer.dll
    c:\program files\iTunes\iTunesMiniPlayer.Resources\en.lproj\iTunesMiniPlayerLocalized.dll
    c:\program files\iTunes\iTunesMiniPlayer.Resources\iTunesMiniPlayer.dll
    c:\windows\system32\WPDShServiceObj.dll
    c:\windows\system32\btncopy.dll
    c:\windows\system32\PortableDeviceTypes.dll
    c:\windows\system32\PortableDeviceApi.dll
    .
    ------------------------ Other Running Processes ------------------------
    .
    c:\windows\system32\msdtc.exe
    c:\program files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe
    c:\program files\Bonjour\mDNSResponder.exe
    c:\program files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
    c:\windows\ehome\ehrecvr.exe
    c:\windows\ehome\ehSched.exe
    c:\program files\Java\jre6\bin\jqs.exe
    c:\program files\Common Files\LightScribe\LSSrvc.exe
    c:\windows\system32\nvsvc32.exe
    c:\windows\system32\PnkBstrA.exe
    c:\windows\ehome\mcrdsvc.exe
    c:\windows\system32\mqsvc.exe
    c:\program files\Windows Media Player\wmpnetwk.exe
    c:\program files\Hewlett-Packard\Shared\hpqwmiex.exe
    c:\windows\system32\mqtgsvc.exe
    c:\program files\WIDCOMM\Bluetooth Software\BTStackServer.exe
    c:\windows\system32\dllhost.exe
    c:\windows\ehome\ehmsas.exe
    c:\windows\system32\wscntfy.exe
    c:\program files\HP\Digital Imaging\bin\hpqimzone.exe
    c:\program files\iPod\bin\iPodService.exe
    .
    **************************************************************************
    .
    Completion time: 2009-05-21 22:51 - machine was rebooted
    ComboFix-quarantined-files.txt 2009-05-21 21:50

    Pre-Run: 5,651,742,720 bytes free
    Post-Run: 5,631,078,400 bytes free

    WindowsXP-KB310994-SP2-Pro-BootDisk-ENU.exe
    [boot loader]
    timeout=2
    default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
    [operating systems]
    c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
    multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Windows XP Media Center Edition" /noexecute=optin /fastdetect

    323 --- E O F --- 2009-05-19 15:13

    Thanks again for your help, I was really struggling with this.
  4. 2009-05-22, 11:37 #4
    katana
    katana is offline
    Security Expert-Emeritus
    Join Date
    Oct 2006
    Location
    Manchester UK
    Posts
    3,425

    Default

    REMOVE P2P PROGRAMS

    IMPORTANT I notice there are signs of one or more P2P (Person to Person) File Sharing Programs on your computer.

    Soulseek

    Please read the Guidelines for P2P Programs where we explain why it's not a good idea to have them.

    Note: Even if you are using a "safe" P2P program, it is only the program that is safe. You will be sharing files from uncertified sources, and these are often infected.
    The bad guys use P2P filesharing as a major conduit to spread their wares.
    Go to Control Panel > Add/Remove Programs and uninstall the programs listed above (in red) NOW.

    ----------------------------------------------------------- -----------------------------------------------------------


    Custom CFScript
    • Please open Notepad (Start -> Run -> type notepad in the Open field -> OK) and copy and paste the text present inside the code box below:

      Code:
      http://forums.spybot.info/showthread.php?p=313520#post313520
Comment:: Katana
Collect::
c:\windows\system32\drivers\28971972.sys
c:\windows\sto453250.dat
c:\windows\system32\2335106829.dat
c:\windows\system32\drivers\ethgfvgd.sys
Folder::
c:\Program Files\Soulseek
c:\Program Files\SoulseekNS
DirLook::
c:\windows\system32\MAD MEN SCREENSAVER dir
Driver::
ethgfvgd
is-873B5drv
DDS::
uInternet Settings,ProxyOverride = *.local;<local>
uInternet Settings,ProxyServer = http=localhost:7171
ADS::
    • Save this as CFScript.txt and place it on your desktop.




    • Referring to the screenshot above, drag CFScript.txt into ComboFix.exe.
    • ComboFix will now run a scan on your system. It may reboot your system when it finishes. This is normal.
    • **Note**
      When CF finishes running, the ComboFix log will open along with a message box--do not be alarmed. With the above script, ComboFix will capture files to submit for analysis.
      • Ensure you are connected to the internet and click OK on the message box.
    • Copy and paste the contents of the log in your next reply.


    CAUTION: Do not mouse-click ComboFix's window while it is running. That may cause it to stall.
    Note: the above code was created specifically for this user. If you are not this user, do NOT follow these directions as they could damage the workings of your system.





    Kaspersky Online Scanner .
    Your Antivirus and/or Antispyware may give a warning during the scan. This is perfectly normal
    NOTE:- This scan is best done from IE (Internet Explorer)
    NOTE:- Vista users should start IE by Start(Vista Orb) >> Internet Explorer >> Right-Click Run As Admin
    Go Here http://www.kaspersky.com/kos/eng/par...avwebscan.html

    Read the Requirements and limitations before you click Accept.
    Once the database has downloaded, click My Computer in the left pane
    Now go and put the kettle on !
    When the scan has completed, click Save Report As...
    Enter a name for the file in the Filename: text box and then click the down arrow to the right of Save as type: and select text file (*.txt)
    Click Save - by default the file will be saved to your Desktop, but you can change this if you wish.


    **Note**

    To optimize scanning time and produce a more sensible report for review:
    • Close any open programs.
    • Turn off the real-time scanner of all antivirus or antispyware programs while performing the online scan.

    Note for Internet Explorer 7 users: If at any time you have trouble viewing the accept button of the license, click on the Zoom tool located at the bottom right of the IE window and set the zoom to 75%. Once the license is accepted, reset to 100%.

    Logs/Information to Post in Reply
    Please post the following logs/Information in your reply
    • Combofix Log
    • Kaspersky log
    • Do you have your XP CD ?
    • How are things running now ?
    Microsoft MVP Consumer Security 2009 -2010
    If we have helped, please consider a donation
    THESE INSTRUCTIONS ARE FOR THIS USER ONLY
« Previous Thread | Next Thread »

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  

Forum Rules