Problem with possible spyware

[cool_ting]

Hi Lonny, both done. fixme.reg as well as combo fix, and also installed the Avst scanner too.

Thanks.

Any further actions to take?

nicholas.tan - 06-12-17 9:19:10.45 Service Pack 2
ComboFix 06.11.27W - Running from: "C:\Documents and Settings\nicholas.tan\Desktop"

(((((((((((((((((((((((((((((((((((((((((((( Other Deletions )))))))))))))))))))))))))))))))))))))))))))))))))


C:\Program Files\Ipwins


((((((((((((((((((((((((((((((( Files Created from 2006-11-17 to 2006-12-17 ))))))))))))))))))))))))))))))))))


2006-12-16 18:19 90,112 --a------ C:\WINDOWS\system32\AVASTSS.scr
2006-12-16 18:19 87,424 --a------ C:\WINDOWS\system32\drivers\aswmon2.sys
2006-12-16 18:19 85,952 --a------ C:\WINDOWS\system32\drivers\aswmon.sys
2006-12-16 18:19 666,240 --a------ C:\WINDOWS\system32\aswBoot.exe
2006-12-16 18:19 36,176 --a------ C:\WINDOWS\system32\drivers\aswTdi.sys
2006-12-16 18:19 24,560 --a------ C:\WINDOWS\system32\drivers\aavmker4.sys
2006-12-16 18:19 16,352 --a------ C:\WINDOWS\system32\drivers\aswRdr.sys
2006-12-16 18:19 <DIR> d-------- C:\Program Files\Alwil Software
2006-12-14 11:45 <DIR> d-------- C:\!KillBox
2006-12-12 06:05 51,200 --a------ C:\WINDOWS\Dll.dll
2006-12-12 06:05 43,504 --a------ C:\WINDOWS\rundl132.exe
2006-12-12 06:05 43,504 --a------ C:\WINDOWS\Logo1_.exe
2006-12-09 11:22 79,360 --a------ C:\WINDOWS\system32\swxcacls.exe
2006-12-09 11:22 53,248 --a------ C:\WINDOWS\system32\Process.exe
2006-12-09 11:22 51,200 --a------ C:\WINDOWS\system32\dumphive.exe
2006-12-09 11:22 40,960 --a------ C:\WINDOWS\system32\swsc.exe
2006-12-09 11:22 4,094 --a------ C:\WINDOWS\system32\tmp.reg
2006-12-09 11:22 288,417 --a------ C:\WINDOWS\system32\SrchSTS.exe
2006-12-09 11:22 135,168 --a------ C:\WINDOWS\system32\swreg.exe
2006-12-09 03:22 <DIR> dr-h----- C:\Documents and Settings\nicholas.tan\Recent
2006-12-06 18:16 <DIR> d-------- C:\hijackthis
2006-12-04 08:37 <DIR> d-------- C:\Program Files\Spybot - Search & Destroy
2006-12-04 08:37 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Spybot - Search & Destroy
2006-12-03 22:19 <DIR> d-------- C:\WINDOWS\system32\ActiveScan
2006-12-03 21:53 <DIR> d-------- C:\Program Files\ESET
2006-11-30 07:00 78,848 --a------ C:\WINDOWS\system32\MSBIND.DLL
2006-11-30 07:00 <DIR> d-------- C:\Program Files\Common Files\ADO
2006-11-30 06:59 <DIR> d-------- C:\Program Files\GiftBox
2006-11-30 06:57 <DIR> d-------- C:\Program Files\Paragon Software
2006-11-25 09:36 <DIR> d-------- C:\Documents and Settings\All Users\Application Data\Trend Micro
2006-11-25 09:34 <DIR> d-------- C:\Program Files\Trend Micro
2006-11-22 21:49 <DIR> d-------- C:\Program Files\Microsoft
2006-11-18 10:47 <DIR> d-------- C:\Program Files\MSXML 4.0
2006-11-18 10:47 <DIR> d-------- C:\f0ed85f02cc510fe33


(((((((((((((((((((((((((((((((((((((((((((((((( Find3M Report )))))))))))))))))))))))))))))))))))))))))))))))))))))


2006-12-16 17:41 -------- d-------- C:\Program Files\Outlook Express
2006-12-16 17:41 -------- d-------- C:\Program Files\Common Files\System
2006-12-14 12:52 -------- d-------- C:\Documents and Settings\nicholas.tan\Application Data\Skype
2006-12-14 11:47 -------- d-------- C:\Program Files\Internet Explorer
2006-12-14 01:53 10 --ahs---- C:\Program Files\_desktop.ini
2006-12-07 14:40 2362184 --a------ C:\WINDOWS\system32\wmvcore.dll
2006-12-07 03:22 -------- d-------- C:\Program Files\MSN Messenger
2006-12-07 03:21 -------- d-------- C:\Program Files\Messenger
2006-12-07 03:20 -------- d-------- C:\Program Files\GetRight
2006-12-07 03:20 -------- d-------- C:\Program Files\Fingerprint Sensor
2006-12-06 18:23 -------- d-------- C:\Program Files\WinRAR
2006-12-06 18:21 -------- d-------- C:\Program Files\Morpheus
2006-12-03 19:55 -------- d-------- C:\Program Files\Common Files
2006-12-02 01:08 -------- d---s---- C:\Documents and Settings\nicholas.tan\Application Data\Microsoft
2006-11-30 09:40 -------- d-------- C:\Documents and Settings\nicholas.tan\Application Data\U3
2006-11-30 06:57 -------- d--h----- C:\Program Files\InstallShield Installation Information
2006-11-27 21:22 -------- d-------- C:\Program Files\MorpheusBar
2006-11-27 10:41 -------- d-------- C:\Program Files\WakeupTweak
2006-11-23 14:00 -------- d-------- C:\Documents and Settings\nicholas.tan\Application Data\AdobeUM
2006-11-22 20:59 -------- d--h----- C:\Program Files\Uninstall Information
2006-11-22 20:59 -------- d-------- C:\Program Files\Yahoo!
2006-11-22 20:59 -------- d-------- C:\Program Files\xerox
2006-11-22 20:59 -------- d-------- C:\Program Files\Windows Media Player
2006-11-22 20:59 -------- d-------- C:\Program Files\Warranty
2006-11-22 20:59 -------- d-------- C:\Program Files\Volo View Express
2006-11-22 20:59 -------- d-------- C:\Program Files\Toshiba
2006-11-22 20:59 -------- d-------- C:\Program Files\Synaptics
2006-11-22 20:59 -------- d-------- C:\Program Files\Softex
2006-11-22 20:59 -------- d-------- C:\Program Files\Skype
2006-11-22 20:59 -------- d-------- C:\Program Files\Realtek
2006-11-22 20:59 -------- d-------- C:\Program Files\QuickTime
2006-11-22 20:59 -------- d-------- C:\Program Files\PenPower
2006-11-22 20:59 -------- d-------- C:\Program Files\PDFCreator
2006-11-22 20:59 -------- d-------- C:\Program Files\Online Services
2006-11-22 20:59 -------- d-------- C:\Program Files\O2Micro
2006-11-22 20:59 -------- d-------- C:\Program Files\MSN
2006-11-22 20:58 -------- d-------- C:\Program Files\ltmoh
2006-11-22 20:58 -------- d-------- C:\Program Files\Logitech
2006-11-22 20:58 -------- d-------- C:\Program Files\K-Lite Codec Pack
2006-11-22 20:58 -------- d-------- C:\Program Files\Java
2006-11-22 20:58 -------- d-------- C:\Program Files\IrfanView
2006-11-22 20:58 -------- d-------- C:\Program Files\Intel
2006-11-22 20:58 -------- d-------- C:\Program Files\HP
2006-11-22 20:58 -------- d-------- C:\Program Files\Hewlett-Packard
2006-11-22 20:58 -------- d-------- C:\Program Files\Fujitsu
2006-11-22 20:58 -------- d-------- C:\Program Files\CyberLink
2006-11-22 20:58 -------- d-------- C:\Program Files\Chipset.log
2006-11-22 20:58 -------- d-------- C:\Program Files\AVI MPEG RM WMV Splitter
2006-11-22 20:58 -------- d-------- C:\Program Files\AuthenTec
2006-11-22 20:58 -------- d-------- C:\Program Files\Ahead
2006-11-22 20:58 -------- d-------- C:\Program Files\Adobe
2006-11-21 15:09 -------- d-------- C:\Documents and Settings\nicholas.tan\Application Data\Adobe
2006-11-16 12:46 -------- d-------- C:\Documents and Settings\nicholas.tan\Application Data\VMware
2006-11-10 18:04 -------- d-------- C:\Documents and Settings\nicholas.tan\Application Data\Apple Computer
2006-11-08 13:06 679424 --a------ C:\WINDOWS\system32\inetcomm.dll
2006-11-07 13:45 2508 --a------ C:\Documents and Settings\nicholas.tan\Application Data\$_hpcst$.hpc
2006-11-07 13:43 -------- d-------- C:\Program Files\Common Files\Microsoft Shared
2006-11-06 00:04 -------- d-------- C:\Program Files\Common Files\FotoWire
2006-11-06 00:04 -------- d-------- C:\Documents and Settings\nicholas.tan\Application Data\FotoWire
2006-11-06 00:02 -------- d-------- C:\Program Files\Common Files\Logitech
2006-11-04 14:14 1245696 --a------ C:\WINDOWS\system32\msxml4.dll
2006-11-02 16:45 -------- d-------- C:\Program Files\Common Files\Ahead
2006-10-27 15:09 6049280 --------- C:\WINDOWS\system32\ieframe.dll
2006-10-27 15:09 50688 --------- C:\WINDOWS\system32\msfeedsbs.dll
2006-10-27 15:09 458752 --------- C:\WINDOWS\system32\msfeeds.dll
2006-10-27 15:09 413696 --a------ C:\WINDOWS\system32\vbscript.dll
2006-10-27 15:09 231424 --a------ C:\WINDOWS\system32\webcheck.dll
2006-10-27 15:09 180736 --------- C:\WINDOWS\system32\ieui.dll
2006-10-27 15:09 156160 --a------ C:\WINDOWS\system32\msls31.dll
2006-10-27 10:07 2560 --a------ C:\WINDOWS\_MSRSTRT.EXE
2006-10-27 02:44 71680 --a------ C:\WINDOWS\system32\admparse.dll
2006-10-27 02:44 55296 --a------ C:\WINDOWS\system32\iesetup.dll
2006-10-27 02:44 54784 --a------ C:\WINDOWS\system32\ie4uinit.exe
2006-10-27 02:44 43008 --a------ C:\WINDOWS\system32\iernonce.dll
2006-10-27 02:44 382976 --a------ C:\WINDOWS\system32\iedkcs32.dll
2006-10-27 02:44 229376 --a------ C:\WINDOWS\system32\ieaksie.dll
2006-10-27 02:44 152064 --a------ C:\WINDOWS\system32\ieakeng.dll
2006-10-27 02:44 13312 --a------ C:\WINDOWS\system32\ieudinit.exe
2006-10-27 02:44 123904 --a------ C:\WINDOWS\system32\advpack.dll
2006-10-27 02:42 161792 --a------ C:\WINDOWS\system32\ieakui.dll
2006-10-22 11:39 -------- d-------- C:\Documents and Settings\nicholas.tan\Application Data\GetRightToGo
2006-10-19 21:56 713216 --a------ C:\WINDOWS\system32\sxs.dll
2006-10-17 13:06 78336 --a------ C:\WINDOWS\system32\ieencode.dll
2006-10-17 13:05 40960 --a------ C:\WINDOWS\system32\licmgr10.dll
2006-10-17 13:05 206336 --------- C:\WINDOWS\system32\WinFXDocObj.exe
2006-10-17 13:05 105984 --a------ C:\WINDOWS\system32\url.dll
2006-10-17 13:04 101376 --a------ C:\WINDOWS\system32\occache.dll
2006-10-17 13:03 17408 --a------ C:\WINDOWS\system32\corpol.dll
2006-10-17 12:58 61952 --------- C:\WINDOWS\system32\icardie.dll
2006-10-17 12:58 12288 --------- C:\WINDOWS\system32\msfeedssync.exe
2006-10-17 12:57 36352 --a------ C:\WINDOWS\system32\imgutil.dll
2006-10-17 12:57 266752 --------- C:\WINDOWS\system32\iertutil.dll
2006-10-17 12:56 45568 --a------ C:\WINDOWS\system32\mshta.exe
2006-10-17 12:28 48128 --a------ C:\WINDOWS\system32\mshtmler.dll
2006-10-17 12:27 380928 --------- C:\WINDOWS\system32\ieapfltr.dll
2006-10-13 20:35 65536 --a------ C:\WINDOWS\system32\nwwks.dll
2006-10-13 20:35 64000 --a------ C:\WINDOWS\system32\nwapi32.dll
2006-10-13 20:35 142336 --a------ C:\WINDOWS\system32\nwprovau.dll
2006-09-26 22:23 14 --a------ C:\WINDOWS\system32\systeminfo.dll


(((((((((((((((((((((((((((((((((((((((((( Reg Loading Points ))))))))))))))))))))))))))))))))))))))))))))))))

*Note* empty entries are not shown

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\run]
"ctfmon.exe"="C:\\WINDOWS\\system32\\ctfmon.exe"
"MsnMsgr"="\"C:\\Program Files\\MSN Messenger\\MsnMsgr.Exe\" /background"
"LogitechSoftwareUpdate"="\"C:\\Program Files\\Logitech\\Video\\ManifestEngine.exe\" boot"
"H/PC Connection Agent"="\"D:\\Program Files\\Microsoft ActiveSync\\wcescomm.exe\""

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run]
"SynTPEnh"="C:\\Program Files\\Synaptics\\SynTP\\SynTPEnh.exe"
"RTHDCPL"="RTHDCPL.EXE"
"Alcmtr"="ALCMTR.EXE"
"AGRSMMSG"="AGRSMMSG.exe"
"ATSwpNav"="\"C:\\Program Files\\Fingerprint Sensor\\ATSwpNav\" -run"
"OmniPass"="C:\\Program Files\\Softex\\OmniPass\\scureapp.exe"
"igfxhkcmd"="C:\\WINDOWS\\system32\\hkcmd.exe"
"igfxpers"="C:\\WINDOWS\\system32\\igfxpers.exe"
"FJUPDNV_Chitose"="C:\\Program Files\\Fujitsu\\updnavi\\updnavi.exe"
"LoadFUJ02E3"="C:\\Program Files\\Fujitsu\\FUJ02E3\\FUJ02E3.exe"
"IndicatorUtility"="C:\\Program Files\\Fujitsu\\Fujitsu Hotkey Utility\\IndicatorUty.exe"
"LoadFujitsuQuickTouch"="C:\\Program Files\\Fujitsu\\Application Panel\\QuickTouch.exe"
"LoadBtnHnd"="C:\\Program Files\\Fujitsu\\BtnHnd\\BtnHnd.exe"
"IntelZeroConfig"="\"C:\\Program Files\\Intel\\Wireless\\bin\\ZCfgSvc.exe\""
"IntelWireless"="\"C:\\Program Files\\Intel\\Wireless\\Bin\\ifrmewrk.exe\" /tf Intel PROSet/Wireless"
"EOUApp"="\"C:\\Program Files\\Intel\\Wireless\\Bin\\EOUWiz.exe\""
"HPDJ Taskbar Utility"="C:\\WINDOWS\\system32\\spool\\drivers\\w32x86\\3\\hpztsb12.exe"
"SunJavaUpdateSched"="\"C:\\Program Files\\Java\\jre1.5.0_09\\bin\\jusched.exe\""
"QuickTime Task"="\"C:\\Program Files\\QuickTime\\qttask.exe\" -atboottime"
"NeroFilterCheck"="C:\\WINDOWS\\system32\\NeroCheck.exe"
"LVCOMSX"="C:\\WINDOWS\\system32\\LVCOMSX.EXE"
"LogitechVideoRepair"="C:\\Program Files\\Logitech\\Video\\ISStart.exe "
"LogitechVideoTray"="C:\\Program Files\\Logitech\\Video\\LogiTray.exe"
"avast!"="C:\\PROGRA~1\\ALWILS~1\\Avast4\\ashDisp.exe"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\IMAIL]
"Installed"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MAPI]
"Installed"="1"
"NoChange"="1"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run\OptionalComponents\MSFS]
"Installed"="1"

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components]
"DeskHtmlVersion"=dword:00000110
"DeskHtmlMinorVersion"=dword:00000005
"Settings"=dword:00000001
"GeneralFlags"=dword:00000001

[HKEY_CURRENT_USER\software\microsoft\internet explorer\desktop\components\0]
"Source"="About:Home"
"SubscribedURL"="About:Home"
"FriendlyName"="My Current Home Page"
"Flags"=dword:00000002
"Position"=hex:2c,00,00,00,cc,00,00,00,00,00,00,00,34,03,00,00,e2,02,00,00,00,\
00,00,00,01,00,00,00,01,00,00,00,01,00,00,00,00,00,00,00,00,00,00,00
"CurrentState"=hex:04,00,00,40
"OriginalStateInfo"=hex:18,00,00,00,ff,ff,00,00,ff,ff,00,00,ff,ff,ff,ff,ff,ff,\
ff,ff,04,00,00,00
"RestoredStateInfo"=hex:18,00,00,00,6a,02,00,00,23,00,00,00,a4,00,00,00,9a,00,\
00,00,01,00,00,00

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\sharedtaskscheduler]
"{438755C2-A8BA-11D1-B96B-00A0C90312E1}"="Browseui preloader"
"{8C7461EF-2B13-11d2-BE35-3078302C2030}"="Component Categories cache daemon"

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shellexecutehooks]
"{AEB6717E-7E19-11d0-97EE-00C04FD91972}"=""

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer\Run]

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"dontdisplaylastusername"=dword:00000000
"legalnoticecaption"=""
"legalnoticetext"=""
"shutdownwithoutlogon"=dword:00000001
"undockwithoutlogon"=dword:00000001

[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_USERS\s-1-5-18\software\microsoft\windows\currentversion\policies\explorer]
"NoDriveTypeAutoRun"=dword:00000091

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\shellserviceobjectdelayload]
"PostBootReminder"="{7849596a-48ea-486e-8937-a2a3009f31a9}"
"CDBurn"="{fbeb8a05-beee-4442-804e-409d6c4515e9}"
"WebCheck"="{E6FB5E20-DE35-11CF-9C87-00AA005127ED}"
"SysTray"="{35CEC8A3-2BE6-11D2-8773-92E220524153}"

HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon\notify\OPXPGina

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\securityproviders]
"SecurityProviders"="msapsspc.dll, schannel.dll, digest.dll, msnsspc.dll"

Completion time: 06-12-17 9:20:07.39
C:\ComboFix.txt ... 06-12-17 09:20

[LonnyRJones]

C:\WINDOWS\rundl132.exe < delete that file at only that location
Submit these here please
C:\WINDOWS\Dll.dll
C:\WINDOWS\Logo1_.exe
http://www.virustotal.com/flash/index_en.html
Let us know the results

Hows that PC running ?

[cool_ting]

Hi Loony,

These are the results. The other file dll.dll got caught by Avast and was deleted. The system felt fine after the last report, but suddenly went cold yesterday. I was forced to restore back to 17th night, although I remember that I did not make any further cleaning on the 17th as the last was done on the 16th. Do you think this would have any effect? Or is there something I should run to check again?

If it is too much trouble, I am also thinking that a reformat may be a better solution. Please let me know your comments.

Thanks

Antivirus Version Update Result
AntiVir 7.3.0.19 12.19.2006 TR/Crypt.NSPM.Gen
Authentium 4.93.8 12.15.2006 Possibly a new variant of W32/PWStealer.gen1
Avast 4.7.892.0 12.16.2006 no virus found
AVG 386 12.18.2006 Worm/Delf.ZU
BitDefender 7.2 12.19.2006 Win32.Worm.Viking.BM
CAT-QuickHeal 8.00 12.18.2006 (Suspicious) - DNAScan
ClamAV devel-20060426 12.19.2006 no virus found
DrWeb 4.33 12.19.2006 Win32.HLLW.Gavir.54
eSafe 7.0.14.0 12.17.2006 suspicious Trojan/Worm
eTrust-InoculateIT 23.73.89 12.19.2006 Win32/Looked.CG!Dropped!Worm
eTrust-Vet 30.3.3259 12.18.2006 Win32/Looked.CO
Ewido 4.0 12.19.2006 Worm.Viking.ct
Fortinet 2.82.0.0 12.19.2006 W32/Viking.CT
F-Prot 3.16f 12.15.2006 Possibly a new variant of W32/PWStealer.gen1
F-Prot4 4.2.1.29 12.19.2006 W32/PWStealer.gen1
Ikarus T3.1.0.27 12.19.2006 Worm.Win32.Viking.ct
Kaspersky 4.0.2.24 12.19.2006 Worm.Win32.Viking.ct
McAfee 4921 12.18.2006 W32/HLLP.Philis.cl
Microsoft 1.1904 12.19.2006 no virus found
NOD32v2 1927 12.19.2006 Win32/Viking.CH
Norman 5.80.02 12.18.2006 W32/Viking.DQ
Panda 9.0.0.4 12.19.2006 W32/Viking.DN.drp
Prevx1 V2 12.19.2006 Worm.Looked
Sophos 4.12.0 12.18.2006 Mal/Packer
Sunbelt 2.2.907.0 12.18.2006 no virus found
TheHacker 6.0.3.134 12.18.2006 W32/Viking.ct
UNA 1.83 12.18.2006 Worm.Win32.Viking.ct
VBA32 3.11.1 12.18.2006 MalwareScope.Worm.Viking.5

[LonnyRJones]

Ok, delete C:\WINDOWS\Logo1_.exe

Since you used system restore and went back a few days, probaly to an infected restore point, you can either repeat all we have done so fare in this thread or use system restore to go back to before the trouble started.

Let me know what you decide to do ?

[tashi]

Due to lack of feedback this topic has been archived.

Good luck.